Send Q(MA,A-Y)
EXCLUDE (X,Y) TO_EX (A) EXCLUDE (A-Y,Y*A) (A-X-Y) =
Filter Timer
Delete (X-A)
Delete (Y-A)
Send Q(MA,A-Y)
Filter Timer=MALI
EXCLUDE (X,Y) TO_IN (A) EXCLUDE (X+A,Y-A) (A)=MALI
Send Q(MA,X-A)
Send Q(MA)
7.5. Switching Router Filter Modes
The Filter Timer is used as a mechanism for transitioning the Router
Filter Mode from EXCLUDE to INCLUDE.
When a Filter Timer expires with a Router Filter Mode of EXCLUDE, a
router assumes that there are no nodes with a *filter mode* of
EXCLUDE present on the attached link. Thus, the router transitions
to INCLUDE filter mode for the multicast address.
A router uses the sources from the Requested List as its state for
the switch to a filter mode of INCLUDE. Sources from the Requested
List are moved in the Include List, while sources from the Exclude
List are deleted. For example, if a router’s state for a multicast
address is EXCLUDE(X,Y) and the Filter Timer expires for that
multicast address, the router switches to filter mode of INCLUDE with
state INCLUDE(X). If at the moment of the switch the Requested List
(X) is empty, the multicast address record is deleted from the
router.
7.6. Action on Reception of Queries
Upon reception of an MLD message that contains a Query, the router
checks if the source address of the message is a valid link-local
address, if the Hop Limit is set to 1, and if the Router Alert option
is present in the Hop-By-Hop Options header of the IPv6 packet. If
any of these checks fails, the packet is dropped.
If the validity of the MLD message is verified, the router starts to
process the Query.
7.6.1. Timer Updates
MLDv2 uses the Suppress Router-Side Processing flag to ensure
robustness, as explained in section 2.1. When a router sends or
receives a query with a clear Suppress Router-Side Processing flag,
it must update its timers to reflect the correct timeout values for
the multicast address or sources being queried. The following table
describes the timer actions when sending or receiving a Multicast
Address Specific or Multicast Address and Source Specific Query with
the Suppress Router-Side Processing flag not set.
Query Action
----- ------
Q(MA,A) Source Timers for sources in A are lowered to LLQT
Q(MA) Filter Timer is lowered to LLQT
When a router sends or receives a query with the Suppress Router-Side
Processing flag set, it will not update its timers.
7.6.2. Querier Election
MLDv2 elects a single router per subnet to be in Querier state; all
the other routers on the subnet should be in Non-Querier state. MLDv2
uses the same querier election mechanism as MLDv1, namely the IPv6
address. When a router starts operating on a subnet, by default it
considers itself as being the Querier. Thus, it sends several
General Queries separated by a small time interval (see sections 9.6
and 9.7 for details).
When a router receives a query with a lower IPv6 address than its
own, it sets the Other Querier Present timer to Other Querier Present
Timeout; if it was previously in Querier state, it switches to Non-
Querier state and ceases to send queries on the link. After the
Other Querier Present timer expires, it should re-enter the Querier
state and begin sending General Queries.
All MLDv2 queries MUST be sent with the FE80::/64 link-local source
address prefix. Therefore, for the purpose of MLDv2 querier
election, an IPv6 address A is considered to be lower than an IPv6
address B if the interface ID represented by the last 64 bits of
address A, in big-endian bit order, is lower than the interface ID
represented by the last 64 bits of address B.
7.6.3. Building and Sending Specific Queries
7.6.3.1. Building and Sending Multicast Address Specific Queries
When a table action "Send Q(MA)" is encountered, the Filter Timer
must be lowered to LLQT. The Querier must then immediately send a
Multicast Address Specific query as well as schedule [Last Listener
Query Count - 1] query retransmissions to be sent every [Last
Listener Query Interval], over [Last Listener Query Time].
When transmitting a Multicast Address Specific Query, if the Filter
Timer is larger than LLQT, the "Suppress Router-Side Processing" bit
is set in the query message.
7.6.3.2. Building and Sending Multicast Address and Source Specific
Queries
When a table action "Send Q(MA,X)" is encountered by the Querier in
the table in section 7.4.2, the following actions must be performed
for each of the sources in X that send to multicast address MA, with
source timer larger than LLQT:
o Lower source timer to LLQT;
o Add the sources to the Retransmission List;
o Set the Source Retransmission Counter for each source to [Last
Listener Query Count].
The Querier must then immediately send a Multicast Address and Source
Specific Query as well as schedule [Last Listener Query Count -1]
query retransmissions to be sent every [Last Listener Query
Interval], over [Last Listener Query Time]. The contents of these
queries are calculated as follows.
