Ping the SID: OAM and the five failures that actually happen

1Pinging a SID: three outcomes, one of which looks like a failure

RFC 9259 describes “how the existing IPv6 mechanisms for ping and traceroute can be used in an SRv6 network” and specifies the OAM flag for “controllable and predictable flow sampling from segment endpoints.”^[1] Its Appendix A is the practical part: pinging an IPv6 address via a segment list, pinging a SID, traceroute via a segment list, traceroute to a SID, hybrid OAM using the O-flag, and monitoring of SRv6 paths.^[1]

The sentence to internalise is that “the ping mechanism described above can also be used to perform SID reachability checks and to validate that the SID is locally programmed at the target node.”^[1] That only works when the endpoint’s configuration permits ICMPv6 as an upper-layer header on that SID.^[2]

Which produces three outcomes, not two:

Code 4 is “SR Upper-layer Header Error” from RFC 8986 section 4.1.1, and the same section notes that operators “may enable local configuration to allow Upper-Layer header type 58 (ICMPv6)” precisely so SIDs can be pinged.^[2] A customer who reads Code 4 as a failure will spend an afternoon fixing a working endpoint.

sysctl -w net.ipv6.conf.all.seg6_enabled=1 net.ipv6.conf.eth1.seg6_enabled=1
ip -6 route add 2001:db8:cafe::/64 encap seg6 mode encap \
  segs fcbb:bbbb:2::1,fcbb:bbbb:3::1,fcbb:bbbb:4::100 dev eth1
# mode encap.red for the reduced SRH. segs are written in SR-policy order;
# the kernel reverses them into the Segment List.

2The O-flag, and how to write up a negative result

The O-flag sits at bit 2 of the SRH Flags octet, in a field RFC 8754 itself declares entirely unused and reserved.^[1][3] Its semantics are narrow and worth quoting: it is “used as a marking bit in user packets to trigger telemetry data collection and export at the segment endpoints”, and processing inserts one step into the endpoint pseudocode — “(a) Make a copy of the packet. (b) Send the copied packet, along with a timestamp, to the OAM process for telemetry data collection and export.”^[1]

Two properties make it safe to enable and useless to guess about. First, “timestamp and any other metadata are not carried in the packet forwarded to the next hop”, so the forwarded packet is byte-identical to one without OAM processing.^[1] Second, “implementation of the O-flag is OPTIONAL. If a node does not support the O-flag, then it simply ignores it upon reception. If a node supports the O-flag, it can optionally advertise its potential via control plane protocol(s)” — and that advertisement is the O-flag bit in the IS-IS SRv6 Capabilities sub-TLV type 25, whose 2 octets of flags currently define nothing else.^[1][4]

The RFC assumes IPFIX as the export protocol “without the loss of generality.”^[1]

So when you craft an SRH with the O-flag in scapy, aim it at a Linux endpoint and nothing happens, the correct write-up is not “bug”. It is: the specification makes implementation optional and unsupporting nodes ignore the flag, this node produced no OAM output, therefore this node does not implement the O-flag. That sentence is publishable. “SRv6 OAM is broken on Linux” is not.

3The five failures that actually happen

Symptoms in an SRv6 domain are almost always the same — “it pings the underlay but the service does not work” — so triage has to run on evidence, not on symptoms. These are the five, each with the command that produces its evidence.

1. MSD advertised as zero. RFC 9352 registers four MSD types: 41 SRH Max Segments Left, 42 SRH Max End Pop, 44 SRH Max H.encaps and 45 SRH Max End D.^[4] Each has the same brutal default: “if no value is advertised, the supported value is 0”, and for type 44 specifically, a zero means “the headend can apply an SR Policy that only contains one segment without inserting any SRH header.”^[4] A headend computing a six-segment path against a receiver that advertised nothing produces drops at the endpoint and nothing useful in a log. Evidence: dump the IS-IS LSPs and confirm all four types are present and non-zero on every node in the path.^[4]

2. MTU, with no PMTUD relief inside the domain. The arithmetic is 40 bytes of outer IPv6 plus 8 bytes of SRH base plus 16 bytes per segment, so an uncompressed three-segment encapsulation costs 96 bytes; the same path as a single uSID carrier costs 40 with no SRH at all.^[3][11] IPv6 guarantees only that “every link in the Internet have an MTU of 1280 octets or greater”, which is a floor and not a budget.^[9] Evidence: sweep the inner payload size until it passes, and compare against the smallest interface MTU on the path. The classic report — “it broke when I added a fourth segment” — is this, almost every time.

