Summary

  • RFC 1953 let the downstream end of one point-to-point link manage its label space and send an unacknowledged Redirect upstream; the receiving node could ignore any or all proposed bindings.
  • A binding was a lease, not a permanent route: it expired unless refreshed, a contradictory label restored default forwarding, and stale redirection messages were discarded unless adjacency state matched.
  • Releasing a shortcut required stronger evidence than proposing one. Reclaim received an explicit Reclaim Ack before the label became free, while the RFC left security issues entirely undiscussed.

The packet after the hourglass emptied

Imagine two adjacent devices carrying the same stream of packets. The ordinary IP forwarding path is already working. For a while, the downstream device offers a short local label that lets later packets use cached forwarding state and, when both sides of an intermediate node participate, cross at layer 2 rather than being routed again at layer 3.

Now the timer runs out. The next packet is not stranded. The special association disappears and the flow returns to the default path. Nothing in that outcome says the shortcut failed. Expiry is how the shortcut proves that it never owned the route.

That is the most revealing feature of the Ipsilon Flow Management Protocol. Published in May 1996, RFC 1953 described a private protocol for IPv4 flows. Its IESG note was unusually direct: the work did not come from an IETF working group, was not standards track and had not necessarily received the review associated with standards-track documents. The RFC recorded a specific design for public examination; it did not transform that design into a universal Internet settlement.

The proposal addressed a concrete performance tension. A router understood IP routes and policy, while an ATM switch could move cells quickly through short VPI/VCI identifiers. IFMP tried to preserve the routed decision and cache its result on one adjacent link. A label could become a compact handle for a flow already classified through IPv4 fields.

The historical interest lies less in the word “label” than in the rules around it. The label was meaningful in one direction of one link. Its allocator, requester, installer, lifetime and release receipt were different roles. That separation kept a fast path from silently becoming a new source of global truth.

Classification before acceleration

RFC 1953 defined a flow as packets from a source to a unicast or multicast destination that were related by routing or logical handling policy. A flow type selected the invariant header fields used to identify that flow. The types formed a hierarchy so the receiver could choose the most specific match.

One type carried no identifier and changed encapsulation broadly. Another was suited to TCP and UDP and used addresses, protocol and ports. A coarser type omitted the ports. This made classification flexible, but it did not authenticate an application or a person. A five-tuple-like key can tell a forwarding engine which packets share a treatment; it cannot prove why that treatment is authorized.

That distinction matters because a label compresses context. Once the binding exists, later packets do not have to restate the whole forwarding decision at the same layer. The system is efficient precisely because the label stands in for remembered work. If the memory is stale or belongs to a different adjacency incarnation, the concise marker becomes dangerous.

IFMP therefore placed a state machine before redirection. The two peers exchanged adjacency messages containing recent instance values, peer beliefs and the next expected redirection sequence. An instance had to change after the link or node came back up. Redirection messages could not be sent until synchronization reached the established state, and a receiver had to discard them if source address, sender instance or peer instance did not match stored adjacency state.

This was recent-state hygiene, not cryptographic identity. The memo's Security Considerations section simply said that security issues were not discussed. A checksum could detect transmission damage. An IP address and instance value could distinguish the expected recent neighbor state. None supplied authenticated institutional identity or permission.

The downstream neighbor proposed; the upstream neighbor decided

Each direction of a link was separate. The downstream end managed the labels that would arrive toward it, then sent a Redirect message upstream to associate one of those labels with a particular flow. The spatial arrangement encoded a clean resource rule: the party consuming the local label space selected the token.

But selection was not compulsion. The upstream receiver could ignore any or all Redirect elements. The Redirect itself was not acknowledged. If the receiver accepted, it attached the specified label to later packets only until it chose to stop or the lifetime expired.

This is a remarkably narrow grant of authority. The downstream node could say, in effect, “I can receive this flow under this local handle for this long.” It could not force the upstream node to alter forwarding. The upstream node controlled its own egress behavior and carried the operational risk of installing the binding.

The Label Range message made the same boundary explicit from the other direction. If a proposed label lay outside what the receiving link could handle, the receiver could advertise an inclusive local range. That range was capability evidence, not a registry of globally owned numbers. The same numeric label could mean something else on another link without conflict.

A lease with an escape hatch

Every Redirect carried a non-zero lifetime measured in seconds. The association had to disappear no later than that limit unless refreshed by an identical Redirect. A matching label for an already redirected flow reset the lifetime. A different label did something deliberately conservative: the new Redirect was ignored and the flow returned to the default state.

The protocol did not ask the nodes to guess which of two contradictory shortcuts was newer or more legitimate. It abandoned the optimization. Ordinary forwarding became the safe common language.

