Summary

  • RFC 2784 separates a delivery header, a GRE header and a payload. Its four-octet base can identify the inner protocol without deciding why the tunnel exists, who may use it or whether the contents are safe.
  • Tony Li co-authored both the 1994 GRE record and the 2000 Standards Track specification. Later RFCs make the operating debt visible: the GRE Key is a context label rather than a security secret, sequencing creates state and denial risk, and IPv6 carriage requires continuous MTU and integrity decisions at the endpoints.

One packet, two addresses, three responsibilities

At a GRE ingress, an ordinary packet becomes payload. A GRE header is placed around it, followed by an outer delivery header. The underlay reads the outer destination and transports the whole construction to the egress. The egress removes the outer layers and returns to the destination in the inner packet.

That sequence sounds like packaging, but it creates three independent records. The delivery header identifies the tunnel endpoints. The GRE header identifies what kind of packet is inside and which optional behaviors apply. The payload retains its own source, destination, lifetime and higher-layer meaning. A route to the outer destination proves only that the envelope can travel. It does not prove that the inner destination is authorized, reachable after decapsulation or visible to the correct security control.

RFC 2784, published on the Standards Track in March 2000, names Dino Farinacci, Tony Li, Stan Hanks, David Meyer and Paul Traina. It replaced the earlier Informational RFC 1701, written by Hanks, Li, Farinacci and Traina. The IETF Datatracker profile supplies Li's public identity, RFC ledger and current roles in the frozen record. These sources establish collective authorship, not a lone-inventor story or personal control over deployed tunnels.

The useful person-level observation is narrower. Li appears in both stages of a design that first described a general envelope and later deliberately reduced its common core. His public record lets us study a standards contribution in which restraint—not command over every use—was the durable engineering choice.

A common envelope replaced a matrix of special cases

Without a reusable encapsulation, every payload protocol can require a distinct method over every delivery protocol. Add another protocol and the number of pairings grows with the matrix. RFC 2784 describes GRE's ambition as reducing that O(n²) problem to a manageable form: payload, common envelope, delivery.

Generality was not presented as magic. The document warns that protocol-specific nuances are ignored and that a purpose-built X over Y mechanism may be better for some combinations. Most importantly, it declines to specify when a packet ought to be encapsulated. GRE supplies grammar, not justification.

That line prevents the standard from turning a technical option into a universal policy. An enterprise may join separated private prefixes. A provider may carry a service across an underlay. A laboratory may test an otherwise unsupported protocol. None of those purposes is authorized merely because the packets conform to GRE. The operator must still name the owner, endpoints, admitted payloads, security boundary, capacity and retirement condition.

The distinction is economically important. A common envelope reduces implementation and coordination cost. It does not absorb the operational downside of the networks using it. The party that saves by reusing GRE remains responsible for the route leak, black hole, inspection gap or dependency the tunnel can create.

Four octets standardize only what the peer must know

With the optional checksum absent, the RFC 2784 header consists of two 16-bit words. The first carries one checksum-present bit, reserved bits and a version value. The second carries the Protocol Type, an EtherType identifying the payload. Version zero is the base format.

That tiny header does not contain a global tunnel identifier, owner, policy, route, encryption claim or service-level promise. It tells the peer how to parse the next bytes. The receiver should discard an unknown Protocol Type. Reserved bits are transmitted as zero; a receiver that does not implement the older behavior must discard packets using certain non-zero extension positions. Unknown meaning is refused rather than guessed.

The optional checksum adds four octets and covers the GRE header and payload with the ordinary Internet checksum. A compliant implementation must process it when present. The result can detect accidental corruption in the covered material. It cannot authenticate an endpoint, hide content or establish permission.

This is what a minimal shared specification looks like in a packet capture. Every common bit answers an interoperability question. Everything it does not answer remains outside the protocol's authority.

The path after decapsulation still belongs to the payload

When the inner packet is IPv4, RFC 2784 tells the egress to forward using the inner destination and decrement the inner TTL. The outer destination has completed its job. It does not replace the payload's routing semantics.

The specification also names a sharp loop condition. If the decapsulated inner destination is the encapsulator at the opposite end, the packet can be sent back into the same relationship; that packet must be discarded. Tunneling can hide topology from the inner packet, but it cannot repeal loop consequences.

This split matters during diagnosis. An outer traceroute can reach the egress while the inner route is absent. The tunnel interface can be administratively up while the payload is dropped after decapsulation. Conversely, an inner application failure can be blamed on GRE even when the actual break is an underlay route, firewall, MTU or return-path mismatch. The three records must be observed separately and then joined.

The 1994 option set was narrowed, not silently inherited

RFC 1701 offered a wider header: routing, key, sequence, strict-source-route and recursion controls could all appear. RFC 2784 standardized the intersection deployed by multiple vendors and deprecated those fields in its base profile. A base receiver encountering the older non-zero flag positions discards the packet unless it explicitly implements the older behavior.

