Network Working Group

Internet Engineering Task Force (IETF)                         A. Morton
Request for Comments: 9946
Category: Standards Track                                  L. Ciavattone
Internet-Draft
ISSN: 2070-1721                                                AT&T Labs
Intended status: Standards Track
                                                            R. Geib
Expires: 20 March 2026 Geib, Ed.
                                                        Deutsche Telekom
                                                       16 September 2025
                                                              March 2026

 The UDP Speed Test Protocol for One-way One-Way IP Capacity Metric Measurement
                  draft-ietf-ippm-capacity-protocol-25

Abstract

   This document addresses the problem of protocol support for measuring
   One-Way IP Capacity metrics specified by RFC 9097.  The Method of
   Measurement discussed there in that RFC requires a feedback channel from
   the receiver to control the sender's transmission rate in near-real-time. near real-
   time.  This document defines the UDP Speed Test Protocol (UDPSTP) for
   conducting RFC 9097 and other related measurements.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents an Internet Standards Track document.

   This document is a product of the Internet Engineering Task Force
   (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list  It represents the consensus of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid the IETF community.  It has
   received public review and has been approved for a maximum publication by the
   Internet Engineering Steering Group (IESG).  Further information on
   Internet Standards is available in Section 2 of RFC 7841.

   Information about the current status of six months this document, any errata,
   and how to provide feedback on it may be updated, replaced, or obsoleted by other documents obtained at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on 20 March 2026.
   https://www.rfc-editor.org/info/rfc9946.

Copyright Notice

   Copyright (c) 2025 2026 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents (https://trustee.ietf.org/
   license-info)
   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Revised BSD License text as described in Section 4.e of the
   Trust Legal Provisions and are provided without warranty as described
   in the Revised BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   3
     1.1.  Terminology . . . . . . . . . . . . . . . . . . . . . . .   4
     1.2.  Requirements Language . . . . . . . . . . . . . . . . . .   4
   2.  Scope, Goals, and Applicability . . . . . . . . . . . . . . .   4
   3.  Protocol Overview . . . . . . . . . . . . . . . . . . . . . .   5
     3.1.  Fixed-Rate Testing  . . . . . . . . . . . . . . . . . . .  10
     3.2.  Handling of and Safeguards required Required by Self-Induced
           Congestion  . . . . . . . . . . . . . . . . . . . . . . .  10
   4.  Requirements, Security Operations, and Optional Checksum  . .  11
     4.1.  Load Rate Adjustment Algorithm Requirements . . . . . . .  11
     4.2.  Parameters and Definitions  . . . . . . . . . . . . . . .  13
     4.3.  Security Mode Operations  . . . . . . . . . . . . . . . .  13
       4.3.1.  Mode 1: Required Authenticated Mode . . . . . . . . .  14
       4.3.2.  Mode 2: Optional Authenticated Mode for Data Phase  .  15
     4.4.  Key Management  . . . . . . . . . . . . . . . . . . . . .  16
       4.4.1.  Key Derivation Function (KDF) . . . . . . . . . . . .  16
     4.5.  Configuration of Network Functions with Stateful Filtering . . . . . . . . . . . . . . . . . . . . . . . .  18
     4.6.  Optional Checksum . . . . . . . . . . . . . . . . . . . .  19
   5.  Test Setup Request and Response . . . . . . . . . . . . . . .  20
     5.1.  Client Generates Test Setup Request . . . . . . . . . . .  20
     5.2.  Server Test Setup Request Processing and Response
           Generation  . . . . . . . . . . . . . . . . . . . . . . .  23
       5.2.1.  Test Setup Request Processing - -- Rejection . . . . . .  24
       5.2.2.  Test Setup Request Processing - -- Acceptance  . . . . .  27
     5.3.  Setup Response Processing at the Client . . . . . . . . .  29
   6.  Test Activation Request and Response  . . . . . . . . . . . .  30
     6.1.  Client Generates Test Activation Request  . . . . . . . .  30
     6.2.  Server Processes Test Activation Request and Generates
           Response  . . . . . . . . . . . . . . . . . . . . . . . .  36
       6.2.1.  Server Rejects or Modifies Request  . . . . . . . . .  36
       6.2.2.  Server Accepts Request and Generates Response . . . .  37
     6.3.  Client Processes Test Activation Response . . . . . . . .  38
   7.  Test Load Stream Transmission and Measurement Status Feedback
           Messages  . . . . . . . . . . . . . . . . . . . . . . . .  39
     7.1.  Load PDU and Roles  . . . . . . . . . . . . . . . . . . .  39
     7.2.  Status PDU  . . . . . . . . . . . . . . . . . . . . . . .  44
   8.  Stopping a Test . . . . . . . . . . . . . . . . . . . . . . .  51
   9.  Operational considerations Considerations for the Measurement Method . . . .  52
     9.1.  Notes on Interface Measurements . . . . . . . . . . . . .  53
   10. Security Considerations . . . . . . . . . . . . . . . . . . .  53
   11. IANA Considerations . . . . . . . . . . . . . . . . . . . . .  55
     11.1.  New User Port Number Assignment  . . . . . . . . . . . .  55
     11.2.  New KeyTable KDF . . . . . . . . . . . . . . . . . . . .  55
     11.3.  New UDPSTP Registry Group  . . . . . . . . . . . . . . .  55
       11.3.1.  PDU Identifier Registry  . . . . . . . . . . . . . .  56
       11.3.2.  Protocol Version Registry  . . . . . . . . . . . . .  57
       11.3.3.  Test Setup PDU Modifier Bitmap Registry  . . . . . .  57
       11.3.4.  Test Setup PDU Authentication Mode Registry  . . . .  58
       11.3.5.  Test Setup PDU Command Response Field Registry . . .  59
       11.3.6.  Test Activation PDU Command Request Registry . . . .  61
       11.3.7.  Test Activation PDU Modifier Bitmap Registry . . . .  61
       11.3.8.  Test Activation PDU Rate Adjustment Algo. Registry  . . . . . . . . . . . . . . . . . . . . . .  62
       11.3.9.  Test Activation PDU Command Response Field Registry  . . . . . . . . . . . . . . . . . . . . . .  63
     11.4.  Guidelines for the Designated Experts  . . . . . . . . .  64
   12. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . .  64
   13. References  . . . . . . . . . . . . . . . . . . . . . . . . .  64
     13.1.
     12.1.  Normative References . . . . . . . . . . . . . . . . . .  64
     13.2.
     12.2.  Informative References . . . . . . . . . . . . . . . . .  66
   Appendix A.  KDF Example (OpenSSL)  . . . . . . . . . . . . . . .  67
   Acknowledgments
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  69

1.  Introduction

   The performance community has seen the development of Informative
   Bulk Transport Capacity (BTC) definitions in the "Framework "A Framework for
   Defining Empirical Bulk Transport
   Capacity" (BTC, see [RFC3148]) and for "Network Transfer Capacity Metrics" [RFC3148] and Maximum
   IP-layer
   "Defining Network Capacity" [RFC5136].  "Model-Based Metrics for BTC" add [RFC5136] as well as experimental metric
   definitions and methods in "Model-Based Metrics for Bulk Transport
   Capacity" [RFC8337].

   This document specifies the UDP Speed Test Protocol (UDPSTP) enabling to
   enable the measurement of One-Way IP Capacity metrics as defined by
   [RFC9097].  The Method of Measurement discussed there in that RFC deploys a
   feedback channel from the receiver to control the sender's
   transmission rate in near-real-time. near real-time.  Section 8.1 of [RFC9097]
   specifies requirements for this method.

   This protocol

   UDPSTP supports measurement features which that weren't available
   by TCP via TCP-
   based speed tests and standard measurement protocols like One
   Way protocols, such as the
   One-Way Active Measurement Protocol (OWAMP) [RFC4656], Two-Way Active
   Measurement Protocol (TWAMP) [RFC5357] [RFC5357], and Simple Two-Way Active
   Measurement Protocol (STAMP) [RFC8762] [RFC8762], prior to this work.  The
   controlled Bulk Capacity measurement or Speed Test, respectively, is
   based on UDP rather than TCP.  The bulk measurement load is
   unidirectional.  These specifications did support the creation of
   asymmetric traffic in combination with some two-way communication, as
   supported by TWAMP and STAMP, when work on UDPSTP started.  Further,
   two-way communications of TWAMP and STAMP are limited to reflection
   or unidirectional load properties, but they lack support for closed
   loop feedback operation.  The latter enables limiting congestion of a
   bottleneck, whose capacity is measured, to a short time range.
   Support of such a control loop is the main purpose of UDPSTP.

   Apart from measurement functionality, a Key Derivation Function (KDF)
   has been added providing to provide cryptographic separation of key material
   for authentication of protocol messages in a standardized and
   cryptographically secure manner.  This is a secondary improvement
   reached by UDPSTP and may simplify its reuse for other measurement
   purposes.  Additionally, because the protocol uses synthetic payload
   data and contains no direct user information, a decision was made to
   forgo encryption support.  Secondarily, this is also expected to
   increase the number of low-end devices that can support the test
   methodology.

1.1.  Terminology

   Downstream UDP Speed Test:  A client initiated client-initiated Network Capacity
      measurement between a server acting as sender and a client acting
      as receiver.

   Upstream UDP Speed Test:  A client initiated client-initiated Network Capacity
      measurement between a client acting as sender and a server acting
      as receiver.

1.2.  Requirements Language

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
   "OPTIONAL" in this document are to be interpreted as described in
   BCP 14 [RFC2119], [RFC2119] [RFC8174] when, and only when, they appear in all
   capitals, as shown here.

2.  Scope, Goals, and Applicability

   The scope of this document is to define a protocol to measure the
   Maximum IP-Layer Capacity metric Metric according to the Method of
   Measurement standardized by Section 8 of [RFC9097].  As such, this
   document adheres to the applicability scope defined in Section 2 of
   [RFC9097].

   Some aspects of this protocol and end-host configuration can lead to
   support of additional forms of measurement, such as application
   emulation enabled by creative use of the load rate adjustment
   algorithm.  Per [RFC9097], that algorithm must not be used as a
   general Congestion Control Algorithm (CCA).  Instead, the load rate
   adjustment algorithm's goal is to help determine the Maximum IP-Layer
   Capacity in the context of an infrequent, diagnostic, short-term
   measurement.

   The goal is to harmonize the specified IP-Layer Capacity metric Metric and
   method
   Method across the industry, and this protocol supports the
   specifications of IETF ([RFC9097]) (see [RFC9097]) and other Standards
   Development Organizations (SDO's; see, (SDOs) (see, e.g., [TR-471]).

   The primary application of the protocol described here is the same as
   in Section 2 of [RFC7497] where:

   *

   |  The access portion of the network is the focus of this problem
   |  statement.  The user typically subscribes to a service with
   |  bidirectional access partly described by rates in bits per second.

   UDPSTP is a client-based protocol.  It may be applied by consumers to
   measure their own access bandwidth.  Consumers may prefer an
   independent 3rd party third-party domain hosting the measurement server for
   this purpose.  UDPSTP may be deployed in Large-Scale a Large-scale Measurement of
   Broadband Performance environments (LMAP, see (LMAP) environment (see [RFC7497]), another
   independent 3rd party third-party domain measurement server deployment.  A
   network operator may support operation and maintenance by UDPSTP, a
   typical intra-domain deployment.  All these deployments require or
   benefit from trust into the results, which are ensured by
   authenticated communication.

3.  Protocol Overview

   All messages defined by this document SHALL use UDP transport.

   The remainder of this section gives an informative overview of the
   communication protocol between two test endpoints (without expressing
   requirements or elaborating on the authentication aspects).

   One endpoint takes the role of server, listening for connection
   requests on a standard UDP Speed Test Protocol port number from the
   other endpoint, the client.

   The client requires configuration of a test direction parameter
   (upstream or downstream test, where the client performs the role of
   sender or receiver, respectively) as well as the hostname or IP
   address(es) of the server(s) in order to begin the setup and
   configuration exchanges with the server(s).  By default, the client
   uses the single, standard UDPSTP port number per connection (see
   Section 5).  If the default port number is not used, the client may
   require configuration of the control port number used by each server.
   This would be the case if multiple server instances (processes)
   operate on one or more machines.

   Additionally, multi-connection (multi-flow) testing is supported by
   the protocol.  Each connection is independent and attempts to
   maximize its own individual traffic rate.  For multi-connection
   tests, a single client process would replicate the connection setup
   and test procedure multiple times (once for each flow) to one or more
   server instances.  The server instance(s) would process each
   connection independently, as if they were coming from separate
   clients.  It shall be the responsibility of the client process to
   manage the inter-related connections: connections such as handling the individual
   connection setup successes and failures, cleaning up connections
   during a test (should some fail) as well as aggregate fail), and aggregating the individual test
   results into an overall set of performance statistics.  Fields in the
   Setup Request (mcIndex, (i.e., mcIndex, mcCount, and mcIdent, mcIdent; see Section 6.1)
   are used to both differentiate and associate the multiple connections
   that comprise a single test.

   The protocol uses UDP transport [RFC0768] with two connection phases
   (Control and Data).  The  As shown below, exchanges 1 and 2 (see below) constitute the
   Control phase, while exchanges 3 and 4 constitute the Data phase.  In
   this document, the term message "message" and the term Protocol "Protocol Data Unit, Unit",
   or
   PDU ([RFC5044]) "PDU" [RFC5044], are used interchangeably.

   1.  Test Setup Request and Response: If a server instance is
       identified with a host name that resolves to both IPv4/IPv6
       addresses, it is recommended to use the first address returned in
       the name resolution response - regardless, response, regardless of whether it's IPv4 or
       IPv6.  Thus, the decision on the preferred IP address family is
       left to the name resolver's default behavior.  Support for
       separate IPv4 and IPv6 measurements or an IPv4 and IPv6 multi multi-
       connection setup are left for future improvement.  The client
       then requests to begin a test by communicating its UDPSTP
       protocol version, intended security mode, and datagram size
       support.  The server either confirms matching a configuration or
       rejects the connection request.  If the request is accepted, the
       server provides a unique ephemeral port number for each test
       connection, allowing further communication.  In a multi-
       connection setup, distinct UDP port numbers may be assigned with
       each Setup Response from a server instance.  Distinct UDP port
       numbers will be assigned if all Setup Response messages originate
       from the same server in that case.

   2.  Test Activation Request and Response: After having received a
       confirmation of the configuration by a server, the client
       composes a request conveying parameters such as the testing
       direction, the duration of the test interval and test sub-
       intervals, and various thresholds (for a detailed discussion, see
       [RFC9097] and [TR-471]).  The server then chooses to accept,
       ignore
       ignore, or modify any of the test parameters, parameters and communicates the
       set that will be used unless the client rejects the
       modifications.  Note that the client assumes that the Test
       Activation exchange has opened any co-located firewalls and
       network address/port translators for the test connection (in
       response to the Request packet on the ephemeral port number) and
       the traffic that follows.  See [RFC9097] for a more detailed
       discussion of firewall and NAT related NAT-related features.  If the Test
       Activation Request is rejected or fails, the client assumes that
       the firewall will close the address/port number pinhole entry
       after the firewall's configured idle traffic timeout.

   3.  Test Stream Transmission and Measurement Feedback Messages:
       Testing proceeds with one endpoint sending the Load PDUs and the
       other endpoint receiving the Load PDUs and sending frequent
       status messages to communicate the status and reception conditions
       there.
       conditions.  The data in the feedback messages, whether received
       from the client or when being sent to the client, is input to a
       load rate adjustment algorithm at the server server, which controls
       future sending rates at either end.  The choice to locate the
       load rate adjustment algorithm at the server, regardless of
       transmission direction, means that the algorithm can be updated
       more easily at a host within the network, network and at a fewer number of
       hosts than the number of clients.  Note that the status messages
       also help keep the pinhole (or mapping, respecitvely) respectively) active at
       on-path stateful devices.  UDPSTP is at least partially compliant
       to
       section Section 3.1 of [RFC8085]: [RFC8085] if the bottleneck is congested, but
       pending congestion is avoided by limiting the duration of that
       congestion to the minimum required to determine the bottleneck
       capacity.

   4.  Stopping the Test: When the specified test duration has been
       reached, the server initiates the exchange to stop the test by
       setting a STOP indication in its outgoing Load PDUs or Status
       Feedback messages.  After being received, the client acknowledges
       it by also setting a STOP indication in its outgoing Load PDUs or
       Status Feedback messages.  A graceful connection termination at
       each end then follows.  Since the Load PDUs and Status Feedback
       messages are used, this exchange is considered a sub-exchange of
       3.
       3 above.  If the Test test traffic stops or the communication path
       fails, the client assumes that the firewall will close the
       address/port number combination after the firewall's configured
       idle traffic timeout.

   5.  Both the client and server react to unexpected interruptions in
       the Control or Data phase, respectively.  Watchdog timers limit
       the time a server or client will wait before stopping all traffic
       and terminating a test.

