ROLL                                                      T. Winter, Ed.
Internet-Draft
Intended status: Standards Track                         P. Thubert, Ed.
Expires: November 29, December 13, 2010                                 Cisco Systems
                                                         RPL Author Team
                                                            IETF ROLL WG
                                                            May 28,
                                                            Jun 11, 2010

      RPL: IPv6 Routing Protocol for Low power and Lossy Networks
                         draft-ietf-roll-rpl-08
                         draft-ietf-roll-rpl-09

Abstract

   Low power and Lossy Networks (LLNs) are a class of network in which
   both the routers and their interconnect are constrained: LLN routers
   typically operate with constraints on (any subset of) processing
   power, memory and energy (battery), and their interconnects are
   characterized by (any subset of) high loss rates, low data rates and
   instability.  LLNs are comprised of anything from a few dozen and up
   to thousands of routers, and support point-to-point traffic (between
   devices inside the LLN), point-to-multipoint traffic (from a central
   control point to a subset of devices inside the LLN) and multipoint-
   to-point traffic (from devices inside the LLN towards a central
   control point).  This document specifies the IPv6 Routing Protocol
   for LLNs (RPL), which provides a mechanism whereby multipoint-to-
   point traffic from devices inside the LLN towards a central control
   point, as well as point-to-multipoint traffic from the central
   control point to the devices inside the LLN, is supported.  Support
   for point-to-point traffic is also available.

Status of this Memo

   This Internet-Draft is submitted to IETF in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups.  Note that
   other groups may also distribute working documents as Internet-
   Drafts.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt.

   The list of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html.

   This Internet-Draft will expire on November 29, December 13, 2010.