When building a Multicast Address and Source Specific Query for a
multicast address MA, two separate query messages are sent for the
multicast address. The first one has the "Suppress Router-Side
Processing" bit set and contains all the sources with retransmission
state (i.e., sources from the Retransmission List of that multicast
address), and timers greater than LLQT. The second has the "Suppress
Router-Side Processing" bit clear and contains all the sources with
retransmission state and timers lower or equal to LLQT. If either of
the two calculated messages does not contain any sources, then its
transmission is suppressed.
Note: If a Multicast Address Specific query is scheduled to be
transmitted at the same time as a Multicast Address and Source
specific query for the same multicast address, then transmission of
the Multicast Address and Source Specific message with the "Suppress
Router-Side Processing" bit set may be suppressed.
8. Interoperation with MLDv1
MLD version 2 hosts and routers interoperate with hosts and routers
that have not yet been upgraded to MLDv2. This compatibility is
maintained by hosts and routers taking appropriate actions depending
on the versions of MLD operating on hosts and routers within a
network.
8.1. Query Version Distinctions
The MLD version of a Multicast Listener Query message is determined
as follows:
MLDv1 Query: length = 24 octets
MLDv2 Query: length >= 28 octets
Query messages that do not match any of the above conditions (e.g., a
Query of length 26 octets) MUST be silently ignored.
8.2. Multicast Address Listener Behavior
8.2.1. In the Presence of MLDv1 Routers
In order to be compatible with MLDv1 routers, MLDv2 hosts MUST
operate in version 1 compatibility mode. MLDv2 hosts MUST keep state
per local interface regarding the compatibility mode of each attached
link. A host’s compatibility mode is determined from the Host
Compatibility Mode variable which can be in one of the two states:
MLDv1 or MLDv2.
The Host Compatibility Mode of an interface is set to MLDv1 whenever
an MLDv1 Multicast Address Listener Query is received on that
interface. At the same time, the Older Version Querier Present timer
for the interface is set to Older Version Querier Present Timeout
seconds. The timer is re-set whenever a new MLDv1 Query is received
on that interface. If the Older Version Querier Present timer
expires, the host switches back to Host Compatibility Mode of MLDv2.
When Host Compatibility Mode is MLDv2, a host acts using the MLDv2
protocol on that interface. When Host Compatibility Mode is MLDv1, a
host acts in MLDv1 compatibility mode, using only the MLDv1 protocol,
on that interface.
An MLDv1 Querier will send General Queries with the Maximum Response
Code set to the desired Maximum Response Delay, i.e., the full range
of this field is linear and the exponential algorithm described in
section 5.1.3. is not used.
Whenever a host changes its compatibility mode, it cancels all its
pending responses and retransmission timers.
8.2.2. In the Presence of MLDv1 Multicast Address Listeners
An MLDv2 host may be placed on a link where there are MLDv1 hosts. A
host MAY allow its MLDv2 Multicast Listener Report to be suppressed
by a Version 1 Multicast Listener Report.
8.3. Multicast Router Behavior
8.3.1. In the Presence of MLDv1 Routers
MLDv2 routers may be placed on a network where there is at least one
MLDv1 router. The following requirements apply:
o If an MLDv1 router is present on the link, the Querier MUST use
the lowest version of MLD present on the network. This must be
administratively assured. Routers that desire to be compatible
with MLDv1 MUST have a configuration option to act in MLDv1 mode;
if an MLDv1 router is present on the link, the system
administrator must explicitly configure all MLDv2 routers to act
in MLDv1 mode. When in MLDv1 mode, the Querier MUST send periodic
General Queries truncated at the Multicast Address field (i.e., 24
bytes long), and SHOULD also warn about receiving an MLDv2 Query
(such warnings must be rate-limited). The Querier MUST also fill
in the Maximum Response Delay in the Maximum Response Code field,
i.e., the exponential algorithm described in section 5.1.3. is not
used.
o If a router is not explicitly configured to use MLDv1 and receives
an MLDv1 General Query, it SHOULD log a warning. These warnings
MUST be rate-limited.
8.3.2. In the Presence of MLDv1 Multicast Address Listeners
MLDv2 routers may be placed on a network where there are hosts that
have not yet been upgraded to MLDv2. In order to be compatible with
MLDv1 hosts, MLDv2 routers MUST operate in version 1 compatibility
mode. MLDv2 routers keep a compatibility mode per multicast address
record. The compatibility mode of a multicast address is determined
from the Multicast Address Compatibility Mode variable, which can be
in one of the two following states: MLDv1 or MLDv2.
The Multicast Address Compatibility Mode of a multicast address
record is set to MLDv1 whenever an MLDv1 Multicast Listener Report is
received for that multicast address. At the same time, the Older
Version Host Present timer for the multicast address is set to Older
Version Host Present Timeout seconds. The timer is re-set whenever a
new MLDv1 Report is received for that multicast address. If the
Older Version Host Present timer expires, the router switches back to
Multicast Address Compatibility Mode of MLDv2 for that multicast
address.
