Subject: [Lsr] Questions about draft-ietf-lsr-dynamic-flooding-04

From: "Gengxuesong (Geng Xuesong)" <[email-masked]>
Date: Sat, 9 May 2020 06:25:08 +0000

Hi Tony, Sarah

Thank you for your work about Flooding Reduction mechanism. I think it is very useful for IGP scalability.
When Sarah giving presentation for draft-chen-lsr-dynamic-flooding-algorithm-00 in LSR interim meeting, I raised a question about how to handle multipoint failure in the flooding topology. I remembered that draft-ietf-lsr-dynamic-flooding-04 was mentioned. I have read this draft, especially section 6.8.11 and temporary flooding relevant content. I think it is a valid method logically. (We have tried to raise some examples to challenge this method, but in all these cases, this method works) Considering that reliability of IGP is crucial for deployment, we are still wondering whether some mathematical proof is necessary (or possible) to guarantee that, in all the possible scenarios, proper convergence could be achieved when using flooding reduction algorithm, just as traditional IGP mechanism. The proof may be case by case depending on the flooding reduction algorithm, but we think even some example or clue about how to do this will be very helpful.

Best Regards
Xuesong

---

From: [email-masked]
Date: Sat, 9 May 2020 10:18:28 -0700

Hi Xuesong,

> Thank you for your work about Flooding Reduction mechanism. I think it is very useful for IGP scalability.

Thank you, we very much appreciate that.

> When Sarah giving presentation for draft-chen-lsr-dynamic-flooding-algorithm-00 in LSR interim meeting, I raised a question about how to handle multipoint failure in the flooding topology. I rememb…

A proof? Ok, I can try to be rigorous, but it’s been a very long time. I apologize in advance to Kireeti, Mr. Myers, Mr. Douglas, and Prof. Greever for what follows.

Definition: Let G=(V, E) be a finite graph. F=(V, E’) is a ‘flooding topology’ on G if E’ is a subset of E and F is connected.

We normally have other properties for flooding topologies, such as being bi-connected, relatively sparse, minimal diameter, and minimal degree, but those properties are not relevant for this proof.

Definition: Let C=(V*, E*), V* a subset of V, E* a subset of E, be the ‘cut’ of G. This represents the failures in the topology. Let G’ = G - C, the topology after failure, and let F’ = F - C, be the flooding topology after failure. 

Definition: Let R = E - E* - E’. This is the set of 'recovery edges': edges that have not failed and are not part of the flooding topology.

Corollary: R is finite. 

Proof: G is finite, by definition. Therefore E is finite, E* must be finite, and E’ is finite.

Lemma 1: If G’ is connected, then F’ + R is connected.

Proof: 

G’ = G - C = (V, E) - (V*, E*) = (V - V*, E - E*).  

F’ + R = (F - C) + (E - E* - E’) = (V, E’) - (V*, E*) + (E - E* - E’) = ( V - V*, E’ - E* ) + ( E - E* - E’) = ( V - V*, E’ - E* + E - E* - E’ ) = ( V - V*, E - E* - E* ) = ( V - V*, E - E* ) = G’.

Q.E.D.

Lemma 2: If G’ is connected, then incrementally adding edges from R to F’ will yield a connected flooding topology.

Proof: By induction. Let R’ be a subset of R. Induction property: Either F' + R’ is connected, or R’ is a proper subset of R.

Base case: R’ is the empty set. If F’ is connected, then F’ + R’ is connected and the property is satisfied. If F’ + R’ is not connected, R’ is empty, which is a proper subset of R.

Induction case: Let r be a recovery edge in R - R’ (i.e., a new edge to add).  If F’ + R’ is connected, then the property is satisfied already. If F’ + R’ + r is connected, the property is satisfied. If R’ + r = R, then by Lemma 1, the property is satisfied. Otherwise, R’ + r != R, and the property is satisfied. By our corollary, the induction must terminate.

Q.E.D.

Bugs, questions, and comments are welcome.