This fallback is easy to underestimate. Performance mechanisms often become hard dependencies because systems remove the slower path once the optimization appears stable. RFC 1953 kept the route beneath the cache. The fast state could be lost on expiry, adjacency reset, peer change, sequence inconsistency or explicit reclaim without requiring the traffic's semantic identity to be reconstructed from the label alone.

RFC 1954 showed the physical consequence on ATM. IFMP labels became VPI/VCI values. Some redirected flow formats omitted repeated IPv4 fields and, for one type, the first transport ports as well. That saved bytes and work, but it also made the retained binding essential for reconstruction. The ordinary encapsulation remained available for IFMP control traffic and default forwarding.

The shortcut thus did not erase IP. It borrowed IP's earlier decision, encoded it in adjacent shared state and used an ATM identifier as a compact execution handle. When the shared state ceased to be trustworthy, the handle lost its meaning.

Why release needed a receipt

Installation was opportunistic. Redirect had no acknowledgement because the requester did not need to make the receiver accept an optimization. Reuse was different. A label released too early might still be attached to queued packets or to a flow the upstream node had not yet unbound.

Reclaim therefore required Reclaim Ack. The downstream node asked the upstream node to remove the binding and return the flow to default forwarding. The receiver acknowledged even an unknown flow. If the flow existed under a different label, it removed that actual binding and reported the label it had released. Where possible, the acknowledgement waited until queued data using the label had been sent.

The asymmetry carries a general lesson. It is acceptable to make a performance offer without a commitment receipt when refusal is safe. It is not acceptable to recycle a scarce identifier on the assumption that a release request must already have taken effect. Creation can be speculative; destructive reuse needs evidence of completion.

Even the acknowledgement stayed bounded. It was evidence about IFMP state between adjacent nodes, not proof that every implementation queue, switch fabric or remote destination had completed its work. The protocol made one transition observable without pretending to certify the entire network.

One proposal among several futures

IFMP belonged to a wider attempt to combine IP control with ATM forwarding. RFC 1954 specified the ATM encoding. Ipsilon's GSMP described a controller managing switch connections, ports and statistics through an asymmetric control relationship. Cisco's contemporary Tag Switching proposal separated forwarding from control too, but described several allocation modes and emphasized topology-driven route bindings rather than relying only on traffic-discovered flows.

Later MPLS architecture and LDP standardized a broader label-switching system. Those documents show that local label bindings, forwarding equivalence classes and control/forwarding separation became durable design ideas. They do not prove that IFMP directly caused MPLS or that the later protocols preserved IFMP's exact lease, adjacency or reclaim semantics. Similar problems can generate related mechanisms through several engineering paths.

The proper historical claim is smaller and more useful. RFC 1953 exposed the questions any shortcut must answer: Who owns the compact identifier? Who may request its use? Who may refuse? How long does state live? What happens when two beliefs differ? What proves that an identifier is safe to recycle? What remains when the optimization disappears?

The label and the thing it caused

Heng Lu's running-code lens helps keep the evidence levels apart. An RFC label such as Redirect is a specified message. A received Redirect is evidence that a neighbor proposed state. Only the receiver's forwarding behavior demonstrates that it accepted and executed the proposal. Traffic observation, expiry and fallback are stronger operational evidence than the symbolic token alone.

The minimum-specification lens explains why IFMP could stay local. Peers needed common syntax for flow keys, instances, sequence order, lifetimes, label ranges and release receipts. They did not need a central label allocator or a rule forcing every receiver to accept optimization. The shared contract was thin enough to coordinate one edge while leaving the actual decision with the operator of that edge.

The reality-layer distinction is equally sharp. A label may be present in a packet yet lack a current binding. A binding may exist in one node but not its neighbor. An adjacency may look established at one instant and be obsolete after a restart. Symbol, stored state and executed forwarding are related, but they are not interchangeable.

The switch offered a shortcut. The router could refuse. That modest sentence contains more architectural discipline than a promise that every packet will be fast.

Sources and boundaries

The historical identity and exact protocol are in the RFC Editor record for RFC 1953 and RFC 1953. ATM realization is bounded by RFC 1954 and its referenced default encapsulation in RFC 1483. The companion switch-control context comes from the RFC Editor record for RFC 1987. Contemporary and later comparisons use RFC 2105, RFC 3031 and RFC 5036. The analytical frame comes from Running-Code Primacy, Minimum Initial Specification and Reality Layers.

The sources establish protocol text and bounded architectural comparisons. They do not establish deployment share, measured performance, commercial success, universal interoperability, cryptographic security or a single causal line from IFMP to MPLS.