Note that when a router switches back to MLDv2 Multicast Address
Compatibility Mode for a multicast address, it takes some time to
regain source-specific state information. Source-specific
information will be learned during the next General Query, but
sources that should be blocked will not be blocked until [Multicast
Address Listening Interval] after that.
When Multicast Address Compatibility Mode is MLDv2, a router acts
using the MLDv2 protocol for that multicast address. When Multicast
Address Compatibility Mode is MLDv1, a router internally translates
the following MLDv1 messages for that multicast address to their
MLDv2 equivalents:
MLDv1 Message MLDv2 Equivalent
------------- ----------------
Report IS_EX( {} )
Done TO_IN( {} )
MLDv2 BLOCK messages are ignored, as are source-lists in TO_EX()
messages (i.e., any TO_EX() message is treated as TO_EX( {} )). On
the other hand, the Querier continues to send MLDv2 queries,
regardless of its Multicast Address Compatibility Mode.
9. List of Timers, Counters, and their Default Values
Most of these timers are configurable. If non-default settings are
used, they MUST be consistent among all nodes on a single link. Note
that parentheses are used to group expressions to make the algebra
clear.
9.1. Robustness Variable
The Robustness Variable allows tuning for the expected packet loss on
a link. If a link is expected to be lossy, the value of the
Robustness Variable may be increased. MLD is robust to [Robustness
Variable] - 1 packet losses. The value of the Robustness Variable
MUST NOT be zero, and SHOULD NOT be one. Default value: 2.
9.2. Query Interval
The Query Interval variable denotes the interval between General
Queries sent by the Querier. Default value: 125 seconds.
By varying the [Query Interval], an administrator may tune the number
of MLD messages on the link; larger values cause MLD Queries to be
sent less often.
9.3. Query Response Interval
The Maximum Response Delay used to calculate the Maximum Response
Code inserted into the periodic General Queries. Default value:
10000 (10 seconds)
By varying the [Query Response Interval], an administrator may tune
the burstiness of MLD messages on the link; larger values make the
traffic less bursty, as host responses are spread out over a larger
interval. The number of seconds represented by the [Query Response
Interval] must be less than the [Query Interval].
9.4. Multicast Address Listening Interval
The Multicast Address Listening Interval (MALI) is the amount of time
that must pass before a multicast router decides there are no more
listeners of a multicast address or a particular source on a link.
This value MUST be ([Robustness Variable] times [Query Interval])
plus [Query Response Interval].
9.5. Other Querier Present Timeout
The Other Querier Present Timeout is the length of time that must
pass before a multicast router decides that there is no longer
another multicast router which should be the Querier. This value
MUST be ([Robustness Variable] times ([Query Interval]) plus (one
half of [Query Response Interval]).
9.6. Startup Query Interval
The Startup Query Interval is the interval between General Queries
sent by a Querier on startup. Default value: 1/4 the [Query
Interval].
9.7. Startup Query Count
The Startup Query Count is the number of Queries sent out on startup,
separated by the Startup Query Interval. Default value: [Robustness
Variable].
9.8. Last Listener Query Interval
The Last Listener Query Interval is the Maximum Response Delay used
to calculate the Maximum Response Code inserted into Multicast
Address Specific Queries sent in response to Version 1 Multicast
Listener Done messages. It is also the Maximum Response Delay used
to calculate the Maximum Response Code inserted into Multicast
Address and Source Specific Query messages. Default value: 1000 (1
second).
Note that for values of LLQI greater than 32.768 seconds, a limited
set of values can be represented, corresponding to sequential values
of Maximum Response Code. When converting a configured time to a
Maximum Response Code value, it is recommended to use the exact value
if possible, or the next lower value if the requested value is not
exactly representable.
This value may be tuned to modify the "leave latency" of the link. A
reduced value results in reduced time to detect the departure of the
last listener for a multicast address or source.
9.9. Last Listener Query Count
The Last Listener Query Count is the number of Multicast Address
Specific Queries sent before the router assumes there are no local
listeners. The Last Listener Query Count is also the number of
Multicast Address and Source Specific Queries sent before the router
assumes there are no listeners for a particular source. Default
value: [Robustness Variable].
9.10. Last Listener Query Time
The Last Listener Query Time is the time value represented by the
Last Listener Query Interval, multiplied by [Last Listener Query
Count]. It is not a tunable value, but may be tuned by changing its
components.
9.11. Unsolicited Report Interval
The Unsolicited Report Interval is the time between repetitions of a
node’s initial report of interest in a multicast address. Default
value: 1 second.
9.12. Older Version Querier Present Timeout
The Older Version Querier Present Timeout is the time-out for
transitioning a host back to MLDv2 Host Compatibility Mode. When an
MLDv1 query is received, MLDv2 hosts set their Older Version Querier
Present Timer to [Older Version Querier Present Timeout].
