Skip to content

RFC 8986 - SRv6 Network Programming

Field Value
Title Segment Routing over IPv6 (SRv6) Network Programming
Authors C. Filsfils, et al.
Date February 2021
Status Proposed Standard
Link datatracker.ietf.org/doc/rfc8986

Summary

RFC 8986 is the foundational specification for SRv6 Network Programming. It defines the set of SRv6 endpoint behaviors that nodes can implement to process packets with SRv6 SIDs.

Key Sections

Section Topic Description
4 SRv6 Segment Defines the SRv6 SID as a 128-bit value composed of Locator, Function, and Arguments
4.1 SRv6 SID Structure of an SRv6 SID: LOC:FUNCT:ARG fields
5 SRv6 Endpoint Behaviors Complete catalog of endpoint behaviors with processing rules
5.1 End (Endpoint) Base behavior: update SL, copy segment to DA, forward
5.2 End.X (L3 Cross-Connect) Forward to specific interface/next-hop after SID processing
5.3 End.T (Table Lookup) Lookup in a specific routing table after SID processing
5.4 End.DX6 / End.DX4 Decapsulate and cross-connect to IPv6 or IPv4 next-hop
5.5 End.DT6 / End.DT4 / End.DT46 Decapsulate and perform table lookup (L3VPN)
5.6 End.DX2 Decapsulate and forward to L2 interface (L2VPN point-to-point)
5.7 End.B6.Encaps / End.B6.Encaps.Red Binding SID: insert SRv6 Policy via encapsulation
5.8 End.BM Binding SID: insert SR-MPLS Policy
6 Transit Behaviors Source/domain ingress behaviors for SRH insertion or encapsulation
7 Flavors PSP, USP, and USD flavor modifiers for endpoint behaviors
8 Security Considerations Trust domain model, filtering, HMAC usage

SRv6 Endpoint Behaviors

Complete Behavior Table

Behavior Type Description Typical Use Case
End Endpoint Decrement SL, update DA with next segment, forward via IPv6 table Intermediate waypoint in segment list
End with PSP Endpoint + Flavor At Penultimate Segment (SL=1), pop the SRH before forwarding Reduce overhead at egress; offload SRH removal
End with USP Endpoint + Flavor At Ultimate Segment (SL=0), pop the SRH SRH removal at the final segment endpoint
End with USD Endpoint + Flavor At Ultimate Segment (SL=0), decapsulate the outer IPv6 header Direct decap at final destination
End.X L3 Cross-Connect Forward to a specific layer-3 adjacency after SID processing Adjacency steering, TE per-link control
End.X with PSP/USP/USD L3 Cross-Connect + Flavor End.X with penultimate/ultimate segment pop or decap Adjacency TE with SRH optimization
End.T Table Lookup Lookup inner packet in a specific IPv6 routing table Multi-topology, VRF-lite steering
End.T with PSP/USP/USD Table Lookup + Flavor End.T with penultimate/ultimate segment pop or decap Table-based forwarding with SRH optimization
End.DX6 Decap + L3 Cross-Connect Decapsulate outer IPv6, forward inner IPv6 to specific next-hop L3VPN PE-CE IPv6 per-CE forwarding
End.DX4 Decap + L3 Cross-Connect Decapsulate outer IPv6, forward inner IPv4 to specific next-hop L3VPN PE-CE IPv4 per-CE forwarding
End.DT6 Decap + Table Lookup Decapsulate outer IPv6, lookup inner IPv6 in specific table L3VPN IPv6 -- lookup in VRF table
End.DT4 Decap + Table Lookup Decapsulate outer IPv6, lookup inner IPv4 in specific table L3VPN IPv4 -- lookup in VRF table
End.DT46 Decap + Table Lookup Decapsulate, lookup inner IPv4 or IPv6 in specific table Dual-stack L3VPN using a single SID
End.DX2 Decap + L2 Cross-Connect Decapsulate outer IPv6, forward inner L2 frame to interface EVPN VPWS (point-to-point L2VPN)
End.DX2V Decap + L2 VLAN Decapsulate, forward L2 frame with VLAN to interface L2VPN with VLAN awareness
End.DT2U Decap + L2 Table (Unicast) Decapsulate, MAC lookup in L2 table for unicast EVPN VLAN-based unicast bridging
End.DT2M Decap + L2 Table (Multicast) Decapsulate, flood to L2 domain EVPN BUM traffic flooding
End.B6.Encaps Binding SID Apply SRv6 Policy by encapsulating with new IPv6 + SRH Steering into SRv6 TE Policy
End.B6.Encaps.Red Binding SID (Reduced) Same as End.B6.Encaps but with reduced SRH when possible Optimized SRv6 Policy insertion
End.BM Binding SID (MPLS) Apply SR-MPLS policy by encapsulating with MPLS labels SRv6-to-MPLS interworking
End.OP OAM Endpoint Punt to control plane for OAM processing SRv6 ping/traceroute (RFC 9259)
End.OTP OAM + Timestamp Add timestamp, punt to control plane Delay measurement

