Summary

  • RFC 9716 extends Reply Path TLV so LSP ping and traceroute replies can traverse multiple SR-MPLS domains without relying on end-to-end IP reachability.
  • A head-end may supply the complete reverse stack, or ABRs and ASBRs may add and translate segments incrementally; those are decisions made from topology knowledge and local policy, not neutral facts about the forward service.
  • Keep the request route, every return-stack mutation, FEC validation, reply code, receipt and later customer observation as linked but separate records.

The packet that came home with other people’s decisions

An LSP traceroute leaves a head-end, crosses an IGP boundary and reaches a router in a remote AS. The target responds. A valid echo reply returns to the initiator as an MPLS packet. On a dashboard, the exchange looks complete.

But the reply did not simply retrace an inevitable road. One border router selected a node segment. Another translated a node address into a label using its own Segment Routing Global Block. An AS boundary router added its Node-SID and a reverse Egress Peer Engineering SID. A different border could have declined to participate. The receipt proves that this particular request and this particular constructed return path completed; it does not prove that ordinary service traffic took either route.

RFC 9716, published in February 2025 on the IETF Standards Track, addresses a practical gap. LSP ping and traceroute normally return results over IP. In a multi-AS or multi-IGP SR-MPLS network, a router inside a remote domain may have no IP route back to the probe source. Building GRE tunnels or static routes to every router can be too heavy. RFC 9716 instead carries an SR reverse path in the existing Reply Path TLV and sends the echo reply through ordinary MPLS forwarding.

The scope is deliberately bounded. The domains belong to one administration or to closely cooperating administrations. All nodes in each domain are SR capable, or SR operates as an overlay and traceroute examines only the SR nodes. SRv6 is outside scope, as is end-to-end OAM across a mixture of IPv4-only and IPv6-only domains. Standards status defines the protocol contract; it does not establish adoption, interoperability or a customer result.

A return stack has an author

RFC 7110 created Reply Mode 5, “Reply via Specified Path”, and Reply Path TLV. RFC 9716 defines three segment encodings for SR-MPLS: Type-A carries a label; Type-C carries an IPv4 node address and optional SID; Type-D does the same with IPv6. An echo request using these procedures must select Reply Mode 5 and include an ordered reverse path. The responder turns that order into the reply’s MPLS label stack and must not silently add other labels.

That encoding can make a route executable. It does not make the route authorless. Segment type is governed by local policy. A receiver may override some supplied label fields under its policy. A responder may check whether the top label is reachable in its LFIB. If the initiator or controller supplies the complete stack, the evidence record needs the controller, topology version, algorithm, operator input, chosen segments and time of construction. “Reply Path TLV present” is not enough to reconstruct why that path existed.

The forward check retains its own meaning. RFC 9716 does not change the Forwarding Equivalence Class validation procedures in RFC 8029 and RFC 8287. FEC validation tests a relation between the packet’s forwarding object and control-plane understanding. Return-stack construction decides how the result gets home. A valid FEC result cannot certify a hidden return-path mutation; a delivered reply cannot retroactively validate the forward FEC.

Traceroute can build the road behind it

The more distinctive procedure appears when the head-end lacks a complete view of remote domains. During traceroute, border nodes may build the return path incrementally. An ABR can prepend its node label. An ASBR can add its Node-SID plus a reverse EPE-SID toward the AS from which the request arrived. Each participating boundary returns code 0x0006, instructing the initiator to use the returned Reply Path TLV in the next request as the traceroute TTL advances.

Non-uniform SRGBs turn translation into evidence. A Type-C or Type-D node address may need to become a Type-A label at the border using that border router’s own SRGB. Downstream routers cannot be assumed to know which foreign SRGB translates the address. The returned stack is therefore a sequence of local interpretations, not a universal name written once at the source.

Local policy is visible in the protocol. A border router can refuse dynamic construction and return 0x0007. The operator may then provide an explicit path or use another way to verify the SR Policy. This is not a defective version of success. It is an authoritative refusal by one domain and should be retained with the policy version, node, request identity and subsequent operator choice.

Silence is also information, though it is harder to interpret. A responder may find the top label unreachable. It may lack an IP fallback to report that failure. An echo reply sent through a default route may never arrive. Logs, missing sequence numbers and timeouts must not be flattened into “network down”; they delimit where evidence ceased.

Six records, not one green light

A defensible inter-domain diagnostic keeps at least six linked records:

  1. Request identity and forward route: sender handle, sequence, timestamp, target FEC, TTL, imposed label stack and known downstream mappings.
  2. Return-path proposal: controller or operator, topology and LSDB versions, ordered Type-A/C/D segments, algorithms and field overrides.
  3. Boundary mutations: every ABR/ASBR that prepended a segment, the SRGB used for translation, selected interface or EPE-SID, and local policy version.
  4. Validation and reply decision: forward FEC result, Reply Path processing result, 0x0006, 0x0007, malformed/unreachable outcomes and any fallback.
  5. Receipt: actual responder, arrival time, returned stack and the observable path by which the echo reply reached the initiator.
  6. Service outcome: separately scoped probes or telemetry showing whether the intended customer traffic class reached its application under the relevant policy and interval.

These records can be correlated without being collapsed. An echo reply may demonstrate that a remote node was able to respond and that one MPLS return stack was forwardable at that moment. It says less about a different production stack, the unobserved branches of an ECMP topology, future state, capacity, application health or the customer’s reverse direction.

Trust is part of the deployment model

The mechanism assumes that sharing domain-internal information is acceptable among the participating administrations. The security section also acknowledges the contrary risk: probes can be used to extract that information. RFC 9716 requires origin-based filtering and recommends link protection such as MACsec on vulnerable inter-domain links, while inheriting RFC 8029’s denial-of-service controls.

This makes observability and disclosure a coupled decision. A controller that asks every border to reveal enough topology to construct a return path gains diagnostic reach and increases the value of the exposed metadata. Access policy, retention, query rate and incident review are not accessories to the protocol; they determine who may create this evidence and who may see it.

Sources

Primary records: RFC 9716, its RFC Editor record and IETF Datatracker record. Mechanism context: RFC 7110, RFC 8029, RFC 8287, RFC 9256, RFC 8402, RFC 8660 and the IANA MPLS LSP Ping Parameters registry.