   Figure 1 provides an example exchange of control and measurement PDUs
   for both a downstream and upstream UDP Speed Tests (always client
   initiated):

                =========== Downstream Test ===========
   +---------+                                           +---------+
   | Client  |          Test Setup Request ----->        |  Server |
   +---------+                                           +---------+
               <----- Test Setup Response (Accept)
               <----- Null Request PDU

                      Test Activation Request ----->

               <----- Test Activation Response (Accept)

               <----- Load PDUs

                         Status Feedback PDUs ----->

             After expiry of server's test duration timer...

               <----- Load PDU (TEST_ACT_STOP)

              Status Feedback PDU (TEST_ACT_STOP) ----->

                ============ Upstream Test ============
   +---------+                                           +---------+
   | Client  |          Test Setup Request ----->        |  Server |
   +---------+                                           +---------+
               <----- Test Setup Response (Accept)
               <----- Null Request PDU

                      Test Activation Request ----->

               <----- Test Activation Response (Accept)

                         Load PDUs ----->

               <----- Status Feedback PDUs

             After expiry of server's test duration timer...

               <----- Status Feedback PDU (TEST_ACT_STOP)

                       Load PDU (TEST_ACT_STOP) ----->

               Figure 1: Successful UDPSTP Message Exchanges

3.1.  Fixed-Rate Testing

   A network operator who is certain of the IP-Layer Capacity to be
   validated,
   validated can execute a fixed-rate test of the IP-Layer Capacity and
   avoid activating the measurement load rate adjustment algorithm (see
   section
   Section 8.1 of [RFC9097]).  Fixed-rate testing SHOULD only be
   activated for operation and maintenance purposes by operators within
   their local network domain.

   If a subscriber requests a diagnostic test from the network operator,
   this
   it strongly implies that there is no certainty on the bottleneck
   capacity and initiating a UDP Speed Test based on the load adjustment
   algorithm is RECOMMENDED.  To protect against misuse, a client (and
   in general, a consumer) MUST NOT be able to initiate a fixed-rate
   test.  A network operator may conduct a fixed-rate test for a stable
   measurement at or near the maximum determined by the load rate
   adjustment algorithm for debugging purposes.  This may be valuable
   for post-installation or post-repair verification.

3.2.  Handling of and Safeguards required Required by Self-Induced Congestion

   Active capacity measurement requires inducing intentional congestion.
   On paths where the capacity bottleneck is not shared with other
   flows, this self-congestion will be observed as loss and/or delay.
   However, when a path is shared by other flows, the measurment measurement
   traffic can congest the bottleneck on the path and therefore can degrade
   the performance of other flows.  Unrestricted use of the tool could
   lead to traffic starvation and significant issues.

   Measurements that generate traffic on shared paths (including WiFi Wi-Fi
   and Internet paths) need to consider the impact on other traffic.
   Fixed-rate testing operates without congestion control and therefore
   must not be executed over other operators operators' network segments.  Fixed-
   rate testing therefore testing, therefore, is limited to paths within a domain entirely
   managed and operated section-wise and end-to-end by the network
   operator performing the measurement.  When the risks of disruption to
   other flows has been considered, testing could be extended to include
   adjacent operational domains for which there is also a testing
   agreement.

   Concurrent tests that congest a common bottleneck will impair the
   measurement and result in additional congestion.  Concurrent
   measurements to measure the maximum capacity on a single path are
   counterproductive.  The number of concurrent independent tests of a
   path SHALL be limited to one, regardless of the number of flows.

   A load rate adjustment algorithm (see section Section 4.1) is required to
   mitigate the impact of this congestion and to limit the duration of
   any congestion by terminating the test when sudden impairments or a
   loss of connectivity is detected.

4.  Requirements, Security Operations, and Optional Checksum

   Security and checksum operation operations aren't covered by [RFC9097], which
   only defines the Method of Measurement.  This section adds the
   operational specification related to security and optional checksum.
   Due to the additional complexities, and loss of the direct Layer 3 to
   Layer 4 mapping of packets to datagrams, it is recommended that Layer
   3 fragmentation be avoided.  A simplified approach is to choose the
   default datagram size that is small enough to prevent fragmentation.
   This version of the specification does not support Datagram
   Packetization Layer Path MTU Discovery for Datagram Transports (DPLPMTUD) [RFC8899].  A
   future version could specify how to support this.  DPLPMTUD support
   will require a carefully adapted protocol design to ensure
   interoperability.  Unless IP fragmentation is expected, and is one of
   the attributes being measured, the IPv4 DF Don't Fragment (DF) bit
   SHOULD be set for all tests.

   Note: When this specification is used for network debugging, it may
   be useful for fragmentation to be under the control of the test
   administrator.

   This section specifies generic requirements requirements, which a measurement load
   rate adjustment algorithm conforming to this specification MUST
   fulfill.

4.1.  Load Rate Adjustment Algorithm Requirements

   This document specifies an active capacity measurement method using a
   load rate adjustment algorithm.  The requirements following below and
   the currently standardised standardized load rate adjustment algorithms B
   [Y.1540Amd2] and C [TR-471] result from years of experiments and
   testing by the original authors.  These tests were performed in Labs,
   but labs,
   and also in the Internet Internet, and covered a set of different fixed,
   broadband, mobile mobile, and wireless access types and technologies in
   different countries and continents.  Feedback received by performance
   measurement experts was included, as well as changes resulting from
   the standardisation standardization of [RFC9097] (reflected also in algorithm B
   [Y.1540Amd2], which updates a prior version of this algorithm).

   Load rate adjustment algorithms for capacity measurement MUST comply
   with the requirements specified by this section.  New standard load
   rate adjustment algorithms for capacity measurement MUST be reviewed
   by IETF designated experts prior to assignment of a codepoint code point in the
   IETF Test
   "Test Activation PDU Rate Adjustment Algorithm Registry.

   Load Algorithm" registry.

   The load rate adjustment algorithm for capacity measurement requirements:
   requirements is as follows:

   1.   The measurement load rate adjustment algorithm described in this
        section MUST NOT be used as a general Congestion Control
        Algorithm (CCA). CCA.

   2.   This specification MUST only be used in the application of
        diagnostic and operations measurements.

   3.   Both,   Both Load PDU messages and Status Feedback PDU messages MUST
        contain sequence numbers.

   4.   The nominal duration of a measurement interval at the
        Destination, parameter testIntTime (I ("I" in [RFC9097]), MUST
        default to a value of no more than 10 seconds.

   5.   A high-speed mode to achieve high sending rates quickly MUST
        reduce the measurement load below a level for which the first
        feedback interval inferred "congestion" from the measurements.
        Consecutive feedback intervals that have a supra-threshold count
        of sequence number anomalies and/or contain an upper delay
        variation threshold exception in all of the consecutive
        intervals,
        intervals indicate "congestion" within a test.  The threshold of
        consecutive feedback intervals SHALL be configurable with a
        default of 3 intervals and a maximum duration to infer
        congestion of 500 ms.

   6.   Congestion MUST be indicated, indicated if the Status Feedback PDUs either
        indicate that either sequence number anomalies were detected OR
        the delay range was above the upper delay variation threshold.
        The RECOMMENDED threshold values are 10 for sequence number gaps
        and 30 ms for lower and 90 ms for upper delay variation
        thresholds, respectively.

   7.   The load rate adjustment algorithm MUST include a Load PDU
        timeout and a Status PDU timeout timeout, which both stop the test when
        received PDU streams cease unexpectedly.

   8.   The Load PDU timeout SHALL be reset to the configured value each
        time a Load PDU is received.  If the Load PDU timeout expires,
        the receiver SHALL be closed and no further Status PDU feedback
        sent.  The default Load PDU timeout MUST be no more than 1 sec.
        second.

   9.   The Status PDU timeout SHALL be reset to the configured value
        each time a feedback message is received.  If the Status PDU
        timeout expires, the sender SHALL be closed and no further load
        packets sent.  The default Status PDU timeout timeout MUST be no more
        than 1 second.

   10.  If a network operator is certain of the IP-Layer Capacity to be
        validated, then testing MAY start with a fixed-rate test at the
        IP-Layer Capacity and avoid activating the measurement load rate
        adjustment algorithm (see section Section 8.1 of [RFC9097]).  However,
        the stimulus for a diagnostic test (such as a subscriber
        request) strongly implies that there is no certainty, and the
        load adjustment algorithm is RECOMMENDED.

   11.  This specification MUST only be used in circumstances consistent
        with Section 10 (Security Considerations) of [RFC9097] ("Security Considerations"). [RFC9097].

   12.  Further measurement load rate adjustment algorithm requirements
        are specified by [RFC9097].

   The following measurement load rate adjustment algorithms are subject
   to these requirements:

   *  Measurement load rate adjustment algorithm B [Y.1540Amd2].

   *  Measurement load rate adjustment algorithm C [TR-471].

4.2.  Parameters and Definitions

   Please refer to Section 4 of [RFC9097] for an overview of Parameters
   related to the Maximum IP-Layer Capacity Metric and Method.  A set of
   error-codes
   error codes to support debugging are provided in Section 11.3.5.

4.3.  Security Mode Operations

   There are two security modes of operation that perform authentication
   of the client/server messaging.  The two modes are:

   1.  A REQUIRED mode with authentication during the Control phase
       (Test Setup and Test Activation exchanges).  This mode may be
       preferred for large-scale servers or low-end client devices where
       processing power is a consideration (see Section 2).

   2.  An OPTIONAL mode with the additional authentication of the Status
       Feedback messages during the Data phase.  This mode may be
       preferred for environments that desire an additional level of
       message integrity verification throughout the test (see
       Section 2).

   The requirements discussed hereafter refer to the PDUs in sections Sections 5
   and 6 below, primarily the authMode, keyId, authUnixTime, and
   authDigest fields.  The roles in this section have been generalized
   so that the requirements for the PDU sender and receiver can be re-
   used and referred to by other sections within this document.  Each
   successive mode increases security, security but comes with additional
   performance impacts and complexity.  The protocol is used with
   unsubstantial payload payload, and it may operate on very low-end devices.
   Offering the flexibility of various security operation modes allows
   for accommodation of available end-device resources.  In general, an
   active measurement technique as the one defined by this document is
   better suited to protect the privacy of those involved in
   measurements [RFC7594].

   A load rate adjustment method needs to satisfy the requirements
   listed in Section 4.1.  This is necessary also to avoid potentially
   inducing congestion after there is an overload or loss (including
   loss on the control path).

4.3.1.  Mode 1: Required Authenticated Mode

   In this mode, the client and the server SHALL be configured to use
   one of a number of shared secret keys, designated via the numeric
   keyId field (see Section 4.4).  This key SHALL be used as input to
   the KDF (Key Derivation Function), KDF, as specified in Section 4.4.1, to obtain the actual keys
   used by the client and server for authentication.

   During the Control phase, the sender SHALL read the current system
   (wall-clock) time and populate the authUnixTime field and next
   calculate the 32-octet HMAC-SHA-256 hash of the entire PDU according
   to section Section 6 of [RFC6234] (with the authDigest and checkSum preset to
   all zeroes).  The authDigest field is filled by the result, then the
   packet is sent to the receiver.  The value in the authUnixTime field
   is a 32-bit timestamp timestamp, and a 10-second tolerance window (+/- 5
   seconds) SHALL be used by the receiver to distinguish a subsequent
   replay of a PDU.  See Table 2 of [TR-471] for a recommended timestamp
   resolution.

   Upon reception, the receiver SHALL validate the message PDU for
   correct length, validity of authDigest, immediacy of authUnixTime,
   and expected formatting (PDU-specific fields are also checked, such
   as protocol version).  Validation of the authDigest requires that it
   will
   be extracted from the PDU and the field, along with the checkSum
   field, zeroed prior to the HMAC Hashed Message Authentication Code (HMAC)
   calculation used for comparison (see
   section Section 7.2 of [RFC9145]).

   If the validation fails, the receiver SHOULD NOT continue with the
   Control phase and implement silent rejection (no further packets sent
   on the address/port pairs).  The exception is when the testing hosts
   have been configured for troubleshooting Control phase failures and
   rejection messages will aid in the process.

   If the validation succeeds, the receiver SHALL continue with the
   Control phase and compose a successful response or a response
   indicating the error conditions identified (if any).

   This process SHALL be executed for the request and response in the
   Test Setup exchange, including the Null Request (Section 5) and the
   Test Activation exchange (Section 6).

4.3.2.  Mode 2: Optional Authenticated Mode for Data Phase

   This mode incorporates Authenticated mode 1.  When using the optional
   authentication during the Data phase, authentication SHALL also be
   applied to the Status Feedback PDU (see Section 7.2).  The client
   sends the Status PDU in a downstream test, and the server sends it in
   an upstream test.

   The Status PDU sender SHALL 1) read the current system (wall-clock)
   time and populate the authUnixTime field, then 2) calculate the authDigest
   field of the entire Status PDU (with the authDigest and checkSum
   preset to all zeroes) zeroes), and 3) send the packet to the receiver.  The
   values of authUnixTime field and authDigest field are determined as
   defined by Section 4.3.1.

   Upon reception, the receiver SHALL validate the message PDU for
   correct length, validity of authDigest, immediacy of authUnixTime,
   and expected formatting (PDU-specific fields are also checked, such
   as protocol version).  Validation of the authDigest will require that
   it be extracted from the PDU and the field, along with the checkSum
   field, zeroed prior to the HMAC calculation used for comparison.

   If the authentication validation fails, the receiver SHALL ignore the
   message.  If the watchdog timer expires (due to successive failed
   validations), the test session will prematurely terminate (no (and no
   further load traffic SHALL be transmitted).  This is necessary also
   to avoid potentially inducing congestion after there is an overload
   or loss on the control path.

   If this optional mode has not been selected, then the keyId,
   authUnixTime, and authDigest fields of the Status PDU (see
   Section 7.2) SHALL be set to all zeroes.

4.4.  Key Management

   Section 2 of [RFC7210] specifies a conceptual database for long-lived
   cryptographic keys.  The key table SHALL be used with the REQUIRED
   authentication mode and the OPTIONAL authentication mode (using the
   same key).  For authentication, this key SHALL only be used as input
   to the KDF, as specified in Section 4.4.1, to derive the actual keys
   used for authentication processing.  Key rotation and related
   management specifics are beyond the scope of this document.

   The key table SHALL have (at least) the following fields, referring
   to fields per
   Section 2 of [RFC7210]:

   *  AdminKeyName

   *  LocalKeyName

   *  KDF

   *  AlgID

   *  Key

   *  SendLifetimeStart

   *  SendLifetimeEnd

   *  AcceptLifetimeStart

   *  AcceptLifetimeEnd

   The LocalKeyName SHALL be determined from the corresponding keyId
   field in the PDUs that follow.

4.4.1.  Key Derivation Function (KDF)

   A Key Derivation Function (KDF) is a one-way function that provides
   cryptographic separation of key material.  The protocol requires a
   KDF to securely derive cryptographic keys used for authentication of
   protocol messages.  The inclusion of a KDF ensures that keys are
   generated in a standardized, cryptographically secure manner,
   reducing the risk of key compromise and enabling interoperability
   across implementations.  The benefits of using a KDF include:

   *  Security: A KDF produces keys with high entropy, resistant to
      brute-force and related-key attacks, ensuring robust protection
      for protocol communications.

   *  Flexibility: The KDF allows derivation of multiple keys from a
      single shared secret, supporting distinct keys for client and
      server authentication.

   *  Standardization: By adhering to established cryptographic
      standards, the KDF ensures compatibility with existing security
      frameworks and facilitates implementation audits.

   *  Efficiency: The KDF enables efficient key generation without
      requiring additional key exchange mechanisms, minimizing protocol
      overhead.

   The KDF algorithm SHALL be a Key Derivation Function in Counter Mode,
   as specified in Section 4.1 of [NIST800-108].  This algorithm uses a
   counter-based mechanism to generate key material from a shared
   secret, ensuring deterministic and secure key derivation.  The
   Pseudorandom Function (PRF) used in the KDF SHALL be HMAC-SHA-256, as
   defined in section Section 6 of [RFC6234].  IANA is asked to assign “HMAC-
   SHA-256” has assigned "HMAC-SHA-256"
   as a new KeyTable KDF (Section 11.2).

   The KDF SHALL use the following parameters:

   *  Kin (Key-derivation (key-derivation key): The shared key as identified by the
      keyId field in the PDU.

   *  Label: The fixed string "UDPSTP" (without quotes), encoded as a
      UTF-8 string, used to bind the derived keys to this specific
      protocol.

   *  Context: The UTF-8 string representation of the authUnixTime field
      received in the very first Setup Request PDU sent from the client
      to the server.  This ensures that the derived keys are unique to
      the session and tied to the temporal context of the initial setup
      exchange.  The authUnixTime field serves as a nonce and is
      protected from modification by the HMAC-SHA-256 hash present in
      the authDigest field.

   *  r: The length of the binary encoding of the counter SHALL be 32
      (bits).

   The total derived key material SHALL be 512 bits (64 octets) in
   length.  The key material SHALL be structured as follows, from most
   significant bit (MSB) to least significant bit (LSB):

   *  Client Authentication Key: 256 bits (32 octets), octets); used for
      authenticating messages sent by the client.