That history is not a simple tale of adding features. The shared core became smaller so that independent implementations could agree on fewer meanings with greater certainty. Optional needs could return through separately specified extensions rather than hiding behind ambiguous reserved bits.

Compatibility therefore means an explainable refusal boundary. A tunnel that fails because one endpoint expects an extension is not repaired by accepting bytes under a guessed layout. Operators must prove the capability pair, activate only the agreed profile and preserve a rollback that restores the prior parsing contract.

A field called Key is not a security key

RFC 2890, authored by Govindan Dommety rather than Li, later defined optional Key and Sequence Number extensions. The four-octet Key identifies a traffic flow or context between encapsulator and decapsulator. How the value is obtained is outside the document.

The standard is unusually direct about the naming hazard: despite being called Key, the field provides no security. It can distinguish tenants, services or flows according to a local agreement, but an observer capable of constructing GRE can copy or invent the number unless another mechanism protects the packet. Treating it as a password converts a context label into a false trust boundary.

The optional Sequence Number carries different debt. It can support unreliable in-order delivery. A receiver keeps the last successfully decapsulated value, discards older values and may use a bounded reordering buffer. That behavior can help a payload sensitive to reordering, but it adds per-flow state and a new denial path: an injected high sequence can make lawful traffic look old.

RFC 2890 requires IPsec AH or ESP for protection against that attack. It also cautions against using GRE ordering where a higher layer already provides ordering or tolerates reordering. An optional bit is therefore a systems decision, not free functionality. Enabling it changes memory, buffering, attack surface, logging and failure semantics at both endpoints.

Filtering moves to the place where meaning becomes visible

RFC 2784 observes that route filtering remains aligned with ordinary IPv4 routing, but packet filtering needs either to inspect inside the GRE packet or to occur at the tunnel endpoints. The underlay can make a correct decision about the delivery header while knowing nothing about the inner protocol, address or port.

This creates a common failure of responsibility. The transport team says the outer route is restricted. The security team says the firewall permits only GRE between two addresses. The service team assumes the inner traffic inherited both decisions. In fact, neither outer fact defines which payloads are allowed after decapsulation.

An accountable design records the admissible inner prefixes and protocols, where decapsulation occurs, which device inspects before or after it, and whether IPsec authenticates or encrypts the delivery packet. “GRE up” is not a security status. The evidence is the effective policy on both layers and the packet that actually crossed them.

IPv6 turned omitted details into activation gates

RFC 7676, written by Carlos Pignataro, Ron Bonica and Suresh Krishnan, later specified IPv6 as GRE payload or delivery protocol. It does not belong to Li's authorship record. It is valuable here because it shows what happens after a thin base contract meets a new network layer.

When IPv6 is the payload, a GRE tunnel must carry a 1280-octet IPv6 packet from ingress to egress without fragmenting the payload. The ingress must verify that ability before activation and periodically afterwards, then activate or deactivate accordingly. The GRE MTU is the underlay path MTU minus delivery and GRE overhead. If a payload above that value cannot travel, the ingress may need to discard it and return an ICMPv6 Packet Too Big message with the usable value.

A small header has not made packet size disappear. It has made overhead calculable—and made the endpoint responsible for testing and signaling it. A lost Packet Too Big message can create the classic tunnel illusion: small probes work, larger application flows stall, and the control plane remains green.

The checksum choice exposes another boundary. Leaving the GRE checksum off can save computation where inner transports already check their data. But an IPv6 delivery header has no checksum, and a GRE checksum would not cover it anyway. RFC 7676 analyzes an unlikely but material case in which a corrupted outer destination reaches the wrong VPN provider-edge router; overlapping private addresses can then make the payload valid in the wrong VPN. The document tells operators not to deploy GRE over IPv6 where they have not accepted that risk, and notes end-to-end payload authentication as a mitigation.

The standards do not promise that this scenario exists in a particular network. They do establish the question an operator must answer. General-purpose carriage is never equivalent to general-purpose safety.

Thin coordination requires thick evidence at the edge

Lu Heng's later Minimum Initial Specification, Localized Future Decision, and Voluntary Adoption gives Sofia Ren a useful lens for GRE. The common layer can remain narrow: layout, version, payload type, optional fields and rejection behavior. Each network remains free—and obliged—to decide why the tunnel exists, who operates it, which inner traffic it accepts, how it secures the delivery and when it will retire the dependency.

The corollary comes from Running-Code Primacy. A configuration object is only intent. Evidence must connect the outer route, emitted GRE flags, protocol type, effective overhead, optional context, security association, inner route, filter decision, MTU feedback, counters and application result.

These Heng texts are a later editorial framework, not proof of Li's private intention or of consensus beyond the cited RFCs. Their value is to clarify the allocation of responsibility. The standard owns the shared envelope. Implementations own correct parsing and state. Operators own every reason that the envelope is allowed to exist.

GRE endured because it did not try to rule its payload. That restraint made it portable. It also left no institution inside the four-byte header to rescue a careless deployment. The envelope can carry almost anything; only the endpoints can prove that it should.

Sources