This value MUST be ([Robustness Variable] times (the [Query Interval]
in the last Query received)) plus ([Query Response Interval]).
9.13. Older Version Host Present Timeout
The Older Version Host Present Timeout is the time-out for
transitioning a router back to MLDv2 Multicast Address Compatibility
Mode for a specific multicast address. When an MLDv1 report is
received for that multicast address, routers set their Older Version
Host Present Timer to [Older Version Host Present Timeout].
This value MUST be ([Robustness Variable] times [Query Interval])
plus ([Query Response Interval]).
9.14. Configuring timers
This section is meant to provide advice to network administrators on
how to tune these settings to their network. Ambitious router
implementations might tune these settings dynamically based upon
changing characteristics of the network.
9.14.1. Robustness Variable
The Robustness Variable tunes MLD to expected losses on a link.
MLDv2 is robust to [Robustness Variable] - 1 packet losses, e.g., if
the Robustness Variable is set to the default value of 2, MLDv2 is
robust to a single packet loss but may operate imperfectly if more
losses occur. On lossy links, the value of the Robustness Variable
should be increased to allow for the expected level of packet loss.
However, increasing the value of the Robustness Variable increases
the leave latency of the link (the time between when the last
listener stops listening to a source or multicast address and when
the traffic stops flowing).
9.14.2. Query Interval
The overall level of periodic MLD traffic is inversely proportional
to the Query Interval. A longer Query Interval results in a lower
overall level of MLD traffic. The value of the Query Interval MUST
be equal to or greater than the Maximum Response Delay used to
calculate the Maximum Response Code inserted in General Query
messages.
9.14.3. Maximum Response Delay
The burstiness of MLD traffic is inversely proportional to the
Maximum Response Delay. A longer Maximum Response Delay will spread
Report messages over a longer interval. However, a longer Maximum
Response Delay in Multicast Address Specific and Multicast Address
And Source Specific Queries extends the leave latency (the time
between when the last listener stops listening to a source or
multicast address and when the traffic stops flowing.) The expected
rate of Report messages can be calculated by dividing the expected
number of Reporters by the Maximum Response Delay. The Maximum
Response Delay may be dynamically calculated per Query by using the
expected number of Reporters for that Query as follows:
Query Type Expected number of Reporters
---------- ----------------------------
General Query All nodes on link
Multicast Address Specific Query All nodes on the link that had
expressed interest in the
multicast address
Multicast Address and Source All nodes on the link that had
Specific Query expressed interest in the source
and multicast address
A router is not required to calculate these populations or tune the
Maximum Response Delay dynamically; these are simply guidelines.
10. Security Considerations
We consider the ramifications of a forged message of each type. Note
that before processing an MLD message, nodes verify if the source
address of the message is a valid link-local address (or the
unspecified address), if the Hop Limit is set to 1, and if the Router
Alert option is present in the Hop-By-Hop Options header of the IPv6
packet. If any of these checks fails, the packet is dropped. This
defends the MLDv2 nodes from acting on forged MLD messages originated
off-link. Therefore, in the following we discuss only the effects of
on-link forgery.
10.1. Query Message
A forged Query message from a machine with a lower IPv6 address than
the current Querier will cause Querier duties to be assigned to the
forger. If the forger then sends no more Query messages, other
routers’ Other Querier Present timer will time out and one will
resume the role of Querier. During this time, if the forger ignores
Multicast Listener Done Messages, traffic might flow to multicast
addresses with no listeners for up to [Multicast Address Listener
Interval].
A forged Version 1 Query message will put MLDv2 listeners on that
link in MLDv1 Host Compatibility Mode. This scenario can be avoided
by providing MLDv2 hosts with a configuration option to ignore
Version 1 messages completely.
A DoS attack on a node could be staged through forged Multicast
Address and Source Specific Queries. The attacker can find out about
the listening state of a specific node with a general query. After
that it could send a large number of Multicast Address and Source
Specific Queries, each with a large source list and/or long Maximum
Response Delay. The node will have to store and maintain the sources
specified in all of those queries for as long as it takes to send the
delayed response. This would consume both memory and CPU cycles in
order to augment the recorded sources with the source lists included
in the successive queries.
To protect against such a DoS attack, a node stack implementation
could restrict the number of Multicast Address and Source Specific
Queries per multicast address within this interval, and/or record
only a limited number of sources.
10.2. Current State Report messages
A forged Report message may cause multicast routers to think there
are listeners of a multicast address on a link when there are not.
Nevertheless, since listening to a multicast address on a host is
generally an unprivileged operation, a local user may trivially gain
the same result without forging any messages.
A forged Version 1 Report Message may put a router into MLDv1
Multicast Address Compatibility Mode for a particular multicast