   *  Server Authentication Key: 256 bits (32 octets), octets); used for
      authenticating messages sent by the server.

   This structure ensures that the derived keys are sufficient for
   securing authentication operations within the protocol, while
   maintaining clear separation of function and directionality.

   If authentication of the initial Setup Request PDU received by the
   server fails, due to an invalid authDigest field, any and all derived
   keying material and keys SHALL be considered invalid.

   The key material derived from the initial Setup Request PDU, either
   at the client prior to transmission or at the server upon reception,
   SHALL be used for all subsequent PDUs sent between them for that test
   connection.  As such, the KDF is only required to be executed once by
   the client and server for each test connection.

   Appendix A, Figure 12 provides a code snippet demonstrating
   derivation of the specified keys from key material using the OpenSSL
   cryptographic library.  Specifically, library, specifically the high-level Key-Based EVP_KDF
   implementation (Key-Based Envelope Key Derivation Function, Function); see
   [EVP_KDF-KB] for details). details.

4.5.  Configuration of Network Functions with Stateful Filtering

   Successful interaction with a local firewall assumes the firewall is
   configured to allow a host to open a bidirectional connection using
   unique source and destination addresses as well as port numbers by
   sending a packet using that 4-tuple for a given transport protocol.
   The client's interaction with its firewall depends on this
   configuration.

   The firewall at the server MUST be configured with an open pinhole
   for the server IP address and standard UDP port of the server.  All
   messages sent by the client to the server use this standard UDP port.

   The server uses one ephemeral UDP port per test connection.  Assuming
   that the firewall administration at the server does not allow an open
   UDP ephemeral port range, then the server MUST send a Null Request to
   the client from the ephemeral port communicated to the client in the
   Test Setup Response.  The Null Request may not reach the client: it
   may be discarded by the client's firewall.

   If the server firewall administration allows an open UDP ephemeral
   port range, then the Null Request is not strictly necessary.
   However, the availability of an open port range policy cannot be
   assumed.

   Network Address Translators (NATs) are expected to offer support of a
   wider set of operational configurations as compared to Firewalls. firewalls.
   Specifications covering NAT behaviour behavior, apart from the above above, are out
   of the scope of this document, as are combined implementations of NAT
   and firewalls too.

4.6.  Optional Checksum

   The protocol MUST utilize the standard UDP checksum for all IPv4 and
   IPv6 datagrams it sends.  The purpose of this checksum is to protect
   the intended recipient as well as other recipients to whom a
   corrupted packet may be delivered.  This provides:

   *  Protection of the endpoint transport state from unnecessary extra
      state (e.g., Invalid state from rogue packets).

   *  Protection of the endpoint transport state from corruption of
      internal state.

   *  Pre-filtering by the endpoint of erroneous data, to protect the
      transport from unnecessary processing and from corruption that it
      can not
      cannot itself reject.

   *  Pre-filtering of incorrectly addressed destination packets, before
      responding to a source address.

   All of the PDUs exchanged between the client and server support an
   optional header checksum that covers the various fields in the UDPSTP
   PDU (excluding the Payload Content payload content of the Load PDU and, to be clear,
   also the IP- IP and UDP-header). UDP headers).  The calculation is the same as the
   16-bit one's complement Internet checksum used in the IPv4 packet
   header (see section Section 3.1 of [RFC0791]).  This checksum is intended for
   environments where UDP data integrity may be uncertain.  This
   includes situations where the standard UDP checksum is not verified
   upon reception or a nonstandard network API is in use (things
   typically done to improve performance on low-end devices).  However,
   all UDPSTP datagrams transmitted via IPv4 or IPv6 SHALL include a
   standard UDP checksum to protect other potential recipients to whom a
   corrupted packet may be delivered.  In the case of a nonstandard
   network API, one option to reduce processing overhead may be to
   restrict testing to only utilize a Payload Content payload content of all zeros so
   that the UDP checksum calculation need not include it for Load PDUs.

   If a PDU sender is populating the checkSum field, it SHALL do so as
   the last step after the PDU is built in all other respects (with the
   checkSum field set to zero prior to the calculation).  The PDU
   receiver SHALL subsequently verify the PDU checksum whenever checksum
   processing has been configured and the field is populated.  If PDU
   checksum validation fails, the PDU SHALL be discarded.

   Because of the redundancy when used in conjunction with
   authentication, it is OPTIONAL for a PDU sender to utilize the UDPSTP
   checkSum field.  However, because authentication is not applicable to
   the Load PDU, the checkSum field SHALL be utilized by the sender
   whenever UDP data integrity may be uncertain (as outlined above).

5.  Test Setup Request and Response

   The client source IP address and the server destination IP address
   MUST NOT be a broadcast or multicast address.  Any Test Setup Request
   or Test Setup Response packet containing a multicast or broadcast
   source or destination IP address MUST be silently dropped and
   ignored.

   The measurement method and the protocol specified by this document
   are expected to function with unicast and anycast IP addresses.

5.1.  Client Generates Test Setup Request

   The client SHALL begin the Control phase exchange by sending a Test
   Setup Request message to the server's (standard) control port.  This
   standard UDPSTP port number is utilized for each connection of a
   multi-connection test.

   The client SHALL simultaneously start a test initiation timer so that
   if the Control phase fails to complete Test Setup and Test Activation
   exchanges in the allocated time, the client software SHALL exit
   (close the UDP socket and indicate an error message to the user).
   Lost messages result in a Test Setup and Test Activation failure.
   The test initiation timer MAY reuse the test termination timeout
   value.

   The watchdog timeout is configured as a 1-second interval to trigger
   a warning message that the received traffic has stopped.  The test
   termination timeout is based on the watchdog interval, interval and implements
   a wait time of 2 additional seconds before triggering a non-graceful
   termination.

   Note: Any field labeled as 'reserved for alignment', in any PDU, MUST
   be set to 0 and MUST be ignored upon receipt.

   The UDP PDU format layout SHALL be as follows (big-endian AB,
   starting by most significant byte and ending by least significant
   byte):

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |            pduId              |          protocolVer          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |    mcIndex    |    mcCount    |            mcIdent            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  cmdRequest   | cmdResponse   |         maxBandwidth          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |           testPort            |modifierBitmap |   authMode    |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         authUnixTime                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   .                     authDigest (32-octet) (32 octets)                    .
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     keyId     | reservedAuth1 |           checkSum            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                      Figure 2: Test Setup PDU Layout

   Additional details regarding the Setup Request and Response fields
   are as follows:

   pduId:  A two-octet field.  IANA is asked to assign has assigned the value hex value 0xACE1
      (Section 11.3.1).

   protocolVer:  A two-octet field, field identifying the actual protocol
      version.  IANA is asked to assign only one initial value, has assigned 20 as the value (Section 11.3.2).

   mcIndex:  A one-octet field, field indicating the index of a connection
      relative to all connections that make up a single test (starting
      at 0, incremented by 1 per connection).  It is used to
      differentiate separate connections within a multi-connection test.
      An implementation may restrict the number of connections supported
      for a single test to a value less than or equal to 255.

   mcCount:  A one-octet field, field indicating the total count of connections
      that the client is attempting to setup. set up.

   mcIdent:  A two-octet field containing a pseudorandom non-zero
      identifier (via a Random Number Generator, source port number,...) number,
      ...) that is common to all connections of a single test.  It is
      used by clients/servers to associate separate connections with a
      single multi-connection test.

   cmdRequest:  A one-octet field set to CHSR_CREQ_SETUPREQ to indicate
      a Setup request Request message.  Note that CHSR_CREQ_NONE remains unused.

   cmdResponse:  A one-octet field.  All Request PDUs always have a
      Command Response of XXXX_CRSP_NONE.

   maxBandwith:  A two-octet field.  A non-zero value of this field
      specifies the maximum bit rate the client expects to send or
      receive during the requested test in Mbps.  The server compares
      this value to its currently available configured limit for test
      admission control.  This field MAY be used for rate-limiting to rate-limit the
      maximum rate the server should attempt.  The maxBandwidth field's
      most significant bit, the CHSR_USDIR_BIT, is set to 0 by default
      to indicate "downstream" and has to be set to 1 to indicate
      "upstream".

   testPort:  A two-octet field, field set to zero in the Test Setup Request
      and populated by the server in the Test Setup Response.  It
      contains the UDP ephemeral port number on the server that the
      client has to use for the Test Activation Request and subsequent
      Load or Status PDUs.

   modifierBitmap:  A one-octet field.  This document only assigns two
      bits in this bitmap, bitmap; see Section 11.3.3:

   CHSR_JUMBO_STATUS

      CHSR_JUMBO_STATUS:  This bit SHALL be set by default.  By default,
         sending rates up to 1 Gbps SHALL NOT produce IP packet sizes
         greater than 1250 bytes (unless CHSR_TRADITIONAL_MTU is set) set),
         while rates above 1 Gbps MAY produce IP packet sizes up to 9000
         bytes.  When CHSR_JUMBO_STATUS is not set, all sending rates
         SHALL NOT produce IP packet sizes greater than 1250 bytes
         (unless CHSR_TRADITIONAL_MTU is set).

   CHSR_TRADITIONAL_MTU

      CHSR_TRADITIONAL_MTU:  This bit SHALL NOT be set by default.  If
         set, sending rates up to 1 Gbps MAY produce IP packets up to
         the
      Traditional traditional size of 1500 bytes.  If CHSR_JUMBO_STATUS is
         simultaneously not set, all sending rates SHALL NOT produce IP
         packets greater than the Traditional traditional size of 1500 bytes.

   Other bit positions are left unassigned by per this document.

   authMode:  A one-octet field.  The authMode field currently has two
      values assigned (see Section 11.3.4).  One of the following has to
      be set (see Section 4.3 for requirements and details of
      operation):

      AUTHMODE_1:  Required Authentication for Control phase phase.

      AUTHMODE_2:  Optional Authentication for Control and Data phase
         (Status Feedback PDU only) only).

   A range of 60 through 63 is reserved for experimentation.  IANA is
   asked to create has
   created a registry for the assigned values; see the IANA
   Considerations Section. section.

   authUnixTime:  A 32-bit timestamp of the current system (wall-clock)
      time since the Unix Epoch on January 1st, 1, 1970 at 00:00:00 UTC.

   authDigest:  This field contains the 32-octet HMAC-SHA-256 hash that
      covers the entire PDU.  Normally, the calculation is done as the
      last step of building the PDU.  However, if the optional checkSum
      field is being utilized, it becomes the penultimate step and is
      done just prior to the checksum calculation (with the checkSum
      field set to zero).

   keyId:  A one-octet field carrying localKeyName, the numeric key
      identifier for a key in the shared key table.

   reservedAuth1:  A one-octet field.  This field MUST be set to 0 and
      MUST be ignored upon receipt.  Consistent naming and placement of
      the reservedAuth1 field across all PDUs is done to minimize
   authentication related
      authentication-related changes in future UDPSTP versions.

   checkSum:  A two-octet field, field containing an optional checksum of the
      entire PDU (see Section 4.6 for guidance).  The calculation is
      done as the very last step of building the PDU, with the checkSum
      field set to zero.

5.2.  Server Test Setup Request Processing and Response Generation

   This section describes the processes at the server that are used to
   evaluate the Test Setup Request and determine the next steps.  When
   the server receives the Setup Request, it SHALL first perform the
   following:

   Message Verification Procedure Procedure:

   1.  Verify that the size of the message is correct.

   2.  If the optional checkSum field is being utilized, validate the
       checksum as described in Section 4.6 and (if valid) zero the
       checkSum field prior to authentication verification.

   3.  Verify that the authMode value is valid and appropriate (per
       Section 4.3) for the message type.

   4.  If the authMode is valid and appropriate, authenticate the
       message by checking the authDigest as prescribed in Section 4.3.

   5.  If the message is authentic, check the authUnixTime field for
       acceptable immediacy.

   Note: If any of the above checks fail, the message SHALL be
   considered invalid.

5.2.1.  Test Setup Request Processing - -- Rejection

   The server SHALL then evaluate the other fields in the protocol
   header, such as the protocol version, the PDU ID (to validate the
   type of message), the maximum Bandwidth bandwidth requested for the test, and
   the modifierBitmap for use of options such as Jumbo datagram status
   and Traditional MTU (1500 bytes).

   If the client has selected options for: for

   *  Jumbo datagram support (modifierBitmap),

   *  Traditional MTU (modifierBitmap), and

   *  Authentication mode (authMode)

   that do not match the server configuration, the server MUST reject
   the Setup Request.

   If the Setup Request must be rejected, the conditions below determine
   whether the server sends a response:

   *  If the authDigest is valid, a Test Setup Response SHALL be sent
      back to the client with a corresponding command response Command Response value
      indicating the reason for the rejection.

   *  If the authDigest is invalid, then the Test Setup Request SHOULD
      fail silently.  The exception is for operations support: server
      administrators are permitted to send a Setup Response to support
      operations and troubleshooting.

   The additional circumstances when a server SHALL NOT communicate the
   appropriate Command Response code for an error condition (fail
   silently) are when:

   1.

   *  the Setup Request PDU size is not equal to the 'struct
      controlHdrSR' size shown in Figure 3,

   2.

   *  the PDU ID is not 0xACE1 (Test Setup PDU), or

   3.

   *  a directed attack has been detected,

   in which case detected.

   In this case, the server will allow setup attempts to terminate
   silently.  Attack detection is beyond the scope of this
   specification.

   When the server replies to a Test Setup Request message, the Test
   Setup Response PDU is structured identically to the Request PDU and
   SHALL retain the original values received in it, with the following
   exceptions:

   *  The cmdRequest field is set to CHSR_CREQ_SETUPRSP, indicating a
      response.

   *  The cmdResponse field is set to an error code (starting at
      cmdResponse 2, Bad Protocol Version, Version; see Section 11.3.5),
      indicating the reason for rejection.  If cmdResponse indicates a
      bad protocol version (CHSR_CRSP_BADVER), the protocolVer field is
      also updated to indicate the current expected version.

   *  The authUnixTime field is updated to the current system (wall-
      clock) time and, after the authDigest and checkSum fields are
      zeroed, the authDigest is recalculated and inserted.  If the
      optional checkSum field is being utilized, it is then also
      calculated and inserted.

   The Setup Request/Response message PDU SHALL be organized as follows
   (here and in all following code figures coded by programming language
   C [C-Prog]):

   <CODE BEGINS>
   //
   // Control header for UDP payload of Setup Request/Response PDUs
   //
   struct controlHdrSR {
   #define CHSR_ID 0xACE1
           uint16_t pduId; // PDU ID
   #define PROTOCOL_VER 20
           uint16_t protocolVer; // Protocol version
           uint8_t mcIndex;      // Multi-connection index
           uint8_t mcCount;      // Multi-connection count
           uint16_t mcIdent;     // Multi-connection identifier
   #define CHSR_CREQ_NONE     0
   #define CHSR_CREQ_SETUPREQ 1   // Setup request
   #define CHSR_CREQ_SETUPRSP 2   // Setup response
           uint8_t cmdRequest;    // Command request
   #define CHSR_CRSP_NONE     0   // (used with request)
   #define CHSR_CRSP_ACKOK    1   // Acknowledgment
   #define CHSR_CRSP_BADVER   2   // Bad version
   #define CHSR_CRSP_BADJS    3   // Jumbo setting mismatch
   #define CHSR_CRSP_AUTHNC   4   // Auth. not configured
   #define CHSR_CRSP_AUTHREQ  5   // Auth. required
   #define CHSR_CRSP_AUTHINV  6   // Auth. (mode) invalid
   #define CHSR_CRSP_AUTHFAIL 7   // Auth. failure
   #define CHSR_CRSP_AUTHTIME 8   // Auth. time invalid
   #define CHSR_CRSP_NOMAXBW  9   // Max bandwidth required
   #define CHSR_CRSP_CAPEXC   10  // Capacity exceeded
   #define CHSR_CRSP_BADTMTU  11  // Trad. MTU mismatch
   #define CHSR_CRSP_MCINVPAR 12  // Multi-conn. invalid params
   #define CHSR_CRSP_CONNFAIL 13  // Conn. allocation failure
           uint8_t cmdResponse;   // Command response
   #define CHSR_USDIR_BIT 0x8000  // Upstream direction bit
           uint16_t maxBandwidth; // Required bandwidth in Mbps
           uint16_t testPort;     // Test port on server
   #define CHSR_JUMBO_STATUS    0x01
   #define CHSR_TRADITIONAL_MTU 0x02
           uint8_t modifierBitmap; // Modifier bitmap
           // ========== Integrity Verification ==========
   #define AUTHMODE_1 1 // Mode 1: Authenticated Control
   #define AUTHMODE_2 2 // Mode 2: Authenticated Control+Status
           uint8_t authMode;      // Authentication mode
           uint32_t authUnixTime; // Authentication timestamp
   #define AUTH_DIGEST_LENGTH 32  // SHA-256 digest length
           uint8_t authDigest[AUTH_DIGEST_LENGTH];
           uint8_t keyId;         // Key ID in shared table
           uint8_t reservedAuth1; // (reserved for alignment)
           uint16_t checkSum;     // Header checksum
   };
   #define SHA256_KEY_LEN 32 // Authentication key length
   <CODE ENDS>

                          Figure 3: Test Setup PDU

5.2.2.  Test Setup Request Processing - -- Acceptance

   If the server finds that the Setup Request matches its configuration
   and is otherwise acceptable, the server SHALL initiate a new
   connection to receive the Test Activation Request from the client,
   using a new UDP socket allocated from the UDP ephemeral port range.
   This new socket will also be used for the subsequent Load and Status
   PDUs that are part of testing (with the port number communicated back
   to the client in testPort field of the Test Setup Response).  Then,
   the server SHALL start a watchdog timer (to terminate the new
   connection if the client goes silent) and SHALL send the Test Setup
   Response back to the client.  The watchdog timer is set to the same
   value as on the Client client side (see Section 5)

   When the server replies to the Test Setup Request message, the Test
   Setup Response PDU is structured identically to the Request PDU and
   SHALL retain the original values received in it, with the following
   exceptions:

   *  The cmdRequest field is set to CHSR_CREQ_SETUPRSP, indicating a
      response.

