Combined Hash Mechanism for ECMP/LAG Load Balancing

4.1. Tunnel Traffic Polarization

As described in Section 1.1 of [RFC6438], in tunnel scenarios, when traffic from multiple sources is aggregated into a single tunnel, all encapsulated packets have the same outer source and destination addresses. If ECMP/LAG paths exist between intermediate routers, and path selection is based solely on hashing the outer 5-tuple (or its subset), all tunnel traffic will be mapped to the same path, preventing effective load sharing.¶

     _____        _____                 _____        _____
    | TEP |______| R1  |---------------| R2  |______| TEP |
    |__A__|      |_____|---------------|_____|      |__B__|
                       ECMP or LAG
                         here

4.2. Limitations of Existing Solutions

Existing solutions each have their applicable scenarios and limitations:¶

• IPv6 Flow Label Approach [RFC6438]: Requires IPv6 outer encapsulation and cooperation from the ingress tunnel endpoint (TEP) to set the flow label.¶
• MPLS Entropy Label Approach [RFC6790]: Only applicable to MPLS networks and requires all LSRs along the path to support entropy labels.¶
• Deep Packet Inspection (DPI): While some devices support inspecting inner packet fields for hashing, this increases processing complexity and latency, and is unavailable when packets are encrypted.¶

4.3. Motivation for Combined Hashing

In practical network devices, a common implementation approach is to configure multiple parallel hash computation units, each independently configurable with its hash field set. However, final path selection typically can only use one of these hash values. The combined hash mechanism defined in this document allows combining multiple base hash values to produce a combined hash value that considers multi-layer information for final path selection.¶

5.1. Basic Principle

The core idea of the combined hash mechanism is to apply combination operations to multiple independently computed base hash values, producing a new combined hash value. Through this approach:¶

1. Each base hash value can be independently computed from different packet field sets (e.g., outer L3, inner L3, L2 fields).¶
2. The combination operation merges the entropy of multiple base hash values, producing a combined hash value containing more information.¶
3. Final path selection can be based on the combined hash value, thus indirectly achieving comprehensive consideration of multiple field sets.¶

5.2. Architecture

                                 +--------------------+
  +--------+                     | Hash Compute Unit 0|-----> H0
  |        |   +-----------+     +--------------------+        |
  |        |-->| Field Set |---->| Hash Function      |        |
  |        |   |     A     |     +--------------------+        |
  |        |   +-----------+                                   |
  |        |                     +--------------------+        |
  | Packet |   +-----------+     | Hash Compute Unit 1|-----> H1
  |        |-->| Field Set |---->+--------------------+        |
  |        |   |     B     |                                   |
  |        |   +-----------+                                   v
  |        |                     +--------------------+
  |        |   +-----------+     | Hash Compute Unit 2|-----> H2 --+
  |        |-->| Field Set |---->+--------------------+            |
  |        |   |     C     |                                       |
  |        |   +-----------+     +--------------------+            |
  |        |   +-----------+     | Hash Compute Unit 3|-----> H3 --+
  |        |-->| Field Set |---->+--------------------+            |
  +--------+   |     D     |                                       |
               +-----------+                                       v
                                                   +---------------+
                                                   | Combination   |
                                                   | H_c = H2 ^ H3 |
                                                   +---------------+
                                                           |
                                                           v
                                                   +---------------+
                                                   | Path Selection|
                                                   | from {H0..H3, |
                                                   |       H_c}    |
                                                   +---------------+
                                                           |
                                                           v
                                                     Forwarding Path

5.3. Relationship with Existing Mechanisms

This mechanism complements [RFC6438] and [RFC6790]. When the outer layer uses IPv6 and TEPs support RFC 6438, the flow label approach can be preferred. When MPLS networks are deployed with RFC 6790 support, the entropy label approach can be preferred. When the above conditions are not met, the combined hash mechanism provides a purely local implementation alternative. These approaches can be used together for optimal results.¶

6.1. Base Hash Computation

Devices implementing this specification MUST support at least two independent base hash computation units. Each computation unit SHOULD support independent configuration of its hash field set.¶

RECOMMENDED hash field set configuration options include:¶

Base hash value bit-width SHOULD be at least 16 bits. Implementations MAY support larger bit-widths for better distribution characteristics.¶

6.2. Combination Operations

Implementations MUST support XOR combination operation on two base hash values:¶

H_combined = H_x XOR H_y

where H_x and H_y are any two selected base hash values.¶

Implementations MAY additionally support the following combination operations:¶

Addition combination:¶

H_combined = (H_x + H_y) mod 2^n

where n is the hash value bit-width.¶

Concatenation hash:¶

H_combined = Hash(H_x || H_y)

where || denotes bit-level concatenation and Hash() is the configured hash function.¶

