BFD

Stands for: Bidirectional Forwarding Detection

Bidirectional Forwarding Detection - a tiny, protocol-agnostic hello stream that detects a dead path in milliseconds, so routing protocols can fail over before users notice.

Routing protocols keep deliberately slow hellos (seconds) for stability; BFD (RFC 5880) runs the fast heartbeat for them: two endpoints exchange minimal control packets at intervals commonly tuned to tens of milliseconds, declare the path down after a few misses, and notify every registered client - BGP, OSPF, IS-IS, static routes, VRRP - in one stroke. One session protects them all, which is the elegance: liveness becomes a shared service instead of per-protocol timer surgery. The echo function pushes detection into the forwarding plane itself. The practical rule of thumb: anywhere failover matters and the media will not signal loss of link, BFD is the difference between 50 milliseconds and 30 seconds.

The detection time is never carried in the packet: each receiver computes it as the remote Detect Mult times the larger of its own Required Min RX Interval and the remote Desired Min TX Interval, so 3 times 300 ms gives 900 ms, FRRouting's default. Until a session is Up, both sides send no faster than once a second, and the three-way handshake runs Down, Init, Up, so a session configured on one side only never comes up.

Single-hop BFD runs over UDP port 3784 with TTL 255 checked on receipt; multihop sessions use port 4784 and should use authentication instead, and RFC 7130 runs one micro-BFD session per link aggregation member on port 6784. RFC 5882 makes BFD advisory: the client protocol decides what to do, and the lowest protocol in the hierarchy should be the client, OSPF rather than an iBGP session that depends on it.

It misfires in known ways. Run in the control plane it can become CPU-bound and may miss a dead forwarding plane; policers, shapers and firewalls can starve it; one session over a bundle cannot see a dead member; and an attacker in full control of a link can forward only BFD packets so the link is falsely declared up. FRRouting's show bfd peers prints both sides' timers, the computed detection timeout and the last diagnostic.

Also known as: bfd, echo function, liveness detection

Sources

← All glossary entries