   *  The cmdResponse field is set to CHSR_CRSP_ACKOK, indicating an
      acknowledgment.

   *  The testPort field is set to the ephemeral port number to be used
      for the client's Test Activation Request and all subsequent
      communication.

   *  The authUnixTime field is updated to the current system (wall-
      clock) time and, after the authDigest and checkSum fields are
      zeroed, the authDigest is recalculated and inserted.  If the
      optional checkSum field is being utilized, it is then also
      calculated and inserted.

   Finally, the new UDP connection associated with the new socket and
   port are made ready, and the server awaits further communication
   there.

   To ensure that a server's local firewall will successfully allow
   packets received for the new ephemeral port, the server SHALL
   immediately send a Null Request with the corresponding values
   including the source and destination IP addresses and port numbers.
   The source port SHALL be the new ephemeral port.  This operation
   allows communication to the server even when the server's local
   firewall prohibits open ranges of ephemeral ports.  The packet is not
   expected to arrive successfully at the client if the client-side
   firewall blocks unexpected traffic.  If the Null Request arrives at
   the client, it is a confirmation that further exchanges are possible
   on the new port-pair (but this is not strictly necessary).  If
   received, the client SHALL follow the message verification procedure Message Verification Procedure
   listed in Section 5.2, Paragraph 2.  Note that there is no response
   to a Null Request.

   The UDP PDU format layout SHALL be as follows (big-endian AB):

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |            pduId              |          protocolVer          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  cmdRequest   |  cmdResponse  |   reserved1   |   authMode    |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         authUnixTime                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   .                     authDigest (32-octet) (32 octets)                    .
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     keyId     | reservedAuth1 |           checkSum            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                     Figure 4: Null Request PDU Layout

   Authentication

   The authentication and checksum checkSum fields follow the same methodology as
   with the Setup Request and Response.

   Additional details regarding the Null Request fields are as follows:

   pduId:  IANA is asked to assign has assigned the value hex value 0xDEAD (Section 11.3.1).

   cmdRequest: Is set  Set to CHNR_CREQ_NULLREQ indicating to indicate a Null Request
      message.

   cmdResponse: Is set  Set to CHNR_CRSP_NONE.

   authMode:  Same as in Section 5.1 5.1.

   authUnixTime:  Same as in Section 5.1 5.1.

   authDigest:  Same as in Section 5.1 5.1.

   keyId:  Same as in Section 5.1 5.1.

   reservedAuth1:  Same as in Section 5.1 5.1.

   checkSum:  Same as in Section 5.1 5.1.

   If a Test Activation Request is not subsequently received from the
   client on the new ephemeral port number before the watchdog timer
   expires, the server SHALL close the socket and deallocate the
   associated resources.

   The Null Request message PDU SHALL be organized as follows:

   <CODE BEGINS>
   //
   // Control header for UDP payload of Null Request PDU
   //
   struct controlHdrNR {
   #define CHNR_ID 0xDEAD
           uint16_t pduId;       // PDU ID
           uint16_t protocolVer; // Protocol version
   #define CHNR_CREQ_NONE    0
   #define CHNR_CREQ_NULLREQ 1  // Null request
           uint8_t cmdRequest;  // Command request
   #define CHNR_CRSP_NONE 0     // (used with request)
           uint8_t cmdResponse; // Command response
           uint8_t reserved1;   // (reserved for alignment)
           // ========== Integrity Verification ==========
           uint8_t authMode;      // Authentication mode
           uint32_t authUnixTime; // Authentication timestamp
           uint8_t authDigest[AUTH_DIGEST_LENGTH];
           uint8_t keyId;         // Key ID in shared table
           uint8_t reservedAuth1; // (reserved for alignment)
           uint16_t checkSum;     // Header checksum
   };
   <CODE ENDS>

                         Figure 5: Null Request PDU

5.3.  Setup Response Processing at the Client

   When the client receives the Test Setup Response message, it SHALL
   first follow the Message Verification Procedure listed in
   Section 5.2, Paragraph 2.

   It

   The client SHALL then proceed to evaluate the other fields in the
   protocol, beginning with the protocol version, PDU ID (to validate
   the type of message), and cmdRequest for the role of the message,
   which MUST be Test Setup Response, CHSR_CREQ_SETUPRSP, as indicated
   by Figure 3.

   If the cmdResponse value indicates an error (values greater than
   CHSR_CRSP_ACKOK)
   CHSR_CRSP_ACKOK), the client SHALL display/report a relevant message
   to the user or management process and exit.  If the client receives a
   Command Response code that is not equal to one of the codes defined,
   the client MUST terminate the connection and terminate operation of
   the current Setup Request.  If the Command Server Response code value
   indicates success (CHSR_CRSP_ACKOK), the client SHALL compose a Test
   Activation Request with all the test parameters it desires, such as
   the test direction, the test duration, etc., as described below.

6.  Test Activation Request and Response

   This section is divided according to the sending and processing of
   the client, server, client and server and again at the client.

6.1.  Client Generates Test Activation Request

   Upon a successful setup exchange, the client SHALL compose and send
   the Test Activation Request to the UDP port number the server
   communicated in the Test Setup Response (the new ephemeral port, and
   not the standard UDPSTP port).

   The UDP PDU format layout is as follows (big-endian AB):

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          txInterval1                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          udpPayload1                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          burstSize1                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          txInterval2                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          udpPayload2                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          burstSize2                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                           udpAddon2                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |            pduId              |          protocolVer          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  cmdRequest   | cmdResponse   |           lowThresh           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |         upperThresh           |           trialInt            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |         testIntTime           |   reserved1   |   dscpEcn     |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |         srIndexConf           |  useOwDelVar  |highSpeedDelta |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |         slowAdjThresh         |         seqErrThresh          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   | ignoreOooDup  |modifierBitmap |  rateAdjAlgo  |   reserved2   |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-|-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   .                      srStruct (28 octets)                     .
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |        subIntPeriod           |          reserved3            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |          reserved4            |   reserved5   |   authMode    |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         authUnixTime                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   .                     authDigest (32-octet) (32 octets)                    .
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     keyId     | reservedAuth1 |           checkSum            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                    Figure 6: Test Activation PDU Layout

   Fields are populated based on default values or command-line options.
   Authentication
   The authentication and checksum checkSum fields follow the same methodology as
   with the Setup Request and Response.

   pduId:  IANA is asked to assign has assigned the value hex value 0xACE2 (Section 11.3.1).

   cmdRequest: Is set  Set to CHTA_CREQ_TESTACTUS to indicate an upstream test
      activation or alternatively to CHTA_CREQ_TESTACTDS to indicate a
      downstream test activation.  Note that CHTA_CREQ_NONE remains
      unused.  See Section 11.3.6.

   cmdResponse: three  Three CHTA_CRSP_<Indication> values are defined, defined; see
      Figure 7.

   lowThresh:  Two two-octet field, fields, low threshold Low on the Range of
      Round Trip Time variation, RTT (Range is values above minimum RTT,
      RTT); see also Table 3 [TR-471].

   upperThresh:  Two two-octet field, fields, upper threshold Low on the Range
      of Round Trip Time variation, RTT (Range is values above minimum RTT,
      RTT); see also Table 3 of [TR-471].

   trialInt:  A two-octet field, field indicating the Status Feedback / trial
      interval [ms].  The test interval Delta_t is subdivided into a
      number of sub-intervals dt, and each sub-interval is further
      divided into a number of trial intervals (see [TR-471]).  Starts
      by 1 and is continuously incremented during a single test interval
      (testIntTime).

   testIntTime:  A two-octet field.  Duration of the test (either
      downlink or uplink) with search algorithm in use, which serves as
      the maximum duration of the search process in Seconds seconds (see also
   TestInterval,
      TestInterval in Table 3 of [TR-471]. [TR-471]).

   dscpEcn:  Diffserv code point and ECN field, field; see also the DSCP field
      specified by [TR-471].  This specification does not provide an ECN-
   capable transport, therefore
      ECN-capable transport; therefore, the sender SHALL set the ECN
      field to not_ECT.

   srIndexConf:  A two-octet field.  The requested Configured Sending
      Rate Table index, used in a Test Activation Request, of the
      desired fixed or starting sending rate (depending on whether
      CHTA_SRIDX_ISSTART is cleared or set set, respectively).  Because a
      value of zero is a valid fixed or starting sending rate index, the
      field SHALL be set to its maximum (CHTA_SRIDX_DEF) when requesting
      the default behavior of the server (starting with the selected
      load rate adjustment algorithm at its minimum/zero index).  This
      SHALL be equivalent to setting srIndexConf to zero and setting the
      CHTA_SRIDX_ISSTART bit.

   useOwDelVar:  A one-octet field.  Boolean, default True (False: Use (if False,
      use RTT=round-trip delay variation in the load rate adjustment
   algorithm)(True: EnableIPDV
      algorithm; if True, use EnableIPDV, which uses one-way delay
      variation for the load rate adjustment algorithm), see algorithm).  See EnableIPDV
      in Table 1 of [TR-471].

   highSpeedDelta:  A one-octet field, field; see Appendix A of [RFC9097].

   slowAdjThresh,

   slowAdjThresh and seqErrThresh:  Two two-octet fields, fields; see Appendix A
      of [RFC9097].

   ignoreOooDup:  A one-octet field.  Ignore out of oder out-of-order duplicates,
      Boolean.  When True True, only Loss counts toward received packet
      sequence number errors.  When False, Loss, Reordering Reordering, and
      Duplication are all counted as sequence number errors, errors; default
      True (see also Table 3 of [TR-471]).

   modifierBitmap:  A one-octet field.  This document only assigns two
      bits in this bitmap, bitmap; see Section 11.3.7:

   CHTA_SRIDX_ISSTART

      CHTA_SRIDX_ISSTART:  Treat srIndexConf as the starting sending
         rate to be used by the load rate adjustment algorithm

   CHTA_RAND_PAYLOAD algorithm.

      CHTA_RAND_PAYLOAD:  Randomize the Payload Content payload content beyond the Load
         PDU
      header header.

   Other bit positions are left unassigned by per this document.

   rateAdjAlgo:  A one-octet field.  The applied Load Rate Adjustment
   Algorithm, load rate adjustment
      algorithm; see Section 11.3.8.

   srStruct: Sending Rate structure (srStruct), used structure.  Used by the server in a Test
   Activation Response for an upstream test, test to communicate the (initial)
   Load PDU transmission parameters the client SHALL use.  For a Test
   Activation Request or a downstream test, this structure SHALL be
   zeroed.  Two sets of periodic transmission parameters are available,
   allowing for dual independent transmitters (to support a high degree
   of rate granularity).  The fields are defined as follows:

   txInterval1 and txInterval2:  Two four-octet fields indicating the
      load rate transmit interval in [us].  A 100 us granularity is
      recommended for optimal rate selection.

   udpPayload1 and udpPayload2:  Two four-octet fields indicating the
      UDP payload at load rate in [byte].

   burstSize1 and burstSize2:  Two four-octet fields indicating the
      burst size at load rate by a dimensionless number (of datagrams).

   udpAddon2:  A four-octet field indicating the size of a single Load
      PDU to be sent at the end of the txInterval2 send sequence, even
      when udpPayload2 or burstSize2 are zero and result in no
      transmission of their own.

   subIntPeriod:  A two-octet field.  Test Sub-interval period in [ms], [ms]
      (see also Table 3 of [TR-471]).  Trials with subIntPeriod in a
      range of 100 to 10000 [ms] resulted in a default value of 1000 ms.

   authMode:  Same as in Section 5.1 5.1.

   authUnixTime:  Same as in Section 5.1 5.1.

   authDigest:  Same as in Section 5.1 5.1.

   keyId:  Same as in Section 5.1 5.1.

   reservedAuth1:  Same as in Section 5.1 5.1.

   checkSum:  Same as in Section 5.1 5.1.

   The Test Activation Request/Response message PDU (as well as the
   included Sending Rate structure) SHALL be organized as follows:

   <CODE BEGINS>
   //
   // Sending rate structure for a single row of transmission parameters
   //
   struct sendingRate {
           uint32_t txInterval1; // Transmit interval (us)
           uint32_t udpPayload1; // UDP payload (bytes)
           uint32_t burstSize1;  // UDP burst size per interval
           uint32_t txInterval2; // Transmit interval (us)
           uint32_t udpPayload2; // UDP payload (bytes)
           uint32_t burstSize2;  // UDP burst size per interval
           uint32_t udpAddon2;   // UDP add-on (bytes)
   };
   //
   // Control header for UDP payload of Test Act. Request/Response PDUs
   //
   struct controlHdrTA {
   #define CHTA_ID 0xACE2
           uint16_t pduId;       // PDU ID
           uint16_t protocolVer; // Protocol version
   #define CHTA_CREQ_NONE      0
   #define CHTA_CREQ_TESTACTUS 1 // Test activation upstream
   #define CHTA_CREQ_TESTACTDS 2 // Test activation downstream
           uint8_t cmdRequest;   // Command request
   #define CHTA_CRSP_NONE     0  // (used with request)
   #define CHTA_CRSP_ACKOK    1  // Acknowledgment
   #define CHTA_CRSP_BADPARAM 2  // Bad/invalid test params
           uint8_t cmdResponse;  // Command response
           uint16_t lowThresh;   // Low delay variation threshold (ms)
           uint16_t upperThresh; // Upper delay variation threshold (ms)
           uint16_t trialInt;    // Status Feedback/trial interval (ms)
           uint16_t testIntTime; // Test interval time (sec)
           uint8_t reserved1;    // (reserved for alignment)
           uint8_t dscpEcn;      // DiffServ Diffserv and ECN field for testing
   #define CHTA_SRIDX_DEF UINT16_MAX // Request default server search
           uint16_t srIndexConf; // Configured Sending Rate Table index
           uint8_t useOwDelVar;  // Use one-way delay, not RTT (BOOL)
           uint8_t highSpeedDelta; // High-speed row adjustment delta
           uint16_t slowAdjThresh; // Slow rate adjustment threshold
           uint16_t seqErrThresh;  // Sequence error threshold
           uint8_t ignoreOooDup;   // Ignore Out-of-Order/Dup (BOOL)
   #define CHTA_SRIDX_ISSTART 0x01 // Use srIndexConf as starting index
   #define CHTA_RAND_PAYLOAD  0x02 // Randomize payload
           uint8_t modifierBitmap; // Modifier bitmap
   #define CHTA_RA_ALGO_B 0     // Algorithm B
   #define CHTA_RA_ALGO_C 1     // Algorithm C
           uint8_t rateAdjAlgo; // Rate adjust. algorithm
           uint8_t reserved2;   // (reserved for alignment)
           struct sendingRate srStruct; // Sending rate structure
           uint16_t subIntPeriod; // Sub-interval period (ms)
           uint16_t reserved3;    // (reserved for alignment)
           uint16_t reserved4;    // (reserved for alignment)
           uint8_t reserved5;     // (reserved for alignment)
           // ========== Integrity Verification ==========
           uint8_t authMode;      // Authentication mode
           uint32_t authUnixTime; // Authentication timestamp
           uint8_t authDigest[AUTH_DIGEST_LENGTH];
           uint8_t keyId;         // Key ID in shared table
           uint8_t reservedAuth1; // (reserved for alignment)
           uint16_t checkSum;     // Header checksum
   };
   <CODE ENDS>

                       Figure 7: Test Activation PDU

6.2.  Server Processes Test Activation Request and Generates Response

   After the server receives the Test Activation Request on the new
   connection, it chooses to accept, ignore ignore, or modify any of the test
   parameters.  When the server replies to the Test Activation Request
   message, the Test Activation Response PDU is structured identically
   to the Request PDU and SHALL retain the original values received in
   it unless they are explicitly coerced to a server acceptable server-acceptable value.

   When the server receives the Test Activation Request message, it
   SHALL first follow the Message Verification Procedure listed in
   Section 5.2, Paragraph 2.

