RPF Check

RPF Check Basics

In unicast routing and forwarding, unicast packets are transmitted along a point-to-point path. Routers only need to know the destination address of a packet to find the outbound interface. In multicast routing and forwarding, however, routers cannot know the location of a specific receiver because the destination address of a multicast packet identifies a group of receivers. Because routers can find out the source of a multicast packet based on the source address, they can check the source addresses of multicast packets to ensure correct forwarding paths. The process of checking the forwarding path based on the source address is a reverse path forwarding (RPF) check.

When a router receives a multicast packet, it searches the unicast routing table for the route to the source address of the packet. After finding the route, the router checks whether the outbound interface for the route is the same as the inbound interface of the multicast packet. If they are the same, the router considers that the multicast packet has been received from a correct interface. This ensures correct forwarding paths for multicast packets.

The correct interface is called an RPF interface.

RPF Check Process

In addition to unicast routes, RPF checks can also be performed using Multiprotocol Border Gateway Protocol (MBGP) routes and static multicast routes. If a router has all these routes, it performs an RPF check on a multicast packet in the following way:

1. The router selects an optimal route from each of the unicast routing table, MBGP routing table, and multicast static routing table according to the source address of the multicast packet. The outbound interfaces of the unicast and MBGP routes are RPF interfaces, and the next hops of those routes are the RPF neighbors. The RPF interface and RPF neighbor of the multicast static route have been specified when the route is manually configured.

2. The router selects one of the three routes as the RPF route according to the following rules:

   • If the longest match rule is configured, the router selects the route with the longest mask. If more than one route has the longest mask, the router selects the one with the highest preference. If more than one route has the highest preference, the router uses the following order of priority: multicast static route, MBGP route, and unicast route.
   • If the longest match rule is not configured, the router selects the route with the highest preference. If more than one route has the highest preference, the router uses the following order of priority: multicast static route, MBGP route, and unicast route.

3. The router compares the inbound interface of the packet with the RPF interface of the selected RPF route. If the inbound interface is the same as the RPF interface, the router considers that the packet has arrived on the correct path from the source and forwards the packet downstream. If the inbound interface is different from the RPF interface, the packet fails the RPF check. The router considers that the packet is received from an incorrect interface and drops the packet.

In Figure 1, a multicast stream sent from source 10.10.2.2 arrives at interface Int1 of the router. The router checks the routing table and finds that the multicast stream from this source should arrive at interface Int0. The RPF check fails, and the router drops the multicast stream.

Figure 1 RPF check fails

In Figure 2, a multicast stream sent from the source 10.10.2.2 arrives at interface Int0 of the router. The router checks the routing table and finds that the RPF interface is also Int0. The RPF check succeeds, and the multicast stream is correctly forwarded.

Figure 2 RPF check succeeds

RPF Check in Multicast Data Forwarding

Multicast routing protocols determine upstream and downstream neighbors and create multicast routing entries based on unicast routes, MBGP routes, and multicast static routes. The RPF check mechanism enables multicast data streams to be transmitted along the multicast distribution tree and prevents loops on forwarding paths.

If a router searches the unicast routing table to perform an RPF check on every multicast data packet received, many system resources are consumed. To save system resources, a router first searches for the matching (S, G) entry after receiving a data packet sent from a source to a group.

• If no matching (S, G) entry is found, the router performs an RPF check to find the RPF interface for the packet. The router then creates a multicast route with the RPF interface as the upstream interface and delivers the route to the multicast forwarding information base (MFIB). If the RPF check succeeds, the inbound interface of the packet is the RPF interface, and the router forwards the packet to all the downstream interfaces in the forwarding entry. If the RPF check fails, the packet has been forwarded along an incorrect path, so the router drops the packet.
• If a matching (S, G) entry is found and the inbound interface of the packet is the same as the upstream interface in the entry, the router replicates the packet to all downstream interfaces specified in the entry.
• If a matching (S, G) entry is found but the inbound interface of the packet is different from the upstream interface in the entry, the router performs an RPF check on the packet. Based on the RPF check result, the router processes the packet as follows:
  • If the RPF interface is the same as the upstream interface in the entry, the (S, G) entry is correct and the packet has been forwarded along an incorrect path. The router drops the packet.
  • If the RPF interface is different from the upstream interface in the entry, the (S, G) entry is outdated, and the router changes the upstream interface in the entry to be the same as the RPF interface. The router then compares the RPF interface with the inbound interface of the packet. If the inbound interface is the RPF interface, the router replicates the packet to all downstream interfaces specified in the (S, G) entry. If the inbound interface is different from the RPF interface, the router drops the packet.