3. An unroutable service SID. RFC 9252 says the SRv6 Service SID SHOULD be routable within the AS of the egress PE, and it is that reachability, not the advertisement, that the ingress PE depends on.^[12] FRR turns the SHOULD into a hard local rule: “in MPLS-VPN or SRv6-VPN, an L3VPN next-hop entry requires that the path chosen respectively contains a labelled path or a valid SID IPv6 address”, so the path is present and the prefix still does not install.^[13] Evidence: the nexthop view on the ingress PE, covered in the previous lesson.

4. seg6_enabled left at 0. The per-interface sysctl “accept or drop SR-enabled IPv6 packets on this interface. Relevant packets are those with SRH present and DA = local”, and it defaults to 0.^[6] A lab node with a perfect seg6local route silently drops everything until it is set. The practical enable line is sysctl -w net.ipv6.conf.all.seg6_enabled=1 net.ipv6.conf.default.seg6_enabled=1 net.ipv6.conf.eth1.seg6_enabled=1; whether the all knob alone is sufficient is [UNVERIFIED] against a kernel document, so set the specific interface too and test it yourself.^[6] Evidence: read the sysctl on the receiving interface, not on all.

5. An unresolved uA or End.X next hop. In Linux, End.X requires SEG6_LOCAL_NH6, so a missing next hop is a configuration rejection.^[10] In community SONiC it is worse because it looks healthy: “when IP NextHop doesn’t exist, SRV6_MY_SID_TABLE objects are programmed with Drop action and notify NeighOrch to resolve IP NextHop. When that NextHop is resolved, SRV6Orchagent updates SRV6_MY_SID_TABLE with valid IP NextHop handle and Forward action.”^[8] The entry exists, the SID is programmed, and the action is Drop. On Cumulus, uA next-hop learning is by router advertisement, and “if the adjacent device is a non-Spectrum switch, you need to enable router advertisements on the adjacent device on the connected interface to ensure proper next hop discovery.”^[7] That last one is a real interop footgun in a mixed Dell and NVIDIA rack.

4Counters as evidence, in three dialects

Every implementation answers the same three questions — how many packets hit this SID, how many bytes, how many failed — with different words.

Linux. Add count to the seg6local route. That enables “1) packets correctly processed; 2) bytes correctly processed; 3) packets that cause a processing error (i.e., missing SID List, wrong SID List, etc). To retrieve the counters … use the -s flag in the show command.”^[5] The kernel names are SEG6_LOCAL_CNT_PACKETS, SEG6_LOCAL_CNT_BYTES and SEG6_LOCAL_CNT_ERRORS, where errors count “packets that have NOT been properly processed by an SRv6 Behavior instance.”^[10]

Cumulus Linux. nv show router segment-routing srv6 stats gives per-SID Hit Counters as SID and Packets, plus a Drop Counters section with “Total no-sid-dropped packets”; there are also stats sid <sid> and stats no-sid-drops forms, and nv action clear router segment-routing srv6 stats to zero them.^[7] Two caveats: there are no byte counters in the documented output, and “when you enable packet trimming with segment routing, Cumulus Linux counts the trimmed packet twice in the SRv6 statistics.”^[7]

Community SONiC. MySID counters use the flex-counter infrastructure with a default polling interval of 10 seconds, gated on the SAI attribute capability, and the CLI is counterpoll srv6 {enable|disable|interval}, sonic-clear srv6counters, show srv6 stats and show srv6 stats <MySID>, with columns MySID, Packets and Bytes.^[8]

The mapping is the useful artefact:

Note what the table does not say. A blank cell means the documentation fetched on 2026-09-07 does not describe that counter, not that the platform lacks it.

5Produce all three outcomes on purpose