Regards,
Tony

---

From: "Gengxuesong (Geng Xuesong)" <[email-masked]>
Date: Mon, 11 May 2020 13:17:18 +0000

Hi Tony,

Thank you for giving detailed proof, and it is very helpful to understand the mechanism.
As I understand, it is showed in the proof that if there is proper temporary flooding in R = E - E* - E’, same connectivity could be achieved by the flooding topology F’ just as G’. I agree with this.
The problem for me now is how to enable the temporary flooding properly.
Here is an example:
[1AB72D8D-D69C-4047-9E89-5F6062EB6526]
The solid line presents the physical link inside flooding topology, and the dashed line presents the physical link out of flooding topology.
From the view of me, when multipoint failure happens, node 3 is supposed to enable the temporary flooding between 3 and 4, in order to connect with the nodes inside the red box, while the other dashed line between node 1 and node nobody is not supposed to do temporary flooding although node 1 is connected to the failed link directly.
It seems a little unclear for me about how the node itself could decide whether a dashed line should do temporary flooding or not in this case.

Best Regards
Xuesong

From: Tony Li [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Sunday, May 10, 2020 1:18 AM
To: Gengxuesong (Geng Xuesong) <[email-masked]>
Cc: [email-masked]; [email-masked]
Subject: Re: [Lsr] Questions about draft-ietf-lsr-dynamic-flooding-04

Hi Xuesong,

Corollary: R is finite.

Proof:

Q.E.D.

Q.E.D.

Regards,
Tony

---

From: [email-masked]
Date: Mon, 11 May 2020 10:03:15 -0700

Hi Xuesong,

> As I understand, it is showed in the proof that if there is proper temporary flooding in R = E - E* - E’, same connectivity could be achieved by the flooding topology F’ just as G’. I agree with th…

I’m glad it helped.

> It seems a little unclear for me about how the node itself could decide whether a dashed line should do temporary flooding or not in this case.

The problem that you’re asking about is partition detection.

To explain this, I’ve taken the liberty of adding some more labels to your diagram.

To start, each node has its link state database and the flooding topology.  Each node should receive link state updates from nodes in its partition, but will not receive updates from other nodes, thus the link state database is partially inconsistent and must be treated with care.

For example, node 2 will see updates from nodes 1, 6, and 7, informing it of the failure, but it will not receive an update from node 8.

Now, the job of each node is try to compute the partitions of the flooding topology.  In particular, each node needs to understand which nodes are in its partition. A node cannot know all of the partitions that exist, but it turns out that that’s irrelevant.

Once a node understands which nodes are in its partition, then it is a simple matter to see which links should be enabled for temporary flooding.  If a neighbor is in the same partition (e.g., nodes 1 and 5), then adding the link adds no value. If the neighbor is not in the same partition (e.g., nodes 3 and 4), then it becomes a recovery link.

The actual computation of the partitions is straightforward, with one caveat: we always want to perform a two-way check for connectivity.  An implementation should be doing this during SPF already, so this should be familiar. The reason for doing this is quite clear: in node 2’s link state database (LSDB), the LSP for node 8 will show connectivity to node 1 even after the failure. However, node 1’s LSP will clearly show that the adjacency has failed.  We can only infer connectivity when we see both sides of the adjacency are up.

Given this, the specific algorithm that you choose is an implementation detail.  You could do a breadth-first search or a depth-first search. Our implementation chooses to walk the entire flooding topology, building a tree of the partitions that it detects. [IPR note: we have a IPR claim for this approach, with the “don’t sue us, we won’t sue you” terms.]

I hope this helps.

Regards,
Tony

---

From: "Gengxuesong (Geng Xuesong)" <[email-masked]>
Date: Wed, 13 May 2020 11:02:03 +0000

Hi Tony,

The whole process of temporary flooding is much more clear for me. Thank you for your explanation!

Best Regards
Xuesong

Sent: Tuesday, May 12, 2020 1:03 AM

Hi Xuesong,

I’m glad it helped.

I hope this helps.

Regards,
Tony