6.2.1.  Server Rejects or Modifies Request

   When evaluating the Test Activation Request, the server MAY allow the
   client to specify its own fixed or starting send rate via
   srIndexConf.

   Alternatively, the server MAY enforce a maximum limit of the fixed or
   starting send rate rate, which the client can successfully request.  If
   the client's Test Activation Request exceeds the server's configured
   maximum, the server MUST either reject the request or coerce the
   value to the configured maximum bit rate, and communicate that
   maximum to the client in the Test Activation Response.  The client
   can of course choose to end the test, as appropriate.

   Other parameters where the server has the OPTION to coerce the client
   to use values other than those in the Test Activation Request are
   (grouped by role):

   *  Load rate adjustment algorithm: lowThresh, upperThresh,
      useOwDelayVar, highSpeedDelta, slowAdjThresh, seqErrThresh,
      highSpeedDelta, ignoreOooDup, rateAdjAlgo. rateAdjAlgo

   *  Test duration/intervals: trialInt, testIntTime, subIntPeriod

   *  Packet marking: dscpEcn

   Coercion is a step towards performing a test with the server-
   configured values; even though the client might prefer certain
   values, the server gives the client an opportunity to run a test with
   different values than the preferred set.  In these cases, the Command
   Response value SHALL be CHTA_CRSP_ACKOK.

   Note that the server also has the option of completely rejecting the
   request and sending back an appropriate cmdResponse field value
   (currently only CHTA_CRSP_BADPARAM, CHTA_CRSP_BADPARAM; see Section 11.3.9).

   Whether this error response is sent or not depends on the Security security
   mode of operation and the outcome of authDigest validation.

   If the Test Activation Request must be rejected (due to the Command
   Response value being CHTA_CRSP_BADPARAM), and

   *  If the authDigest is valid, a Test Activation Response SHALL be
      sent back to the client with a corresponding command response Command Response
      value indicating the reason for the rejection.

   *  If the authDigest is invalid, then the Test Activation Request SHOULD
      fail silently.  The exception is for operations support: server
      administrators are permitted to send a an Activation Response to
      support operations and troubleshooting.

   The additional circumstances when a server SHALL NOT communicate the
   appropriate Command Response code for an error condition (fail
   silently) are when:

   1.

   *  the Test Activation Request PDU size is not equal to the 'struct
      controlHdrTA' size shown in Figure 7,

   2.

   *  the PDU ID is not 0xACE2 (Test Activation PDU), or

   3.

   *  a directed attack has been detected,

   in which case detected.

   In this case, the server will allow Test Activation Requests to
   terminate silently.  Attack detection is beyond the scope of this
   specification.

6.2.2.  Server Accepts Request and Generates Response

   When the server sends the Test Activation Response, it SHALL set the
   cmdResponse field to CHTA_CRSP_ACKOK (see Section 11.3.9) 11.3.9).

   If the client has requested an upstream test, the server SHALL:

   *  include the transmission parameters from the first row of the
      Sending Rate Table in the Sending Rate structure (if requested by
      srIndexConf having been set to CHTA_SRIDX_DEF), or

   *  include the transmission parameters from the designated Configured
      Sending Rate Table index (srIndexConf) of the Sending Rate
      Table where, if CHTA_SRIDX_ISSTART is set in modifierBitmap, this
      will be used as the starting rate for the load rate adjustment
      algorithm, else
      algorithm; else, it will be considered a fixed-rate test.

   When generating the Test Activation Response (acceptance) for a
   downstream test, the server SHALL set all octets of the Sending Rate
   structure to zero.

   If activation continues, the server prepares the new connection for
   an upstream OR downstream test.

   In the case of an upstream test, the server SHALL prepare to use a
   single timer to send Status PDUs at the specified interval.  For a
   downstream test, the server SHALL prepare to utilize dual timers to
   send Load PDUs based on on:

   *  the transmission parameters directly from the first row of the
      Sending Rate Table (if requested by srIndexConf having been set to
      CHTA_SRIDX_DEF), or

   *  the transmission parameters from the designated Configured Sending
      Rate Table index (srIndexConf) of the Sending Rate Table where, if
      CHTA_SRIDX_ISSTART is set in modifierBitmap, this will be used as
      the starting rate for the load rate adjustment algorithm, else algorithm; else, it
      will be considered a fixed-rate test.

   The server SHALL then send the Test Activation Response back to the
   client, update the watchdog timer with a new timeout value, and set a
   test duration timer to eventually stop the test.

6.3.  Client Processes Test Activation Response

   When the client receives the Test Activation Response message, it
   SHALL first follow the Message Verification Procedure listed in
   Section 5.2, Paragraph 2.

   After the client receives the (vetted) Test Activation Response, it
   first checks the command response Command Response value.

   If the client receives a Test Activation cmdResponse field value that
   indicates an error, the client SHALL display/report a relevant
   message to the user or management process and exit.

   If the client receives a Test Activation cmdResponse field value that
   is not equal to one of the codes defined in Section 11.3.9, the
   client MUST terminate the connection and terminate operation of the
   current setup procedure.

   If the client receives a Test Activation Command Response value that
   indicates success (CHTA_CRSP_ACKOK, (e.g., CHTA_CRSP_ACKOK; see Section 11.3.9), the
   client SHALL update its configuration to use any test parameters
   modified by the server.  If the setup parameters coerced by the
   server are not acceptable to the client, the client ends the test.

   To finalize an accepted test activation, the client SHALL prepare its
   connection for either an upstream test with dual timers set to send
   Load PDUs (based on the starting transmission parameters sent by the
   server),
   server) OR a downstream test with a single timer to send Status PDUs
   at the specified interval.

   Then, the client SHALL stop the test initiation timer and start a
   watchdog timer to detect if the server goes quiet.

   The connection is now ready for testing.

7.  Test Load Stream Transmission and Measurement Status Feedback
    Messages

   This section describes the data Data phase of the protocol.  The roles of
   sender and receiver vary depending on whether the direction of
   testing is from server to client, or the reverse.

7.1.  Load PDU and Roles

   Testing proceeds with one endpoint sending Load PDUs, based on
   transmission parameters from the Sending Rate Table, and the other
   endpoint sending Status Feedback messages to communicate the traffic
   conditions at the receiver.  When the server is sending Status
   Feedback messages, they will also contain the latest transmission
   parameters from the Sending Rate Table that the client SHALL use.

   When a Load PDU is received, the receiver SHALL first: do the following:

   1.  Verify that the size of the message is greater than or equal to
       the 'struct loadHdr' size shown in Figure 9.

   2.  If the optional checkSum field is being utilized, validate  Validate the checksum for the Load PDU header portion of the
       total message (as described in Section 4.6). 4.6) if the optional
       checkSum field is being utilized.

   3.  Confirm that the PDU ID is 0xBEEF (Load PDU).

   Note: If any of the above checks fail, the message SHALL be
   considered invalid.

   The watchdog timer at the receiver SHALL be reset each time a valid
   Load PDU is received (which includes verification of the checkSum, if
   in use).  See non-graceful test stop in Section 8 for handling the
   watchdog timeout expiration at each endpoint.  Note that the watchdog
   timer's purpose is to detect a connection failure or a massive
   congestion condition only.

   When the server is sending Load PDUs in the role of sender, it SHALL
   use the transmission parameters directly from the Sending Rate
   Table via the index that is currently selected (which was indirectly
   based on the feedback in its received Status Feedback messages).

   However, when the client is sending Load PDUs in the role of sender,
   it SHALL use the discreet transmission parameters that were
   communicated by the server in its periodic Status Feedback messages
   (and not referencing a Sending Rate Table directly).  This approach
   allows the server to control the individual sending rates as well as
   the algorithm used to decide when and how to adjust the rate.

   The server uses a load rate adjustment algorithm which that evaluates
   measurements taken locally at the Load PDU receiver.  When the client
   is the receiver, the information is communicated to the server via
   the
   periodic Status Feedback messages.  When the server is the receiver,
   the information is used directly (although it is also communicated to
   the client via its periodic Status Feedback messages).  This approach
   is unique to this protocol; it provides the ability to search for the
   Maximum IP Capacity and specify specific sender behaviors that are
   absent from other testing tools.  Although the algorithm depends on
   the protocol, it is not part of the protocol per se.

   The default algorithm (B, (B; see [Y.1540]) has three paths to its
   decision on the next sending rate:

   1.  When there are no impairments present (no sequence errors and low
       delay variation), resulting in a sending rate increase.

   2.  When there are low impairments present (no sequence errors but
       higher levels of delay variation), the same sending rate is
       maintained.

   3.  When the impairment levels are above the thresholds set for this
       purpose and "congestion" is inferred, resulting in a sending rate
       decrease.

   Algorithm B also has two modes for increasing/decreasing the sending
   rate:

   *  A high-speed mode (fast) to achieve high sending rates quickly, quickly but
      that also back-off backs off quickly when "congestion" is inferred from the
      measurements.  Consecutive feedback intervals that have a supra-
      threshold count of sequence number anomalies and/or contain an
      upper delay variation threshold exception in all of the
      consecutive intervals are sufficient to declare "congestion"
      within a test.  The threshold of consecutive feedback intervals
      SHALL be configurable with a default of 3 intervals.

   *  A single-step (slow) mode where all rate adjustments use the
      minimum increase or decrease of one step in the sending rate
      table.  The single step single-step mode continues after the first inference
      of "congestion" from measured impairments.

   An OPTIONAL load rate adjustment algorithm (designated C) has been
   defined in [TR-471].  Algorithm C operation and modes are similar to
   B, but C uses multiplicative increases in the fast mode to reach the
   Gigabit
   gigabit range quickly and adds the possibility to re-try the fast
   mode during a test (which improves the measurement accuracy in
   dynamic or error-prone access, such as radio access).

   On the other hand, the test configuration MAY use a fixed sending
   rate requested by the client, using the field srIndexConf.

   The client MAY communicate the desired fixed-rate fixed rate in its test
   activation request. Test
   Activation Request.

   The UDP PDU format layout SHALL be as follows (big-endian AB):

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |            pduId              |   testAction  |   rxStopped   |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                           lpduSeqNo                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |           udpPayload          |           spduSeqErr          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          spduTime_sec                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         spduTime_nsec                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-|-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          lpduTime_sec                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         lpduTime_nsec                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |         rttRespDelay          |           checkSum            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   .                       Payload Content...                      .
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                         Figure 8: Load PDU Layout

   Specific details regarding Load PDU fields are as follows:

   pduId:  IANA is asked to assign has assigned the value hex value 0xBEEF (Section 11.3.1).

   testAction:  A one-octet fileld field designating the current test action as
      either TEST_ACT_TEST (testing in progress), TEST_ACT_STOP1 (first
      phase of graceful termination, used locally by server), or
      TEST_ACT_STOP2 (second phase of graceful termination, sent by
      server and reciprocated by client).  See Section 8 for additional
      information on test termination.

   rxStopped:  A one-octet fileld. field.  Boolean, 0 or 1, used to indicate to
      the remote endpoint that local receive traffic (either Load or
      Status PDUs) has stopped.  All outgoing Load or Status PDUs SHALL
      continue to assert this indication until traffic is received
      again, or the test is terminated.  The time threshold to trigger
      this condition is expected to be a reasonable fraction of the
      watchdog timeout (a default of one second is recommended).

   lpduSeqNo:  A four-octet field indicating the Load PDU sequence
      number (starting at 1).  Used to determine loss, out-of-order, and
      duplicates.

   udpPayload:  A two-octet field indicating the total payload size of
      the UDP datagram including the Load PDU message header and Payload
   Content payload
      content (i.e., what the UDP socket read function would return).
      This field allows the Load PDU receiver to maintain accurate
      receive statistics if utilizing receive truncation (only
      requesting the Load PDU message header octets from the protocol
      stack).

   spduSeqErr:  A two-octet field indicating the Status PDU loss count,
      as seen by the Load PDU sender.  This is determined by the Status
      PDU sequence number (spduSeqNo) in the most recently received
      Status PDU.  Used to communicate to the Load PDU receiver that
      return traffic (in the unloaded direction) is being lost.

   spduTime_sec/spduTime_nsec:  Two four-octet fields containing a copy
      of the most recent spduTime_sec/spduTime_nsec from the last Status
      PDU received.  Used for RTT measurements made by the Load PDU
      receiver.

   lpduTime_sec/lpduTime_nsec:  Two four-octet fields containing the
      local send time of the Load PDU.  Used for one-way delay variation
      measurements made by the Load PDU receiver.

   rttRespDelay:  A two-octet field indicating the RTT response delay,
      used to "adjust" raw RTT.  On the Load PDU sender, it is the
      number of milliseconds from reception of the most recent Status
      PDU (when the latest spduTime_sec/spduTime_nsec was obtained) to
      the transmission of the Load PDU (where the previously obtained
      spduTime_sec/spduTime_nsec is returned).  When the Load PDU
      receiver is calculating RTT, by subtracting the copied Status PDU
      send time (in the Load PDU) from the local Load PDU receive time,
      this value is subtracted from the raw RTT to correct for any
      response delay due to Load PDU scheduling.

   checkSum:  An optional checksum of only the Load PDU header (see
      Section 4.6 for guidance).  The checksum does not cover the Payload
   Content.
      payload content.  The calculation is done as the very last step of
      building the PDU header, with the checksum checkSum field set to zero.

   Payload Content:  All zeroes, all ones, or a pseudorandom binary
      sequence.

   The Load PDU SHALL be organized as follows (followed by any payload
   content):

   <CODE BEGINS>
   //
   // Load header for UDP payload of Load PDUs
   //
   struct loadHdr {
   #define LOAD_ID 0xBEEF
           uint16_t pduId;  // PDU ID
   #define TEST_ACT_TEST  0 // Test active
   #define TEST_ACT_STOP1 1 // Stop indication used locally by server
   #define TEST_ACT_STOP2 2 // Stop indication exchanged with client
           uint8_t testAction;  // Test action
           uint8_t rxStopped;   // Receive traffic stopped (BOOL)
           uint32_t lpduSeqNo;  // Load PDU sequence number
           uint16_t udpPayload; // UDP payload (bytes)
           uint16_t spduSeqErr; // Status PDU sequence error count
           uint32_t spduTime_sec;  // Send time in last rx'd status PDU
           uint32_t spduTime_nsec; // Send time in last rx'd status PDU
           uint32_t lpduTime_sec;  // Send time of this load PDU
           uint32_t lpduTime_nsec; // Send time of this load PDU
           uint16_t rttRespDelay;  // Response delay for RTT (ms)
           uint16_t checkSum;      // Header checksum
   };
   <CODE ENDS>

                             Figure 9: Load PDU

7.2.  Status PDU

   The Load PDU receiver SHALL send a Status PDU to the sender during a
   test at the configured feedback interval, after at least one Load PDU
   has been received (when there is something to provide status on).  In
   test scenarios with long delays between client and server, it is
   possible for the Status PDU send timer to fire before the first Load
   PDU arrives.  In these cases, the Status PDU SHALL NOT be sent.

   When the Load PDU sender receives a Status PDU message, it SHALL
   first follow the Message Verification Procedure listed in
   Section 5.2, Paragraph 2.

   The watchdog timer at the Load PDU sender SHALL be reset each time a
   valid Status PDU is received (which includes verification of the
   checkSum and/or authDigest, if in use).  See non-graceful test stop
   in Section 8 for handling the watchdog timeout expiration at each
   endpoint.

   The UDP PDU format layout SHALL be as follows (big-endian AB):

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          rxDatagrams                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                            rxBytes                            |
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                           deltaTime                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                           seqErrLoss                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                           seqErrOoo                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                           seqErrDup                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          delayVarMin                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          delayVarMax                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          delayVarSum                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          delayVarCnt                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         rttVarMinimum                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         rttVarMaximum                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                           accumTime                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |             pduId             |   testAction  |   rxStopped   |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                           spduSeqNo                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   .                      srStruct (28 octets)                     .
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          subIntSeqNo                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   .                      sisSav (56 octets)                       .
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                           seqErrLoss                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                           seqErrOoo                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                           seqErrDup                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         clockDeltaMin                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          delayVarMin                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          delayVarMax                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          delayVarSum                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          delayVarCnt                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          rttMinimum                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         rttVarSample                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  delayMinUpd  |   reserved1   |          reserved2            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          tiDeltaTime                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         tiRxDatagrams                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                           tiRxBytes                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         spduTime_sec                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         spduTime_nsec                         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |          reserved3            |   reserved4   |   authMode    |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         authUnixTime                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   .                     authDigest (32-octet) (32 octets)                    .
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     keyId     | reservedAuth1 |           checkSum            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                        Figure 10: Status PDU Layout

   Note that the Sending Rate structure is defined in Section 6.

   The primary role of the Status Feedback message is to communicate to
   the Load PDU sender the
   traffic conditions at the Load PDU receiver. receiver to the Load PDU sender.
   While the Sub-Interval Statistics structure (sisSav) covers the most
   recently saved (completed) sub-interval, similar fields directly in
   the Status PDU itself cover the most recent trial interval (the time
   period between Status Feedback messages, completed by this Status
   PDU).  Both sets of statistics SHALL always be populated by the Load
   PDU receiver, regardless of role (client or server).

