bfd

Overview ¶

Package bfd decodes BFD Control packets per RFC 5880. BFD Echo packets (which are user-defined and opaque) and the multi-hop / S-BFD variants are not covered.

Wrap-vs-native judgement

Native. RFC 5880 is fully public; BFD Control packets
have a tight 24-byte mandatory header with an optional
variable-length Authentication Section. No crypto, no
compression, no varints. Operators paste BFD bytes
(UDP dest port 3784 for single-hop or 4784 for multi-
hop) from a `tcpdump -X udp port 3784` line, a Wireshark
Follow-UDP-Stream view, a Quagga / FRR / BIRD / Juniper /
Cisco debug log, or any BFD-speaking router's tcpdump
and get the documented header + optional auth section.

What this package covers

• **24-byte mandatory header** (RFC 5880 §4.1):

• byte 0: Version (3 bits; 1) + **Diagnostic** (5 bits) with **9-entry name table**:

• 0 No Diagnostic

• 1 Control Detection Time Expired

• 2 Echo Function Failed

• 3 Neighbor Signaled Session Down

• 4 Forwarding Plane Reset

• 5 Path Down

• 6 Concatenated Path Down

• 7 Administratively Down

• 8 Reverse Concatenated Path Down

• byte 1: **State** (2 bits) with **4-entry name table** (0 AdminDown, 1 Down, 2 Init, 3 Up) + **6 flag bits**: P (Poll), F (Final), C (Control Plane Independent), A (Authentication Present), D (Demand Mode), M (Multipoint, reserved).

• byte 2: Detect Mult — the number of consecutive missed control packets before declaring the session down.

• byte 3: Length — total BFD packet length in bytes (24 for unauthenticated, 24+auth-section-length for authenticated).

• bytes 4-7: My Discriminator (uint32 BE) — sender's opaque session identifier.

• bytes 8-11: Your Discriminator (uint32 BE) — last received My Discriminator from the peer; 0 until the session is established.

• bytes 12-15: Desired Min TX Interval (uint32 BE microseconds) — minimum interval the sender wants to send control packets.

• bytes 16-19: Required Min RX Interval (uint32 BE microseconds) — minimum interval the sender is willing to accept control packets.

• bytes 20-23: Required Min Echo RX Interval (uint32 BE microseconds) — minimum interval the sender is willing to accept Echo packets (0 disables Echo).

• **Authentication Section** (when A flag set):

• byte 0: **Auth Type** with **5-entry name table**: 1 Simple Password (cleartext), 2 Keyed MD5, 3 Meticulous Keyed MD5, 4 Keyed SHA1, 5 Meticulous Keyed SHA1.

• byte 1: Auth Len — total length of the Authentication Section including these 2 header bytes.

• byte 2: Auth Key ID — operator-chosen identifier for the agreed key.

• bytes 3+: Auth Data — opaque per Auth Type:

• Simple Password: 1-16 byte cleartext password.

• Keyed MD5 / Meticulous Keyed MD5: 1-byte Reserved

• 4-byte Sequence Number + 16-byte MD5 digest.

• Keyed SHA1 / Meticulous Keyed SHA1: 1-byte Reserved + 4-byte Sequence Number + 20-byte SHA1 digest.

• **Timing-microsecond → millisecond conversion** — the three timing fields are surfaced both as raw microseconds and converted to milliseconds for human readability.

• **Conformance check** — Version != 1 surfaces a Note; Length != actual buffer length surfaces a Note; Detect Mult == 0 surfaces a Note (must be ≥ 1).

What this package does NOT cover (deliberately out of scope)

• UDP / IP framing — feed the UDP payload bytes (after the outer IP+UDP headers; standard UDP dest port 3784 single-hop or 4784 multi-hop per RFC 5882).

• BFD Echo packets — opaque user-defined format; the receiver loops them back without inspection.

• S-BFD (Seamless BFD, RFC 7880) — uses a different stateless approach with reserved Your Discriminators; future Spec.

• Cryptographic verification — Auth Type 2-5 are recognised but digest verification belongs in a separate Spec.

• BFD-on-MPLS / BFD-for-VxLAN / BFD-for-Geneve — same wire format but different encapsulations; the decoder handles the BFD frame itself.