Summary

  • RIP's simple split horizon withheld a route from the neighbour that supplied it; poisoned reverse sent the entry back with metric 16, explicitly ruling the learner out as a return path.
  • That extra negative evidence breaks a two-router loop without waiting for timeout, but it enlarges updates and cannot prevent three or more routers from reinforcing one another's stale beliefs.

A protocol documented after it had spread

RIP entered the RFC record as running practice. RFC 1058, published in June 1988, said that it was documenting routing software already in wide use and reconciling implementations that disagreed in detail. Its immediate model came from Berkeley Unix routed; its longer ancestry ran through Xerox PUP and XNS, while distance-vector routing itself reached back into early ARPANET work.

That history matters because the stability rules were not ornaments added to a clean mathematical design. They were repairs for behavior seen in deployed networks. A router did not possess a map. For each destination it kept a metric and the neighbour on whose report its preferred route depended. Periodically, neighbours exchanged their current distances. Every participant built a local answer from adjacent claims.

The scheme was intentionally modest. RIP was an interior gateway protocol for reasonably homogeneous networks of moderate size. It was not intended to coordinate the whole Internet. Its compact knowledge model was useful precisely because a router could participate without learning the complete topology.

When a copy looked like independent evidence

The dangerous case began after failure. Suppose router A reaches a destination through B. If B loses its real path but hears A continue to advertise reachability, B may treat A's report as an alternative. Yet A's claim was derived from B in the first place. The two copies are not independent observations; they are one stale belief returning through another mouth.

Each local calculation can look reasonable. A says that B is best. B later says that A is best. Packets then circulate while the advertised distance rises. The problem is not that either router owns the route or has authority over the other. It is that the update carries a number without carrying the full lineage of how that number was learned.

RIP called the resulting process counting to infinity. A failed destination could appear progressively farther away as neighbours added hop costs to one another's obsolete reports. The protocol needed an infinity small enough that this climb would end.

Sixteen was failure and a size limit

RIP chose metric 16 as infinity. Usable paths therefore stop at 15 hops. That is sometimes described only as an old scalability weakness, but it was also a convergence choice: a smaller infinity gives a false route fewer increments before the domain must call it unreachable.

The bargain is explicit in RFC 1058. Infinity must exceed every valid route, yet should be no larger than necessary because counting must stop. The same number that bounds network diameter also bounds how long a particular failure can masquerade as distance.

Metric 16 is not a statement about the world. It means that this RIP route is unreachable in the relevant exchange and current local state. Another protocol, interface or later update may supply a valid path. Treating infinity as scoped evidence rather than universal truth is essential to understanding poisoned reverse.

Silence removed the echo; poison displaced it

Simple split horizon applies one lineage rule: do not advertise a route back towards the neighbour or interface from which it was learned. If A's best route to D came from B, A omits D when updating B. A refuses to turn B's own information into apparent corroboration.

Poisoned reverse is more explicit. A includes D in the update to B but changes the metric to 16. The message does not say that D has vanished everywhere. It says: do not use A to reach D, because A's own selected path points back through B.

Why send a negative row when omission seems to convey the same topology? Time makes the difference. If A merely falls silent, B may retain an old route through A until its timer expires. If A sends infinity, B can invalidate that return path as soon as the update is processed.

The route has therefore come back as unreachable without being contradicted in every context. Its positive value may still be used away from the learning interface. Only the circular return is poisoned.

The bytes purchased a faster withdrawal

RFC 1058 was candid about the cost. On a campus backbone, a router might learn many routes from the shared network. Simple split horizon leaves those entries out when advertising onto that network. Poisoned reverse sends them all with metric 16. A large update may consist mainly of declarations that the advertising router should not be used.

In a static snapshot those declarations add little. Every neighbour already knows it supplied the routes. During change, however, the explicit negatives can replace stale positives immediately. More bandwidth buys a sharper transition.

The standard left room for judgement: simple split horizon, poisoned reverse, an operator-selectable mode, or a hybrid that poisons a changed route for a limited period and later omits it. The choice did not alter what metric 16 meant. It decided how much negative evidence to carry and for how long.

Two liars were stopped; three could continue

The most important sentence in the design is its limit. Poisoned reverse prevents loops involving only two routers. If A and B point at each other, each receives the other's explicit infinity and the loop breaks without waiting for silence to age out.

Add a third router and the lineage can disappear around the corner. A may depend on B, B on C and C on A. None necessarily sends the route directly back to the immediate neighbour from which that neighbour's own belief originated. Split horizon cannot see the full circle. The metrics may continue climbing until 16.

Triggered updates were designed to shorten that interval. When a selected route changes, a router sends an update without waiting for the next periodic round. Routers whose own selected paths depend on it accept the worse metric and propagate the change backwards. But messages can be delayed, interleaved with regular updates or overtaken by different local events. The cascade accelerates convergence; it does not create one simultaneous network transaction.

A withdrawal had to remain visible before deletion

RIP also separated invalidation from erasure. A route that times out is marked unreachable and advertised with metric 16 during a garbage-collection interval before its table entry disappears. Removing it instantly would save state but could leave neighbours with positive copies and no explicit correction.

This is the same logic as poisoned reverse at a different boundary. Negative information has an operational lifetime. It must remain observable long enough to displace the state it revokes. Later deletion is safe only after the withdrawal has had a chance to travel.

The rule survived changes in the packet format

The Internet standards record kept this distinction. RFC 1812 made split horizon mandatory for RIP implementations and poisoned reverse recommended, while allowing an operator control because the added routing traffic could be material. Its guidance also considered limiting poison to the period in which old state might remain alive.

IPv6 did not make the epistemic problem disappear. RFC 2080 carried RIP into RIPng, called poison reverse the preferred operation and recommended per-interface selection among no horizon, simple horizon and poison. Prefixes and packet fields changed; a neighbour's recycled belief could still look like new evidence.

Demand circuits changed the transport assumptions more radically. RFC 2091 ordered and acknowledged triggered routing updates so a quiet link did not require periodic full tables. Yet it still required poisoned-reverse processing. Reliable delivery of an update cannot correct a circular assertion unless the sender marks the return path as invalid.

Finally, RFC 2453 retained the mature RIPv2 account: metric 16, split horizon, poison, triggered propagation and the two-router limit remained together. Later packet features did not promote poisoned reverse into universal loop prevention.

What the unreachable return actually proved

A poisoned route proved one negative proposition: the announcing router should not be selected by that receiving context for a route whose preferred next hop leads back through the receiver. It did not prove that the destination was globally absent, that every alternative had failed, that the neighbour was dishonest, or that packets could not arrive by another mechanism.

That narrowness is the historical achievement. RIP made provenance visible without transmitting a full path. It used direction, metric and time to stop a copied claim from returning as independent authority. The resulting control was cheap enough for a small distance-vector protocol, strong enough to end one common loop quickly and honest about the loops it could not see.

Sources and evidence limits

These standards establish the algorithm, requirements and evolution. They do not establish current vendor defaults, deployment share, a particular network's convergence time or malicious intent behind any loop. Trigger RIP applies to its demand-circuit context, and RIPng's preference for poison does not prove that every interface enables it.