   Details on the Status PDU measurement fields are provided in
   [RFC9097].  Authentication  The authentication and checksum checkSum fields follow the same
   methodology as with the Setup Request and Response.  Additional
   information regarding fields not defined previously are as follows:

   pduId:  IANA is asked to assign has assigned the value hex value 0xFEED (Section 11.3.1).

   spduSeqNo:  A four-octet field containing the Status PDU sequence
      number (starting at 1).  Used by the Load PDU sender to detect
      Status PDU loss (in the unloaded direction).  The loss count is
      communicated back to the Load PDU receiver via spduSeqErr in
      subsequent Load PDUs.

   subIntSeqNo:  A four-octet field containing the Sub-interval sequence
      number (starting at 1) that corresponds to the statistics provided
      in sisSav, for the last saved (completed) sub-interval.

   sisSav:  Sub-interval statistics saved (completed) for the most
      recent sub-interval (as designated by the subIntSeqNo).  These
      consist of the following fields:

      rxDatagrams:  A four-octet field Sub-interval indicating the
         number of received datagrams during the Sub-Interval.

      rxBytes:  An eight-octet field indicating the Sub-Interval byte
         count (eight octets chosen to prevent overflow at high speeds).

      deltaTime:  A four-octet field indicating the exact duration of
         the Sub-Interval in microseconds.  Used to calculate the
         received traffic rate together with rxBytes.

      seqErrLoss/seqErrOoo/seqErrDup:  Three four-octet fields, fields populated
         by the Loss, out-of-order, and duplicate totals.  Available for
         both the sub-interval and trial interval, interval; it is a breakout of
         the SeqErrors count in Table 3 of [TR-471]. seqErrOoo and
         seqErrDup are realized by comparing sequence numbers.  A
         lookback list of the last n sequence numbers received is used
         as the basis.  Each Load PDU sequence number is checked against
         this lookback.  The number n may depend on the implementation
         and on typical characteristics of environments, where
   UDPST UDPSTP is
         deployed (like mobile networks or Wi-Fi).  Currently, a default
         sequence number interval of n=32 has been chosen.  Specifically
         for seqErrOoo, each successively received higher seqno sets the next-expected-seqno
         next-expected seqno to seqno+1 seqno+1, and anything below that is
         considered out-of-order out of order (i.e., delayed).  For example, given
         the sequence 93, 94, 95, 100, 96, 97, 101, 98, 99, 102, 103,
         ... reception of 96, 97, 98, and 99 would not increment the next-
   expected-seqno
         next-expected seqno and would all be considered out-of-order. out of order.

      delayVarMin/delayVarMax/delayVarSum/delayVarCnt:  Four four-octet
         fields populated by the one-way delay variation measurements of
         all received Load PDUs (where avg = sum/cnt).  For each Load
         PDU received, the send time (lpduTime_sec/lpduTime_nsec) is
         subtracted from the local receive time, which is then
         normalized by subtracting the current clockDeltaMin.  Available
         for both the sub-interval and trial interval.

      rttVarMinimum/rttVarMaximum (in sisSav):  Two four-octet fields
         populated by the minimum and maximum RTT delay variation
         (rttVarSample) in the sub-interval designated by the
         subIntSeqNo.

      accumTime:  The accumulated time of the test in milliseconds,
         based on the duration of each sub-interval.  Equivalent to the
         sum of each deltaTime (although in ms) sent in each Status PDU
         during the test.

      clockDeltaMin:  A four-octet field indicating the minimum clock
         delta (difference) since the beginning of the test.  Obtained
         by subtracting the send time of each Load PDU (lpduTime_sec/
         lpduTime_nsec) from the local time that it was received.  This
         value is initialized with the first Load PDU received and is
         updated with each subsequent one to maintain a current (and
         continuously updated) minimum.  If the endpoint clocks are
         sufficiently synchronized, this will be the minimum one-way
         delay in milliseconds.  Otherwise, this value may be negative, negative
         but still valid for one-way delay variation measurements for
         the default test duration (default is 10 [s]).  If the test
         duration is extended to a range of minutes, where significant
         clock drift can occur, synchronized (or at least well-
         disciplined) clocks may be required.

      rttMinimum (in Status PDU):  A four-octet field indicating the
         minimum "adjusted" RTT measured since the beginning of the
         test.  See rttRespDelay (Section 7.1) regarding "adjusted"
         measurements.  RTT is obtained by subtracting the copied
         spduTime_sec/spduTime_nsec in the received Load PDU from the
         local time at which it was received.  This minimum SHALL be
         kept current (and continuously updated) via each Load PDU
         received with an updated spduTime_sec/spduTime_nsec.  This
         value MUST be positive.  Before an initial value can be
         established, and because zero is itself valid, it SHALL be set
         to STATUS_NODEL when communicated in the Status PDU.

      rttVarSample:  A four-octet field indicating the most recent
         "adjusted" RTT delay variation measurement.  See rttRespDelay
         (Section 7.1) regarding "adjusted" measurements.  RTT delay
         variation is obtained by subtracting the current (and
         continuously updated) "adjusted" RTT minimum, communicated as
         rttMinimum (in Status PDU), from each "adjusted" RTT
         measurement (which is itself obtained by subtracting the copied
         spduTime_sec/spduTime_nsec in the received Load PDU from the
         local time at which it was received).  Note that while one-way
         delay variation is measured for every Load PDU received, RTT
         delay variation is only sampled via the Status PDU sent and the
         very next Load PDU received with the corresponding updated spduTime_sec/
   spduTime_nsec.
         spduTime_sec/spduTime_nsec.  When a new value is unavailable
         (possibly due to packet loss), and because zero is itself
         valid, it SHALL be set to STATUS_NODEL when communicated in the
         Status PDU.

      delayMinUpd:  A one-octet field.  Boolean, 0 or 1, indicating that
         the clockDeltaMin and/or rttMinimum (in Status PDU), as
         measured by the Load PDU receiver, has been updated.

      tiDeltaTime/tiRxDatagrams/tiRxBytes:  Three four-octet fields, fields
         populated by the trial interval time in microseconds, along
         with the received datagram and byte counts.  Used to calculate
         the received traffic rate for the trial interval.

      spduTime_sec/spduTime_nsec:  Two four-octet fields, fields containing the
         local transmit time of the Status PDU.  Expected to be copied
         into spduTime_sec/spduTime_nsec in subsequent Load PDUs after
         being received by the Load PDU sender.  Used for RTT
         measurements.

      authMode:  Same as in Section 5.1 5.1.

      authUnixTime:  Same as in Section 5.1 5.1.

      authDigest:  Same as in Section 5.1 5.1.

      keyId:  Same as in Section 5.1 5.1.

      reservedAuth1:  Same as in Section 5.1 5.1.

      checkSum:  Same as in Section 5.1 5.1.

   The Status Feedback message PDU (as well as the included Sub-Interval
   Statistics structure) SHALL be organized as follows:

   <CODE BEGINS>
   //
   // Sub-interval statistics structure for received traffic information
   //
   struct subIntStats {
           uint32_t rxDatagrams; // Received datagrams
           uint64_t rxBytes;     // Received bytes (64 bits)
           uint32_t deltaTime;   // Time delta (us)
           uint32_t seqErrLoss;  // Loss sum
           uint32_t seqErrOoo;   // Out-of-Order sum
           uint32_t seqErrDup;   // Duplicate sum
           uint32_t delayVarMin; // Delay variation minimum (ms)
           uint32_t delayVarMax; // Delay variation maximum (ms)
           uint32_t delayVarSum; // Delay variation sum (ms)
           uint32_t delayVarCnt; // Delay variation count
           uint32_t rttMinimum;  // Minimum round-trip time (ms)
           uint32_t rttMaximum;  // Maximum round-trip time (ms)
           uint32_t accumTime;   // Accumulated time (ms)
   };
   //
   // Status feedback header for UDP payload of status PDUs
   //
   struct statusHdr {
   #define STATUS_ID 0xFEED
           uint16_t pduId;     // PDU ID
           uint8_t testAction; // Test action
           uint8_t rxStopped;  // Receive traffic stopped (BOOL)
           uint32_t spduSeqNo; // Status PDU sequence number
           struct sendingRate srStruct; // Sending rate structure
           uint32_t subIntSeqNo;        // Sub-interval sequence number
           struct subIntStats sisSav;   // Sub-interval saved stats
           uint32_t seqErrLoss;    // Loss sum
           uint32_t seqErrOoo;     // Out-of-Order sum
           uint32_t seqErrDup;     // Duplicate sum
           uint32_t clockDeltaMin; // Clock delta minimum (ms)
           uint32_t delayVarMin;   // Delay variation minimum (ms)
           uint32_t delayVarMax;   // Delay variation maximum (ms)
           uint32_t delayVarSum;   // Delay variation sum (ms)
           uint32_t delayVarCnt;   // Delay variation count
   #define STATUS_NODEL UINT32_MAX // No delay data/value
           uint32_t rttMinimum;    // Min round-trip time sampled (ms)
           uint32_t rttVarSample;  // Last round-trip time sample (ms)
           uint8_t delayMinUpd;    // Delay minimum(s) updated (BOOL)
           uint8_t reserved1;      // (reserved for alignment)
           uint16_t reserved2;     // (reserved for alignment)
           uint32_t tiDeltaTime;   // Trial interval delta time (us)
           uint32_t tiRxDatagrams; // Trial interval receive datagrams
           uint32_t tiRxBytes;     // Trial interval receive bytes
           uint32_t spduTime_sec;  // Send time of this status PDU
           uint32_t spduTime_nsec; // Send time of this status PDU
           uint16_t reserved3;     // (reserved for alignment)
           uint8_t reserved4;      // (reserved for alignment)
           // ========== Integrity Verification ==========
           uint8_t authMode;      // Authentication mode
           uint32_t authUnixTime; // Authentication timestamp
           uint8_t authDigest[AUTH_DIGEST_LENGTH];
           uint8_t keyId;         // Key ID in shared table
           uint8_t reservedAuth1; // (reserved for alignment)
           uint16_t checkSum;     // Header checksum
   };
   <CODE ENDS>

                           Figure 11: Status PDU

8.  Stopping a Test

   When the test duration timer (testIntTime) on the server expires, it
   SHALL set the local connection test action to TEST_ACT_STOP1 (phase 1
   of graceful termination).  This is simply a non-reversible state
   awaiting the next message(s) to be sent from the server.  During this
   time, any received Load or Status PDUs are processed normally.

   Upon transmission of the next Load or Status PDUs, the server SHALL
   set the local connection test action to TEST_ACT_STOP2 (phase 2 of
   graceful termination) and mark any outgoing PDUs with a testAction
   value of TEST_ACT_STOP2.  While in this state, the server MAY reduce
   any Load PDU bursts to a size of one.

   When the client receives a Load or Status PDU with the TEST_ACT_STOP2
   indication, it SHALL finalize testing, display the test results, and
   also
   mark its local connection with a test action of TEST_ACT_STOP2 (so
   that any PDUs subsequently received can be ignored).

   With the test action of the client's connection set to
   TEST_ACT_STOP2, the very next expiry of a send timer, for either a
   Load or a Status PDU, SHALL result in it and any subsequent PDUs to be
   being sent with a testAction value of TEST_ACT_STOP2 (as confirmation
   to the server).  While in this state, the client MAY reduce any Load
   PDU bursts to a size of one.  The client SHALL then schedule an
   immediate end time for the connection.

   When the server receives the TEST_ACT_STOP2 confirmation in the Load
   or Status PDU, the server SHALL schedule an immediate end time for
   the connection which that closes the socket and deallocates the associated
   resources.  The TEST_ACT_STOP2 exchange constitutes a graceful
   termination of the test.

   In a non-graceful test stop due to path failure, the watchdog
   timeouts at each endpoint will expire (sometimes at one endpoint
   first),
   first); notifications in logs, STDOUT, and/or formatted output SHALL
   be made, made; and the endpoint SHALL schedule an immediate end time for
   the connection.

   If an attacker clears the TEST_ACT_STOP2 indication, then the
   configured test duration timer (testIntTime) at the server and client
   SHALL take precedence and the endpoint SHALL schedule an immediate
   end time for the connection.

9.  Operational considerations Considerations for the Measurement Method

   The architecture of the method requires two cooperating hosts
   operating in the roles of Src (test packet sender) and Dst
   (receiver), with a measured path and return path between them.

   The nominal duration of a measurement interval at the Destination,
   parameter testIntTime, MUST be constrained in a production network,
   since this is an active test method and it will likely cause
   congestion on the Src to Dst host path during a test.

   It is RECOMMENDED to locate test endpoints as close to the intended
   measured link(s) as practical.  The testing operator MUST set a value
   for the MaxHops Parameter, based on the expected path length.  This
   Parameter can keep measurement traffic from straying too far beyond
   the intended path.

   It is obviously counterproductive to run more than one independent
   and concurrent test (regardless of the number of flows in the test
   stream) when attempting to measure the maximum capacity on a single
   path.  The number of concurrent, independent tests of a path SHALL be
   limited to one.

   The load rate adjustment algorithm's scope is limited to helping
   determine the Maximum IP-Layer Capacity in the context of an
   infrequent, diagnostic, short-term measurement.  It is RECOMMENDED to
   discontinue non-measurement traffic that shares a subscriber's
   dedicated resources while testing: measurements may not be accurate,
   and throughput of competing elastic traffic may be greatly reduced.

   See section Section 8 of [RFC9097] for a discussion of the method Method of
   measurement
   Measurement beyond purely operational aspects.

9.1.  Notes on Interface Measurements

   Additional measurements may be useful in specific circumstances.  For
   example, interface byte counters measured by a client at a
   residential gateway are possible when the client application has
   access to an interface that sees all traffic to/from a service
   subscriber's location.  Adding a byte counter at the client for
   download or upload directions could be used to measure total traffic
   and possibly detect when non-test traffic is present (and using
   capacity).  The client may not have the CPU cycles available to count
   both the interface traffic and IP-layer IP-Layer Capacity simultaneously, so
   this form of diagnostic measurement may not be possible.

10.  Security Considerations

   Active metrics and measurements have a long history of security
   considerations.  The security considerations that apply to any active
   measurement of live paths are relevant here.  See [RFC4656] and
   [RFC5357].

   When considering privacy of those involved in measurement or those
   whose traffic is measured, the sensitive information available to
   potential observers is greatly reduced when using active techniques
   which
   that are within this scope of work.  Passive observations of user
   traffic for measurement purposes raise many privacy issues.  We refer
   the reader to  See the
   privacy considerations described in the LMAP Framework [RFC7594],
   which covers active and passive techniques.

   There

   Below are some new considerations for Capacity capacity measurement as
   described in this document.

   1.  Cooperating client and server hosts and agreements to test the
       path between the hosts are REQUIRED.  Hosts perform in either the
       server or the client roles.  One way to assure a cooperative
       agreement employs the optional Authorization mode is through the
       use of the authDigest field and the known identity associated
       with the shared key used to create the authDigest field via the
       KDF.  Other means are also possible, such as access control lists
       at the server.

   2.  It is REQUIRED to have a user client-initiated setup handshake
       between cooperating hosts that allows firewalls to control
       inbound unsolicited UDP traffic which either that goes to either a control
       port or to ephemeral ports that are only created as needed.
       Firewalls protecting each host can both continue to do their job jobs
       normally.

   3.  Client-server authentication and integrity protection for
       feedback messages conveying measurements is RECOMMENDED.  To
       accommodate different host limitations and testing circumstances,
       different modes of operation are available, as described in
       Section 4 above. 4.

   4.  Hosts MUST limit the number of simultaneous tests to avoid
       resource exhaustion and inaccurate results.

   5.  Senders MUST be rate-limited.  This can be accomplished using a
       pre-built table defining all the offered sending rates that will
       be supported.  The default and optional load rate adjustment
       algorithm results in "ramp up" from the lowest rate in the table.
       Optionally, the server could utilize the maxBandwidth field (and
       the CHSR_USDIR_BIT bit) in the Setup Request from the client to
       limit the maximum that it will attempt to achieve.

   6.  Service subscribers with limited data volumes who conduct
       extensive capacity testing might experience the effects of
       Service Provider controls on their service.  Testing with the
       Service Provider's measurement hosts SHOULD be limited in
       frequency and/or overall volume of test traffic (for example, the
       range of test interval duration values should be limited).

   One specific attack that has been recognized is an on-path attack on
   the testAction field where the attacker would set or clear the STOP
   indication.  Setting the indication in successive packets terminates
   the test prematurely, with no threat to the Internet but annoyance
   for the testers.  If an attacker clears the STOP indication, the
   mitigation relies on knowledge of the test duration at the client and
   server, where these hosts cease all traffic when the specified test
   duration is complete.

   Authentication methods and requirements steadily evolve.  Alternate
   authentication modes provide for algorithm agility by defining a new
   Mode,
   mode, whose support is indicated by an assigning a suitable "Test Setup
   PDU Authentication Mode Registry" Mode" registry value (see Section 11.3.4 ).