When using XOR operation, implementations MUST detect whether H_x and H_y might be identical (computed from the same field set). If configured to XOR identical hash values, implementations SHOULD generate a warning, as this will result in a combined value of zero.¶

6.3. Path Selection

Implementations MUST support selecting the final hash value for path selection from any base hash value (H0, H1, H2, H3, ...) or the combined hash value (H_combined).¶

Final hash value selection SHOULD be configurable.¶

For ECMP path selection, the hash-threshold algorithm described in [RFC2992] or a similar deterministic algorithm SHOULD be used to ensure all packets of the same flow are forwarded to the same path.¶

7.1. Configuration Parameters

7.2. Configuration Constraints

The following configuration constraints MUST be enforced:¶

1. combination.input-1 and combination.input-2 SHOULD NOT be configured to the same value. If configured to the same value, implementations MUST generate a warning.¶
2. When combination.enabled is false, the valid range for final-hash-select is 0 to (hash-unit-count - 1).¶
3. When combination.enabled is true, final-hash-select MAY additionally select the combined hash value.¶

8.1. Initialization

Upon device startup, the following initialization procedure MUST be executed:¶

1. Read and validate configuration parameter validity.¶
2. Configure each hash computation unit with its corresponding field set.¶
3. If combined hashing is enabled, initialize the combination operation module.¶
4. Configure path selection logic to use the specified final hash value.¶

8.2. Packet Processing

For each received packet, the processing procedure is as follows:¶

Step 1: Base Hash Computation¶

• Each hash computation unit extracts configured fields from the packet in parallel.¶
• Execute hash function computation on extracted fields.¶
• Produce base hash values H0, H1, ..., Hn.¶

Step 2: Combined Hash Computation (if enabled)¶

• Select two base hash values according to configuration.¶
• Execute the configured combination operation.¶
• Produce combined hash value H_combined.¶

Step 3: Path Selection¶

• Select final hash value according to final-hash-select configuration.¶
• Execute path selection algorithm using final hash value (e.g., hash-threshold algorithm from [RFC2992]).¶
• Determine forwarding path and forward packet.¶

8.3. Configuration Change Handling

When configuration changes occur:¶

• Implementations SHOULD support online configuration changes without device restart.¶
• Configuration changes MUST take effect immediately for subsequent packets.¶
• Implementations SHOULD log configuration change events for audit purposes.¶

9.1. Relationship with RFC 6438

[RFC6438] defines a method for using the flow label in IPv6 tunnel scenarios for ECMP/LAG load balancing. That method requires the ingress tunnel endpoint to set a flow label value in the outer IPv6 header based on information computed from the inner packet.¶

The combined hash mechanism defined in this document complements [RFC6438]: RFC 6438 executes at tunnel endpoints and affects all intermediate nodes along the tunnel path, while the combined hash mechanism executes locally at a single forwarding node and does not affect other nodes. When both mechanisms are used together, their effects can accumulate.¶

9.2. Relationship with RFC 6790

[RFC6790] defines the MPLS entropy label mechanism, allowing entropy information for load balancing to be carried in the MPLS label stack.¶

The mechanism defined in this document complements [RFC6790]: RFC 6790 requires nodes along the path to support entropy label parsing, while the combined hash mechanism does not require support from other nodes. In MPLS networks, both mechanisms can be used simultaneously.¶

9.3. Relationship with RFC 2992

[RFC2992] analyzes the hash-threshold algorithm for ECMP. The final hash value produced by the combined hash mechanism defined in this document can be used as input to the RFC 2992 algorithm. This document does not modify or replace the path selection algorithm defined in [RFC2992].¶

10.1. Configuration Security

The combined hash mechanism is a local device behavior and does not introduce new attack surfaces beyond those inherent in hash-based load balancing. However, operators should be aware that hash configuration details, if exposed, could allow traffic engineering attacks. Implementations MUST enforce access control for hash configuration parameters. Implementations SHOULD log configuration changes for audit purposes.¶

A.1. Data Center Overlay Networks

In overlay networks such as VXLAN/NVGRE, large amounts of tenant traffic traverse shared underlay tunnels. Example configuration:¶

• Hash unit 0: OUTER field set (outer IP addresses)¶
• Hash unit 1: INNER field set (inner IP addresses)¶
• Combination operation: H0 XOR H1¶
• Final selection: Combined hash value¶

This configuration enables path selection to consider both outer tunnel information and inner tenant flow information.¶

A.2. Service Provider Core Networks

In MPLS backbone networks, entropy labels may not be fully deployed. Example configuration:¶

• Hash unit 0: L3 field set (IP 5-tuple)¶
• Hash unit 1: MPLS label stack¶
• Combination operation: H0 XOR H1¶
• Final selection: Combined hash value¶

This configuration provides improved load distribution without relying on entropy labels.¶