[AusNOG] MPLS Hashing and horrid things to debug also known as 6-MAC

[Ben Roeder]

Hi,
Do not post very often, but I thought this was worth posting.

We have been having an "interesting" issue with one of our suppliers, and
thought I would post this as it could affect you and/or your customers as
well.

Customer reports poor TCP performance.

The presentation linked to goes into a lot more detail.

In summary though

MPLS P Routers are not aware of what type of traffic is flowing through
them.

Vendors naively speculate what actual payload is

They might look at first octet:
– > if “4”, the packet must be an IPv4 packet
– > if “6”, the packet must be an IPv6 packet

So what happens if the traffic passing is part of a MPLS pseudo wire, and
your mac address starts with a 6 or 4.

The P router then decides that the packet is IP and uses the next part as
the seed for the hash to balance traffic across links, to keep a flow on
the same path, and reduce out of order packet delivery.

If your MAC addr starts with a 4 the seed is smaller, and does not really
effect you.

If your MAC addr starts with 6 the seed is massive and includes lots of the
payload ( inc checksum, size etc) which will cause your traffic to be
sprayed randomly across the load balanced core links

This results in out of order TCP packets, ( which as we call know TCP loves
that ), which results in very poor performance, and unhappy customers


Further reading

Understanding MPLS Hashing And how it affects your brand new equipment

https://www.nanog.org/meetings/nanog57/presentations/Tuesday/tues.general.SnijdersWheeler.MACaddresses.14.pdf

<https://www.nanog.org/meetings/nanog57/presentations/Tuesday/tues.general.SnijdersWheeler.MACaddresses.14.pdf>
*there is a mistake in the above presentation example showing a MAC addr
that is 06 when it should be 60, but the rest of it stands.

*https://tools.ietf.org/html/bcp128 <https://tools.ietf.org/html/bcp128>*

Cisco bug: https://quickview.cloudapps.cisco.com/quickview/bug/CSCup45387


*This might help close a few weird performance tickets you might have. :-)*

regards
Ben Roeder
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20180327/6286a150/attachment.html>