11.  IANA Considerations

   This document requests

   Per this document, IANA to assign has assigned a User/Registered UDP port for the Test Setup
   exchange in the Control phase of protocol operation, operation and to create has created a
   new registry group for the UDP Speed Test Protocol
   (UDPSTP). UDPSTP.

11.1.  New User Port Number Assignment

   IANA will allocate has registered the following service name to in the "Service Name
   and Transport Protocol Port Number Registry" registry:

   Service: Registry":

   Service Name:  udpstp
   Port Number:  24601
   Transport Protocol:  UDP

   Assignee:  IESG <iesg@ietf.org>

   Contact:  IETF Chair <chair@ietf.org>
   Description:  UDP-based IP-Layer Capacity and performance measurement
      protocol
   Assignee:  IESG <iesg@ietf.org>
   Contact:  IETF Chair <chair@ietf.org>
   Reference:  This RFC, RFCYYYY.

   Port Number:  <PORTNUM> of the IANA User Port range (1024-49151)  RFC 9946

   The protocol uses IP-Layer Unicast.  The assignment of a  A single port number is requested was
   assigned to help configure firewalls and other port-based systems for
   access control prior to negotiating dynamic ports between client and
   server.

11.2.  New KeyTable KDF

   IANA will allocate has added the following KDF entry to the existing list of
   KeyTable KDFs "KeyTable KDFs"
   registry (see https://www.iana.org/assignments/keytable/
   keytable.xhtml#kdf). <https://www.iana.org/assignments/keytable>):

        +==============+=============================+===========+
        | KDF          | Description                 | Reference
   =============================================================== |
        +==============+=============================+===========+
        | HMAC-SHA-256 | HMAC using the SHA-256 hash | [RFC6234] |
        +--------------+-----------------------------+-----------+

                     Table 1: KeyTable KDFs Registry

11.3.  New UDPSTP Registry Group

   IANA will create has created the following registries in the subsections that follow under
   a new registry group called "UDP Speed Test Protocol (UDPSTP)".

   IANA is requested to has added the following note under the "UDP Speed Test Protocol
   (UDPSTP)" registry group:

   |  Note: Values reserved for experimental use are not expected to be
   |  used on the Internet, but for experiments that are confined to
   |  closed environments.

11.3.1.  PDU Identifier Registry

   IANA will create has created the "PDU Identifier" registry under the "UDP Speed
   Test Protocol (UDPSTP)" registry group.  Every UDPSTP PDU contains a
   two octet
   two-octet pduId field identifying the role and format of the PDU that
   follows.  The code points in this registry are allocated according to
   the registration procedures [RFC8126] described in Table 1. 2.

              +===================+=========================+
              | Range(Hex)        | Registration Procedures
   =============================================================== |
              +===================+=========================+
              | 0xFFFF and 0x0000 | Reserved                |
              +-------------------+-------------------------+
              | 0x8000-0xFFFE     | IETF Review             |
              +-------------------+-------------------------+
              | 0x0001-0x7F00     | Specification Required  |
              +-------------------+-------------------------+
              | 0x7F01-0x7FE0     | Experimental Use        |
              +-------------------+-------------------------+
              | 0x7FE1-0x7FFF     | Private Use             |
              +-------------------+-------------------------+

                  Table 1: 2: Registration procedures Procedures for the
                          PDU Identifier registry

   Initially, Registry

   IANA will assign has assigned values in the "PDU Identifier" registry with the
   values in Table 2: as follows:

       +===============+===============================+===========+
       | Value         | Description                   | Reference
   =================================================== |
       +===============+===============================+===========+
       | 0x0000        | Reserved                      | RFC 9946  |
       +---------------+-------------------------------+-----------+
       | 0x7F01-0x7FE0 | Reserved for Experimental Use | RFC 9946  |
       +---------------+-------------------------------+-----------+
       | 0x7FE1-0x7FFF | Reserved for Private Use      | RFC 9946  |
       +---------------+-------------------------------+-----------+
       | 0xACE1        | Test Setup PDU        <this RFC>                | RFC 9946  |
       +---------------+-------------------------------+-----------+
       | 0xACE2        | Test Activation PDU   <this RFC>           | RFC 9946  |
       +---------------+-------------------------------+-----------+
       | 0xBEEF        | Load PDU              <this RFC>                      | RFC 9946  |
       +---------------+-------------------------------+-----------+
       | 0xDEAD        | Null PDU              <this RFC>                      | RFC 9946  |
       +---------------+-------------------------------+-----------+
       | 0xFEED        | Status Feedback PDU   <this RFC>           | RFC 9946  |
       +---------------+-------------------------------+-----------+
       | 0xFFFF        | Reserved                      | RFC 9946  |
       +---------------+-------------------------------+-----------+

           Table 2: 3: Initial Values of the PDU Identifier Values Registry

11.3.2.  Protocol Version Registry

   IANA will create has created the "Protocol Version" registry under the "UDP Speed
   Test Protocol (UDPSTP)" registry group.  UDPSTP Test Setup Request,
   Test Setup Response Response, and Test Activation Request PDUs contain a two two-
   octet protocolVer field, identifying the version of the protocol in
   use.  The code points in this registry are allocated according to the
   registration procedures [RFC8126] described in Table 3. 4.

               +================+=========================+
               | Range(Decimal) | Registration Procedures
   =============================================================== |
               +================+=========================+
               | 0-19           | Reserved                |
               +----------------+-------------------------+
               | 20-40960       | IETF Review             |
               +----------------+-------------------------+
               | 40961-53248    | Specification Required  |
               +----------------+-------------------------+
               | 53249-65534    | Experimental Use        |
               +----------------+-------------------------+
               | 65535          | Reserved                |
               +----------------+-------------------------+

                 Table 3: 4: Registration procedures Procedures for the
                        Protocol Version registry

   Initially, Registry

   IANA will assign the has assigned decimal value 20 listed in Table 4 in the "Protocol Version" registry: registry
   as follows:

                           +=======+===========+
                           | Value | Reference
   ================================================ |
                           +=======+===========+
                           | 20       <this RFC>    | RFC 9946  |
                           +-------+-----------+

                           Table 4: 5: Initial Value
                              of the Protocol
                              Version value Registry

11.3.3.  Test Setup PDU Modifier Bitmap Registry

   IANA will create has created the "Test Setup PDU Modifier Bitmap" registry under
   the "UDP Speed Test Protocol (UDPSTP)" registry group.  The Test
   Setup PDU layout contains a modifierBitmap field.  The bitmaps in
   this registry are allocated according to the registration procedures
   [RFC8126] described in Table 5. 6.

              +===================+=========================+
              | Range(Bitmap)     | Registration Procedures
   =============================================================== |
              +===================+=========================+
              | 00000000-01111111 | IETF Review             |
              +-------------------+-------------------------+
              | 10000000          | Reserved                |
              +-------------------+-------------------------+

                  Table 5: 6: Registration procedures Procedures for the
                  Test Setup PDU Modifier Bitmap Registry
   Initially,

   IANA will assign the has assigned bitmap values defined by Table 6 in the "Test Setup PDU Modifier
   Bitmap" registry. registry as follows:

           +=======+===============================+===========+
           | Value | Description                   | Reference
   =============================================================== |
           +=======+===============================+===========+
           | 0x00  | No modifications        <this RFC>              | RFC 9946  |
           +-------+-------------------------------+-----------+
           | 0x01  | Allow Jumbo datagram    <this RFC> sizes    | RFC 9946  |
           |       | above sending rates of 1 Gbps |           |
           +-------+-------------------------------+-----------+
           | 0x02  | Use Traditional MTU     <this RFC> (1500     | RFC 9946  |
           |       | bytes with IP-header)         |           |
           +-------+-------------------------------+-----------+

               Table 6: 7: Initial Values of the Test Setup PDU
                          Modifier Bitmap values Registry

11.3.4.  Test Setup PDU Authentication Mode Registry

   IANA will create has created the "Test Setup PDU Authentication Mode" registry
   under the "UDP Speed Test Protocol (UDPSTP)" registry group.  The
   Test Setup PDU layout contains an authMode field.  The code points in
   this registry are allocated according to the registration procedures
   [RFC8126] described in Table 7. 8.

               +================+=========================+
               | Range(Decimal) | Registration Procedures
   =============================================================== |
               +================+=========================+
               | 0-59           | IETF Review             |
               +----------------+-------------------------+
               | 60-63          | Experimental Use        |
               +----------------+-------------------------+
               | 64-255         | Reserved                |
               +----------------+-------------------------+

                 Table 7: 8: Registration procedures Procedures for the
                    Test Setup PDU Authentication Mode registry

   Initially,
                                 Registry

   IANA will assign the has assigned decimal values defined by Table 8 in the "Test Setup PDU
   Authentication Mode" registry. registry as follows:

   +=======+===============================================+===========+
   | Value | Description                                   | Reference
   =============================================================== |
   +=======+===============================================+===========+
   | 0     | Not used                       <this RFC>                                      | RFC 9946  |
   +-------+-----------------------------------------------+-----------+
   | 1     | Required authentication        <this RFC> for the Control       | RFC 9946  |
   |       | phase                                         |           |
   +-------+-----------------------------------------------+-----------+
   | 2     | Optional authentication for    <this RFC> the Data          | RFC 9946  |
   |       | phase, in addition to the Control phase       |           |
   +-------+-----------------------------------------------+-----------+

     Table 8: 9: Initial Values of the Test Setup PDU Authentication Mode values
                                  Registry

11.3.5.  Test Setup PDU Command Response Field Registry

   IANA will create has created the "Test Setup PDU Command Response Field" registry
   under the "UDP Speed Test Protocol (UDPSTP)" registry group.  The
   Test Setup PDU layout contains a cmdResponse field.  The code points
   in this registry are allocated according to the registration
   procedures [RFC8126] described in Table 9. 10.

               +================+=========================+
               | Range(Decimal) | Registration Procedures
   =============================================================== |
               +================+=========================+
               | 0-127          | IETF Review             |
               +----------------+-------------------------+
               | 128-239        | Specification Required  |
               +----------------+-------------------------+
               | 240-249        | Experimental Use        |
               +----------------+-------------------------+
               | 250-254        | Private Use             |
               +----------------+-------------------------+
               | 255            | Reserved                |
               +----------------+-------------------------+

                  Table 9: 10: Registration procedures Procedures for
                   the Test Setup PDU Command Response
                              Field Registry

   Initially,

   IANA will assign the has assigned decimal values defined by Table 10 in the "Test Setup PDU Command
   Response Field" registry. registry as follows:

   +=========+============================================+===========+
   | Value   | Description                                | Reference
   =============================================================== |
   +=========+============================================+===========+
   | 0       | None (used by                  <this RFC> client in Request)           | RFC 9946  |
   +---------+--------------------------------------------+-----------+
   | 1       | Acknowledgment                 <this RFC>                             | RFC 9946  |
   +---------+--------------------------------------------+-----------+
   | 2       | Bad Protocol Version           <this RFC> protocol version                       | RFC 9946  |
   +---------+--------------------------------------------+-----------+
   | 3       | Invalid Jumbo datagram         <this RFC> option              | RFC 9946  |
   +---------+--------------------------------------------+-----------+
   | 4       | Unexpected Authentication      <this RFC> authentication in Setup Request | RFC 9946  |
   +---------+--------------------------------------------+-----------+
   | 5       | Authentication missing         <this RFC> in Setup Request    | RFC 9946  |
   +---------+--------------------------------------------+-----------+
   | 6       | Invalid authentication         <this RFC> method              | RFC 9946  |
   +---------+--------------------------------------------+-----------+
   | 7       | Authentication failure         <this RFC>                     | RFC 9946  |
   +---------+--------------------------------------------+-----------+
   | 8       | Authentication time is         <this RFC> invalid in Setup    | RFC 9946  |
   |         | Request                                    |           |
   +---------+--------------------------------------------+-----------+
   | 9       | No Maximum maximum test Bit bit rate       <this RFC> specified         | RFC 9946  |
   +---------+--------------------------------------------+-----------+
   | 10      | Server Maximum Bit maximum bit rate        <this RFC> exceeded           | RFC 9946  |
   +---------+--------------------------------------------+-----------+
   | 11      | MTU option does not match      <this RFC> server           | RFC 9946  |
   +---------+--------------------------------------------+-----------+
   | 12      | Multi-connection parameters    <this RFC> rejected by    | RFC 9946  |
   |         | server                                     |           |
   +---------+--------------------------------------------+-----------+
   | 13      | Connection allocation          <this RFC> failure on server    | RFC 9946  |
   +---------+--------------------------------------------+-----------+
   | 240-249 | Reserved for Experimental Use              | RFC 9946  |
   +---------+--------------------------------------------+-----------+
   | 250-254 | Reserved for Private Use                   | RFC 9946  |
   +---------+--------------------------------------------+-----------+
   | 255     | Reserved                                   | RFC 9946  |
   +---------+--------------------------------------------+-----------+

     Table 10: 11: Initial Values of the Test Setup PDU Command Response
                              Field values Registry

   Note that value 4 is required for backward compatibility with
   previous experimental versions of software already in use.  Further
   note,  Further,
   value 6 signals that a client erroneously used an authMode
   which that
   hasn't been standardised standardized yet (i.e., authMode is greater than 1 or 2).

11.3.6.  Test Activation PDU Command Request Registry

   IANA will create has created the "Test Activation PDU Command Request" registry
   under the "UDP Speed Test Protocol (UDPSTP)" registry group.  The
   Test Setup PDU layout contains a cmdRequest field.  The code points
   in this registry are allocated according to the registration
   procedures [RFC8126] described in Table 11. 12.

               +================+=========================+
               | Range(Decimal) | Registration Procedures
   =============================================================== |
               +================+=========================+
               | 0-127          | IETF Review             |
               +----------------+-------------------------+
               | 128-239        | Specification Required  |
               +----------------+-------------------------+
               | 240-249        | Experimental Use        |
               +----------------+-------------------------+
               | 250-254        | Private Use             |
               +----------------+-------------------------+
               | 255            | Reserved                |
               +----------------+-------------------------+

                  Table 11: 12: Registration procedures Procedures for
                 the Test Activation PDU Command Request registry

   Initially,
                                 Registry

   IANA will assign the has assigned decimal values defined by Table 12 in the "Test Activation PDU Command
   Request" registry. registry as follows:

          +=========+==============================+===========+
          | Value   | Description                  | Reference
   =============================================================== |
          +=========+==============================+===========+
          | 0       | No Request                    <this RFC>                   | RFC 9946  |
          +---------+------------------------------+-----------+
          | 1       | Request test in Upstream      <this RFC> upstream     | RFC 9946  |
          |         | direction (client to server) |           |
          +---------+------------------------------+-----------+
          | 2       | Request test in Downstream    <this RFC> downstream   | RFC 9946  |
          |         | direction (server to client) |           |
          +---------+------------------------------+-----------+
          | 240-249 | Reserved for Experimental    | RFC 9946  |
          |         | Use                          |           |
          +---------+------------------------------+-----------+
          | 250-254 | Reserved for Private Use     | RFC 9946  |
          +---------+------------------------------+-----------+
          | 255     | Reserved                     | RFC 9946  |
          +---------+------------------------------+-----------+

             Table 12: 13: Initial Values of the Test Activation
                       PDU Command Request values Registry

11.3.7.  Test Activation PDU Modifier Bitmap Registry

   IANA will create has created the "Test Activation PDU Modifier Bitmap" registry
   under the "UDP Speed Test Protocol (UDPSTP)" registry group.  The
   Test Activation PDU layout (also) contains a modifierBitmap field.
   The bitmaps in this registry are allocated according to the
   registration procedures [RFC8126] described in Table 13. 14.

              +===================+=========================+
              | Range(Bitmap)     | Registration Procedures
   =============================================================== |
              +===================+=========================+
              | 00000000-01111111 | IETF Review             |
              +-------------------+-------------------------+
              | 10000000          | Reserved                |
              +-------------------+-------------------------+

                 Table 13: 14: Registration procedures Procedures for the
                    Test Activation PDU Modifier Bitmap registry

   Initially,
                                  Registry

   IANA will assign the has assigned bitmap values defined by Table 14 in the "Test Activation PDU Modifier
   Bitmap" registry. registry as follows:

   +=======+===============================================+===========+
   | Value | Description                                   | Reference
   =============================================================== |
   +=======+===============================================+===========+
   | 0x00  | No modifications          <this RFC>                              | RFC 9946  |
   +-------+-----------------------------------------------+-----------+
   | 0x01  | Set when srIndexConf is   <this RFC>                       | RFC 9946  |
   |       | start rate for search                         |           |
   +-------+-----------------------------------------------+-----------+
   | 0x02  | Set for randomized        <this RFC> UDP                        | RFC 9946  |
   |       | payload                                       |           |
   +-------+-----------------------------------------------+-----------+

        Table 14: 15: Initial Values of the Test Activation PDU Modifier
                              Bitmap values Registry

11.3.8.  Test Activation PDU Rate Adjustment Algo. Registry

   The Test Activation PDU layout contains a rateAdjAlgo field.  The
   table below defines the assigned Capitalized alphabetic UTF-8 values
   in the registry.

