Summary

  • RFC 9772 requires an active OAM packet to share the path and treatment of the object it monitors. A Management-VNI reply therefore proves something precise about that control-channel test, not every tenant flow carried by the tunnel.
  • Tenant-to-tenant testing is explicitly outside the RFC's scope. Application health, service-chain state and customer outcome need receipts beyond an OAM endpoint response.
  • Operators should record the VNI, entropy, QoS, direction, endpoint and observation window behind every green result, then name the next untested boundary instead of calling the whole service healthy.

The alarm arrived with an awkward contradiction. A tenant said its application could not complete a transaction, while the network console showed a bright green response from the Geneve tunnel. The probe had left one network-virtualisation edge, crossed the overlay, reached the remote endpoint and returned. Both observations could be true.

That is the management value of RFC 9772. It does not make active operations, administration and maintenance omniscient. It defines the conditions under which a deliberately constructed test packet can speak accurately about a particular monitored object. The precision is the feature. Trouble begins when an organisation converts that narrow receipt into a claim about layers the packet never entered.

Geneve carries tenant packets over an underlying physical network while allowing metadata to travel with the encapsulation. Active OAM injects special test packets into that environment. RFC 9772 names ICMP, BFD and STAMP as examples, but the protocol name is less important than the measurement contract: which traffic is being represented, where the test begins and ends, and what treatment it receives on the way.

Fate sharing is a specification, not an adjective

The RFC requires OAM test traffic to be in-band with the monitored traffic. It must traverse the same links and interfaces and receive the same quality-of-service treatment in the forward direction. In a multipath underlay, the operator also needs a way to encode entropy so the test follows the same data-flow path as the traffic whose condition it is meant to represent.

Those requirements expose why “the tunnel is up” is often too large a sentence. A tunnel can carry many flows distributed across different equal-cost paths, queues and policy branches. One probe with one entropy value samples one of those possibilities. A result becomes relevant to a particular tenant flow only when the probe is constructed to share that flow's VNI, path selection and treatment. Even then, relevance is bounded by the time and packet characteristics sampled.

RFC 7799 supplies the wider measurement vocabulary: active methods introduce dedicated traffic. That makes their evidence controllable and repeatable, but not identical to every production packet. A well-designed probe is a model of the monitored object. The operator must preserve the assumptions that make the model faithful.

The Management VNI proves a different thing

RFC 9772 defines a Geneve control channel and recommends a Management Virtual Network Identifier, with value 1 as the default. The channel must not carry tenant data. Packets received through it must not be forwarded to a tenant system. Instead, the Management VNI can terminate on the tenant-facing side of the Geneve encapsulation and decapsulation function so that a test exercises that machinery before reaching local management logic.

An ICMP request can therefore cross the Geneve path, be decapsulated, reach the endpoint's management function, trigger an echo reply and return inside Geneve. That is valuable. It can expose faults that a special shortcut around the encapsulation hardware would miss. It can show that the tested endpoints and enough of the overlay path were responsive during the observation.

It is also deliberately not a tenant transaction. No tenant is connected to the control channel. The reply did not prove that a tenant VNI was mapped correctly, that a tenant firewall admitted the flow, that a service mesh chose a healthy backend, that a workload accepted a socket, or that a database committed a change. The Management VNI's isolation is a safety and operational property; it is also the reason its success cannot stand for the application.

RFC 9772 addresses the narrower tenant case separately. If the goal is to monitor the condition experienced by a particular tenant flow, the test packet must use the associated VNI and be in-band with that flow. This closes part of the evidentiary gap. It still does not turn the packet into the user's request. The RFC explicitly puts end-to-end testing between tenant systems outside scope.

A reply contains two paths, not one verdict

The fate-sharing language focuses on the forward direction, from test ingress toward the egress endpoint. A visible reply adds evidence about a return trip. Those paths may be asymmetric. They may select different underlay links, queues or failure domains. A round-trip time is therefore a composition of two directional experiences, not proof that one invariant path was healthy in both directions.

This matters when a probe fails as much as when it succeeds. Silence does not uniquely locate the defect. The request may have been dropped before encapsulation, along the forward path, during endpoint classification, by control-plane rate limiting, or on the return path. The collector itself may have missed the response. A timeout is a trigger for localization, not a map pin.

Success is narrower but still composite. It shows that the chosen packet was admitted, travelled far enough to reach responsive OAM or management logic, produced a response, and returned within the observer's window. It does not enumerate every branch the flow might take tomorrow or under a different entropy value. Repeated samples can improve coverage; they do not erase the need to state what was sampled.

The endpoint is not the workload

RFC 9521 describes BFD for point-to-point Geneve tunnels and locates the continuity check between Geneve tunnel endpoints or virtual access points. That is an important operational boundary. It lets a system detect path failures quickly without pretending to execute the tenant's application.

Likewise, STAMP can provide performance measurements. A delay or loss sample belongs to the defined measurement session. It does not automatically include a load balancer decision, workload scheduler, authentication dependency, storage call or business rule. A service can fail above a healthy overlay, and an overlay can fail while an application briefly appears healthy through caching or retries.

The right response is not to distrust OAM. It is to assemble an evidence ladder. First prove that the probe was constructed with the intended VNI, entropy and QoS. Then record origination and encapsulation. Establish fate sharing for the named forward flow. Record remote decapsulation and OAM recognition. Record response generation and return. Add repeated coverage across relevant paths and time. Use a tenant-specific test where required. Finally, use application telemetry or a synthetic transaction to prove the user-visible service.

Each rung answers a different question. A dashboard that stores only “up” deletes the distinctions an incident team needs. A dashboard that stores the monitored object and receipt can say, for example: “Management-VNI ICMP response observed between these NVEs; tenant VNI and application path not tested.” The longer sentence produces faster decisions because it closes fewer doors prematurely.

Controls can shape the observation

OAM traffic itself needs protection. RFC 9772 requires a control to limit the rate of packets punted to the Geneve control plane so they cannot overload it. It also applies the Generalized TTL Security Mechanism: an inner TTL or Hop Limit other than 255 must be discarded. These are sensible safeguards, but they become part of interpretation.

Under load, rate limiting can make missing replies look like a network fault. A malformed or differently sourced packet can be rejected before it measures the intended path. Clock quality affects delay measurements. Collector loss can imitate remote silence. Operators should therefore keep probe configuration, admission decisions, rate-limit counters and collector health beside the measurement result.

No source here establishes that a named vendor or operator has deployed RFC 9772, nor does the RFC document a measured outage or product performance. Its value is architectural: it forces measurement claims to remain attached to the packet, path and endpoint that generated them. That is exactly the discipline operational leadership needs when a green indicator and a failing customer arrive at the same time.

Sources