Transit Behaviors

Behavior Description Use Case
T.Insert Insert an SRH into an existing IPv6 packet (no new encapsulation) Mid-domain policy application without extra header
T.Insert.Red Insert a reduced SRH (omit last SID if it equals DA) Optimized T.Insert with smaller overhead
T.Encaps Encapsulate with outer IPv6 header + SRH Domain ingress encapsulation
T.Encaps.Red Encapsulate with reduced SRH Optimized encapsulation
T.Encaps.L2 Encapsulate an L2 frame with outer IPv6 + SRH L2VPN ingress encapsulation
T.Encaps.L2.Red Encapsulate L2 frame with reduced SRH Optimized L2 encapsulation

Flavors (PSP, USP, USD)

Flavor Full Name When Applied Effect
PSP Penultimate Segment Pop SL = 1 (one segment remaining) Pops the SRH before forwarding to the ultimate segment; the last node receives a clean IPv6 packet without SRH
USP Ultimate Segment Pop SL = 0 (final segment reached) The ultimate segment endpoint itself removes the SRH
USD Ultimate Segment Decapsulation SL = 0 (final segment reached) The ultimate segment endpoint removes the entire outer IPv6 header (full decapsulation)

PSP is the most commonly deployed flavor

PSP offloads SRH removal to the penultimate node, reducing processing on the egress PE. Most vendor implementations default to or prefer PSP.

Common Pitfalls

PSP vs USP selection. PSP removes the SRH at the penultimate segment endpoint (SL=1), while USP removes it at the ultimate endpoint (SL=0). In many deployments, PSP is preferred because it offloads SRH processing from the final egress node. However, if the egress node needs to see the SRH for policy or OAM purposes, USP must be used instead.

End.DT4 vs End.DX4 confusion. End.DT4 performs a table lookup in a VRF -- the inner packet is looked up in a routing table, and the outgoing interface is determined by the lookup result. End.DX4 performs a cross-connect to a specific next-hop/interface without a lookup. Use End.DT4 for multi-homed VPN customers (typical L3VPN) and End.DX4 only when you need per-CE direct forwarding.

End.DT46 is a single SID for dual-stack. Instead of allocating separate End.DT4 and End.DT6 SIDs for a VRF, End.DT46 handles both IPv4 and IPv6 inner packets. This saves SID space but both address families must be in the same table.

Transit behaviors are applied at the source or domain ingress, not at segment endpoints. T.Insert and T.Encaps are headend behaviors that create or modify the SRH. They are not the same as End behaviors.

Document Relationship Description
RFC 9800 Extension Adds NEXT-C-SID and REPLACE-C-SID compressed SID flavors
RFC 9252 Uses behaviors BGP signaling for SRv6 VPN services referencing End.DT/DX behaviors
draft-ietf-spring-sr-service-programming Extension Service function chaining behaviors (End.AN, End.AS, etc.) for SRv6
RFC 9259 Uses behaviors Defines End.OP and End.OTP OAM endpoint behaviors