   IANA will create has created the "Test Activation PDU Rate Adjustment Algo."
   registry under the "UDP Speed Test Protocol (UDPSTP)" registry group.
   The Test Activation PDU layout contains a rateAdjAlgo field.  The
   code points in this registry are allocated according to the
   registration procedures [RFC8126] described in Table 15. 16.

       +=================================+=========================+
       | Range(Capital alphabet. alphabet / UTF-8) | Registration Procedures
   ========================================================== |
       +=================================+=========================+
       | A-Y                             | IETF review Review             |
       +---------------------------------+-------------------------+
       | Z                               | Reserved                |
       +---------------------------------+-------------------------+

         Table 15: 16: Registration procedures Procedures for the Test Activation
                    PDU Rate Adjustment Algo. registry

   Initially,  Registry

   IANA will assign the Capitalized has assigned capitalized alphabetic UTF-8 values, as well as the
   corresponding incremental numeric, defined by Table 16 numeric values, in the "Test Activation PDU
   Rate Adjustment Algo." registry. registry as follows:

         +================+=======================+==============+
         | Value(Numeric) | Description           | Reference
   ========================================================    |
         +================+=======================+==============+
         | A(n/a)         | Not used                <this RFC>              | RFC 9946     |
         +----------------+-----------------------+--------------+
         | B(0)           | Rate algorithm Type B | [Y.1540Amd2] |
         +----------------+-----------------------+--------------+
         | C(1)           | Rate algorithm Type C | [TR-471]     |
         +----------------+-----------------------+--------------+

            Table 16: 17: Initial Values of the Test Activation PDU
                      Rate Adjustment Algo. values  Registry

11.3.9.  Test Activation PDU Command Response Field Registry

   IANA will create has created the "Test Activation PDU Command Response Field"
   registry under the "UDP Speed Test Protocol (UDPSTP)" registry group.
   The Test Activation PDU layout (also) contains a cmdResponse field.
   The code points in this registry are allocated according to the
   registration procedures [RFC8126] described in Table 17. 18.

               +================+=========================+
               | Range(Decimal) | Registration Procedures
   =============================================================== |
               +================+=========================+
               | 0-127          | IETF Review             |
               +----------------+-------------------------+
               | 128-239        | Specification Required  |
               +----------------+-------------------------+
               | 240-249        | Experimental Use        |
               +----------------+-------------------------+
               | 250-254        | Private Use             |
               +----------------+-------------------------+
               | 255            | Reserved                |
               +----------------+-------------------------+

                  Table 17: 18: Registration procedures Procedures for
                 the Test Activation PDU Command Response
                              Field registry

   Initially, Registry

   IANA will assign the has assigned decimal values defined by Table 18 in the "Test Activation PDU Command
   Response Field" registry. registry as follows:

        +=========+==================================+===========+
        | Value   | Description                      | Reference
   =============================================================== |
        +=========+==================================+===========+
        | 0       | None (used by               <this RFC> client in Request) | RFC 9946  |
        +---------+----------------------------------+-----------+
        | 1       | Server Acknowledgment       <this RFC> acknowledgment            | RFC 9946  |
        +---------+----------------------------------+-----------+
        | 2       | Server indicates an error   <this RFC>        | RFC 9946  |
        +---------+----------------------------------+-----------+
        | 240-249 | Reserved for Experimental Use    | RFC 9946  |
        +---------+----------------------------------+-----------+
        | 250-254 | Reserved for Private Use         | RFC 9946  |
        +---------+----------------------------------+-----------+
        | 255     | Reserved                         | RFC 9946  |
        +---------+----------------------------------+-----------+

           Table 18: 19: Initial Values of the Test Activation PDU
                     Command Response Field values Registry

11.4.  Guidelines for the Designated Experts

   It is suggested that multiple designated experts be appointed for
   registry change requests.

   Criteria that should be applied by the designated experts include
   determining whether the proposed registration duplicates existing
   entries and whether the registration description is clear and fits
   the purpose of this registry.

   Registration requests are evaluated within a two-week review period
   on the advice of one or more designated experts.  Within the review
   period, the designated experts will either approve or deny the
   registration request, communicating this decision to IANA.  Denials
   should include an explanation and, if applicable, suggestions as to
   how to make the request successful.

12.  Acknowledgments

   This document was edited by Al Morton, who passed away before being
   able to finalize this work.  Ruediger Geib only joined later to help
   finalize this draft.

   Thanks to Lincoln Lavoie, Can Desem, Greg Mirsky, Bjoern Ivar Teigen,
   Ken Kerpez and Chen Li for reviewing this draft and providing helpful
   suggestions and areas for further development.  Mohamed Boucadair's
   AD review improved comprehensibility of the document and he further
   navigated the document well through the final review stages.  Tommy
   Pauly shepherded this document.  Further comments by Gorry Fairhurst,
   Eric Vyncke, Roman Danyliw, Gunter van de Velde, Deb Cooley, Tianran
   Zhou, Andy Newton, Giuseppe Fioccola, Lars Eggert, Erik Kline and
   Benson Muite helped to shape the document.  David Dong and Amanda
   Baber provided early reviews of the IANA Considerations section.

   Starting with the early SEC-DIR review, Brian Weis provided very
   constructive guidance regarding numerous security related protocol
   issues.  Crypto Forum RG reviewed these parts, again providing
   guidance.  Magnus Westerlund's review resulted in further changes and
   refinements.  Ultimately, Paul Wouters' feedback was critical in
   finalizing the chosen security approach.

13.  References

13.1.

12.1.  Normative References

   [C-Prog]   ISO/IEC, "ISO/IEC 9899:1999 Programming "Programming languages - -- C",
              1999. ISO/IEC 9899:1999,
              1999, <https://www.iso.org/standard/29237.html>.

   [NIST800-108]
              Chen, LC., L., "Recommendation for Key Derivation Using
              Pseudorandom Functions (Revised, Update 1)", Functions",
              DOI 10.6028/NIST.SP.800-108r1-upd1, NIST
              SP 800-108r1-upd1, August 2022,
              <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/
              NIST.SP.800-108r1-upd1.pdf>.

   [RFC0768]  Postel, J., "User Datagram Protocol", STD 6, RFC 768,
              DOI 10.17487/RFC0768, August 1980,
              <https://www.rfc-editor.org/info/rfc768>.

   [RFC0791]  Postel, J., "Internet Protocol", STD 5, RFC 791,
              DOI 10.17487/RFC0791, September 1981,
              <https://www.rfc-editor.org/info/rfc791>.

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119,
              DOI 10.17487/RFC2119, March 1997,
              <https://www.rfc-editor.org/info/rfc2119>.

   [RFC5044]  Culley, P., Elzur, U., Recio, R., Bailey, S., and J.
              Carrier, "Marker PDU Aligned Framing for TCP
              Specification", RFC 5044, DOI 10.17487/RFC5044, October
              2007, <https://www.rfc-editor.org/info/rfc5044>.

   [RFC6234]  Eastlake 3rd, D. and T. Hansen, "US Secure Hash Algorithms
              (SHA and SHA-based HMAC and HKDF)", RFC 6234,
              DOI 10.17487/RFC6234, May 2011,
              <https://www.rfc-editor.org/info/rfc6234>.

   [RFC7210]  Housley, R., Polk, T., Hartman, S., and D. Zhang,
              "Database of Long-Lived Symmetric Cryptographic Keys",
              RFC 7210, DOI 10.17487/RFC7210, April 2014,
              <https://www.rfc-editor.org/info/rfc7210>.

   [RFC8085]  Eggert, L., Fairhurst, G., and G. Shepherd, "UDP Usage
              Guidelines", BCP 145, RFC 8085, DOI 10.17487/RFC8085,
              March 2017, <https://www.rfc-editor.org/info/rfc8085>.

   [RFC8126]  Cotton, M., Leiba, B., and T. Narten, "Guidelines for
              Writing an IANA Considerations Section in RFCs", BCP 26,
              RFC 8126, DOI 10.17487/RFC8126, June 2017,
              <https://www.rfc-editor.org/info/rfc8126>.

   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
              May 2017, <https://www.rfc-editor.org/info/rfc8174>.

   [RFC8899]  Fairhurst, G., Jones, T., Tüxen, M., Rüngeler, I., and T.
              Völker, "Packetization Layer Path MTU Discovery for
              Datagram Transports", RFC 8899, DOI 10.17487/RFC8899,
              September 2020, <https://www.rfc-editor.org/info/rfc8899>.

   [RFC9097]  Morton, A., Geib, R., and L. Ciavattone, "Metrics and
              Methods for One-Way IP Capacity", RFC 9097,
              DOI 10.17487/RFC9097, November 2021,
              <https://www.rfc-editor.org/info/rfc9097>.

   [TR-471]   Morton, A,, Editor., "Broadband Forum TR-471: IP Layer   Broadband Forum, "Maximum IP-Layer Capacity Metrics Metric,
              Related Metrics, and Measurement, Measurements", TR-471, Issue 4", 4,
              September 2024, <https://www.broadband-forum.org/technical/download/
              TR-471.pdf>.
              <https://www.broadband-forum.org/pdfs/tr-471-4-0-0.pdf>.

   [Y.1540]   ITU-T, "Internet protocol data communication service - IP
              packet transfer and availability performance parameters",
              ITU-T Recommendation Y.1540, December 2019,
              <https://www.itu.int/rec/T-REC-Y.1540-201912-I/en>.

   [Y.1540Amd2]
              ITU-T, "Internet protocol data communication service - IP
              packet transfer and availability performance parameters parameters,
              Amendment 2 - Revised Annex B: Additional search
              algorithms for IP-based capacity parameters and methods of
              measurement", ITU-T Recommendation Y.1540 Amd. 2, March
              2023, <https://www.itu.int/rec/T-REC-Y.1540-201912-I/en>.

13.2.
              <https://www.itu.int/rec/T-REC-Y.1540-202303-I!Amd2/en>.

12.2.  Informative References

   [EVP_KDF-KB]
              "The
              "EVP_KDF-KB - The Key-Based EVP_KDF implementation",
              OpenSSL Documentation,
              <https://docs.openssl.org/master/man7/EVP_KDF-KB/>.

   [RFC3148]  Mathis, M. and M. Allman, "A Framework for Defining
              Empirical Bulk Transfer Capacity Metrics", RFC 3148,
              DOI 10.17487/RFC3148, July 2001,
              <https://www.rfc-editor.org/info/rfc3148>.

   [RFC4656]  Shalunov, S., Teitelbaum, B., Karp, A., Boote, J., and M.
              Zekauskas, "A One-way Active Measurement Protocol
              (OWAMP)", RFC 4656, DOI 10.17487/RFC4656, September 2006,
              <https://www.rfc-editor.org/info/rfc4656>.

   [RFC5136]  Chimento, P. and J. Ishac, "Defining Network Capacity",
              RFC 5136, DOI 10.17487/RFC5136, February 2008,
              <https://www.rfc-editor.org/info/rfc5136>.

   [RFC5357]  Hedayat, K., Krzanowski, R., Morton, A., Yum, K., and J.
              Babiarz, "A Two-Way Active Measurement Protocol (TWAMP)",
              RFC 5357, DOI 10.17487/RFC5357, October 2008,
              <https://www.rfc-editor.org/info/rfc5357>.

   [RFC7497]  Morton, A., "Rate Measurement Test Protocol Problem
              Statement and Requirements", RFC 7497,
              DOI 10.17487/RFC7497, April 2015,
              <https://www.rfc-editor.org/info/rfc7497>.

   [RFC7594]  Eardley, P., Morton, A., Bagnulo, M., Burbridge, T.,
              Aitken, P., and A. Akhter, "A Framework for Large-Scale
              Measurement of Broadband Performance (LMAP)", RFC 7594,
              DOI 10.17487/RFC7594, September 2015,
              <https://www.rfc-editor.org/info/rfc7594>.

   [RFC8337]  Mathis, M. and A. Morton, "Model-Based Metrics for Bulk
              Transport Capacity", RFC 8337, DOI 10.17487/RFC8337, March
              2018, <https://www.rfc-editor.org/info/rfc8337>.

   [RFC8762]  Mirsky, G., Jun, G., Nydell, H., and R. Foote, "Simple
              Two-Way Active Measurement Protocol", RFC 8762,
              DOI 10.17487/RFC8762, March 2020,
              <https://www.rfc-editor.org/info/rfc8762>.

   [RFC9145]  Boucadair, M., Reddy.K, T., and D. Wing, "Integrity
              Protection for the Network Service Header (NSH) and
              Encryption of Sensitive Context Headers", RFC 9145,
              DOI 10.17487/RFC9145, December 2021,
              <https://www.rfc-editor.org/info/rfc9145>.

Appendix A.  KDF Example (OpenSSL)

   <CODE BEGINS>
   //
   // Output individual authentication keys of length SHA256_KEY_LEN
   // from derived key material.
   //
   // Return Values: 0 = Failure, 1 = Success
   //
   int kdf_hmac_sha256(char *Kin, uint32_t authUnixTime,
     unsigned char *cAuthKey,   // Client key
     unsigned char *sAuthKey) { // Server key

     int var, keylen = SHA256_KEY_LEN * 2;
     char context[16];
     unsigned char *keyptr, keybuf[keylen];
     EVP_KDF *kdf = NULL;
     EVP_KDF_CTX *kctx = NULL;
     OSSL_PARAM params[16], *p = params;

     //
     // Fetch KDF algorithm and create context
     //
     if ((kdf = EVP_KDF_fetch(NULL, "KBKDF", NULL)) == NULL) {
       return 0;
     }
     if ((kctx = EVP_KDF_CTX_new(kdf)) == NULL) {
       EVP_KDF_free(kdf);
       return 0;
     }

     //
     // Set parameters for KBKDF
     // ---------------------------------------------------------
     *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE, "COUNTER", 0);
     *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC, "HMAC", 0);
     *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, "SHA256", 0);
     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, Kin, strlen(Kin));
     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT, "UDPSTP", 6);
     var = snprintf(context, sizeof(context), "%u", authUnixTime);
     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, context, var);
     //
     // Confirm the following are enabled
     //
     var = 1;
     *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_KBKDF_USE_L, &var);
     *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_KBKDF_USE_SEPARATOR, &var);
     //
     // Set counter length in bits (available as of OpenSSL 3.1)
     //
     var = 32; // Length of 32 is backward compatible with OpenSSL 3.0
     *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_KBKDF_R, &var);
     *p++ = OSSL_PARAM_construct_end();
     // ---------------------------------------------------------

     //
     // Derive key material
     //
     if (EVP_KDF_derive(kctx, keybuf, keylen, params) < 1) {
       EVP_KDF_CTX_free(kctx);
       EVP_KDF_free(kdf);
       return 0;
     }

     //
     // Output individual keys
     //
     keyptr = keybuf;
     memcpy(cAuthKey, keyptr, SHA256_KEY_LEN);
     keyptr += SHA256_KEY_LEN;
     memcpy(sAuthKey, keyptr, SHA256_KEY_LEN);

     //
     // Cleanup
     //
     EVP_KDF_CTX_free(kctx);
     EVP_KDF_free(kdf);
     return 1;
   }
   <CODE ENDS>

                    Figure 12: KDF Example Code Snippet

Acknowledgments

   This document was edited by Al Morton, who passed away before being
   able to finalize this work.  Ruediger Geib only joined later to help
   finalize this specification.

   Thanks to Lincoln Lavoie, Can Desem, Greg Mirsky, Bjoern Ivar Teigen,
   Ken Kerpez, and Chen Li for reviewing this specification and
   providing helpful suggestions and areas for further development.
   Mohamed Boucadair's AD review improved comprehensibility of the
   document, and he further navigated the document well through the
   final review stages.  Tommy Pauly shepherded this document.  Further
   comments by Gorry Fairhurst, Éric Vyncke, Roman Danyliw, Gunter Van
   de Velde, Deb Cooley, Tianran Zhou, Andy Newton, Giuseppe Fioccola,
   Lars Eggert, Erik Kline, and Benson Muite helped to shape the
   document.  David Dong and Amanda Baber provided early reviews of the
   IANA Considerations section.

   Starting with the early SEC-DIR review, Brian Weis provided
   constructive guidance regarding numerous security-related protocol
   issues.  The Crypto Forum Research Group reviewed these parts, again
   providing guidance.  Magnus Westerlund's review resulted in further
   changes and refinements.  Ultimately, Paul Wouters' feedback was
   critical in finalizing the chosen security approach.

Authors' Addresses

   Al Morton

   Len Ciavattone
   AT&T Labs
   Middletown, NJ
   United States of America
   Email: lenciavattone@gmail.com

   Ruediger Geib (editor)
   Deutsche Telekom
   Deutsche Telekom Allee 9
   64295 Darmstadt
   Germany
   Phone: +49 6151 5812747
   Email: Ruediger.Geib@telekom.de