Copyright Notice

   Copyright (c) 2010 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . . .   6
     1.1.   Design Principles  . . . . . . . . . . . . . . . . . . . .   6
     1.2.   Expectations of Link Layer Type  . . . . . . . . . . . . .   7
   2.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . .   7
   3.  Protocol Overview . . . . . . . . . . . . . . . . . . . . . .   9
     3.1.   Topology . . . . . . . . . . . . . . . . . . . . . . . . .   9
       3.1.1.  Topology Identifiers  . . . . . . . . . . . . . . . . . 10   9
     3.2.   Instances, DODAGs, and DODAG Versions  . . . . . . . . . .  10
     3.3.   Upward Routes and DODAG Construction . . . . . . . . . . .  12
       3.3.1.  DAG Repair  Objective Function (OF) . . . . . . . . . . . . . . .  12
       3.3.2.  DODAG Repair  . . . . . . . . . . . . . . . . . . . .  12
       3.3.2.
       3.3.3.  Security  . . . . . . . . . . . . . . . . . . . . . .  13
       3.3.4.  Grounded and Floating DODAGs  . . . . . . . . . . . .  13
       3.3.5.  Local DODAGs  . . . . . . 12
       3.3.3.  Administrative Preference . . . . . . . . . . . . . .  13
       3.3.4.  Objective Function (OF)
       3.3.6.  Administrative Preference . . . . . . . . . . . . . .  13
       3.3.7.  Datapath Validation and Loop Detection  . . . . . . .  13
       3.3.5.
       3.3.8.  Distributed Algorithm Operation . . . . . . . . . . .  13
     3.4.   Downward Routes and Destination Advertisement  . . . . . .  14
     3.5.   Local DODAGs Route Discovery . . . . . . . . . . . . . .  14
     3.6.   Routing Metrics and Constraints Used By RPL  . . . . . . .  14
       3.5.1.
       3.6.1.  Loop Avoidance  . . . . . . . . . . . . . . . . . . . .  15
       3.5.2.
       3.6.2.  Rank Properties . . . . . . . . . . . . . . . . . . . 16
     3.6.  17
     3.7.   Traffic Flows Supported by RPL . . . . . . . . . . . . . .  19
       3.6.1.
       3.7.1.  Multipoint-to-Point Traffic . . . . . . . . . . . . .  19
       3.6.2.
       3.7.2.  Point-to-Multipoint Traffic . . . . . . . . . . . . .  19
       3.6.3.
       3.7.3.  Point-to-Point Traffic  . . . . . . . . . . . . . . . . 19  20
   4.  RPL Instance  . . . . . . . . . . . . . . . . . . . . . . . . .  20
     4.1.   RPL Instance ID  . . . . . . . . . . . . . . . . . . . . .  20
   5.  ICMPv6 RPL Control Message  . . . . . . . . . . . . . . . . . .  21
     5.1.   RPL Security Fields  . . . . . . . . . . . . . . . . . . .  23
     5.2.   DODAG Information Solicitation (DIS) . . . . . . . . . . . 26  28
       5.2.1.  Format of the DIS Base Object . . . . . . . . . . . . 26  28
       5.2.2.  Secure DIS  . . . . . . . . . . . . . . . . . . . . . . 27  29
       5.2.3.  DIS Options . . . . . . . . . . . . . . . . . . . . . 27  29
     5.3.   DODAG Information Object (DIO) . . . . . . . . . . . . . . 27  29
       5.3.1.  Format of the DIO Base Object . . . . . . . . . . . . 27  29
       5.3.2.  Secure DIO  . . . . . . . . . . . . . . . . . . . . . . 29  31
       5.3.3.  DIO Options . . . . . . . . . . . . . . . . . . . . . 29  31
     5.4.   Destination Advertisement Object (DAO) . . . . . . . . . . 30  32
       5.4.1.  Format of the DAO Base Object . . . . . . . . . . . . 30  32
       5.4.2.  Secure DAO  . . . . . . . . . . . . . . . . . . . . . . 31  33
       5.4.3.  DAO Options . . . . . . . . . . . . . . . . . . . . . 31  33
     5.5.   Destination Advertisement Object Acknowledgement
            (DAO-ACK)  . . . . . . . . . . . . . . . . . . . . . . . . 31  33
       5.5.1.  Format of the DAO-ACK Base Object . . . . . . . . . . 31  33
       5.5.2.  Secure DAO-ACK  . . . . . . . . . . . . . . . . . . . . 32  34
       5.5.3.  DAO-ACK Options . . . . . . . . . . . . . . . . . . . 32  35
     5.6.  RPL Control Message Options   Consistency Check (CC) . . . . . . . . . . . . . . . 32 . .  35
       5.6.1.  RPL Control Message Option Generic  Format of the CC Base Object  . . . . . . . 32
       5.6.2.  Pad1 . . . . .  35
       5.6.2.  CC Options  . . . . . . . . . . . . . . . . . . . . 33
       5.6.3.  PadN .  36
     5.7.   RPL Control Message Options  . . . . . . . . . . . . . .  36
       5.7.1.  RPL Control Message Option Generic Format . . . . . .  36
       5.7.2.  Pad1  . . . . 33
       5.6.4.  Metric Container . . . . . . . . . . . . . . . . . . . 34
       5.6.5.  Route Information .  37
       5.7.3.  PadN  . . . . . . . . . . . . . . . . . 35
       5.6.6.  DODAG Configuration . . . . . . .  37
       5.7.4.  Metric Container  . . . . . . . . . . 36
       5.6.7.  RPL Target . . . . . . . .  38
       5.7.5.  Route Information . . . . . . . . . . . . . . 37
       5.6.8.  Transit Information . . . .  38
       5.7.6.  DODAG Configuration . . . . . . . . . . . . . 39
       5.6.9.  Solicited Information . . . .  40
       5.7.7.  RPL Target  . . . . . . . . . . . . 40
       5.6.10. Prefix Information . . . . . . . . .  41
       5.7.8.  Transit Information . . . . . . . . . 42
   6.  Upward Routes . . . . . . . .  42
       5.7.9.  Solicited Information . . . . . . . . . . . . . . . .  44
     6.1.  DIO Base Rules
       5.7.10. Prefix Information  . . . . . . . . . . . . . . . . .  45
   6.  Sequence Counters . . . . . 45
     6.2.  Upward Route Discovery and Maintenance . . . . . . . . . . 45
       6.2.1.  Neighbors and Parents within a DODAG Version . . . . . 45
       6.2.2.  Neighbors and Parents across DODAG Versions . .  47
   7.  Upward Routes . . . 46
       6.2.3.  DIO Message Communication . . . . . . . . . . . . . . 51
     6.3.  DIO Transmission . . . . . . .  48
     7.1.   DIO Base Rules . . . . . . . . . . . . . . . 52
       6.3.1.  Trickle Parameters . . . . . .  48
     7.2.   Upward Route Discovery and Maintenance . . . . . . . . .  49
       7.2.1.  Neighbors and Parents within a DODAG Version  . . . . 52
     6.4.  49
       7.2.2.  Neighbors and Parents across DODAG Selection Versions . . . . .  50
       7.2.3.  DIO Message Communication . . . . . . . . . . . . . .  54
     7.3.   DIO Transmission . . 53
     6.5.  Operation as a Leaf Node . . . . . . . . . . . . . . . . . 53
     6.6.  Administrative Rank .  54
       7.3.1.  Trickle Parameters  . . . . . . . . . . . . . . . . .  55
     7.4.   DODAG Selection  . 53
   7.  Downward Routes . . . . . . . . . . . . . . . . . . .  56
     7.5.   Operation as a Leaf Node . . . . 54
     7.1.  Downward Route Discovery and Maintenance . . . . . . . . . 54
       7.1.1.  Overview . . .  56
     7.6.   Administrative Rank  . . . . . . . . . . . . . . . . . .  57
   8.  Downward Routes . . 54
       7.1.2.  Mode of Operation . . . . . . . . . . . . . . . . . . 55
       7.1.3. . . .  57
     8.1.   Destination Advertisement Parents  . . . . . . . . . . 56
       7.1.4.  DAO Operation on Storing Nodes . .  57
     8.2.   Downward Route Discovery and Maintenance . . . . . . . .  58
     8.3.   DAO Base Rules . . 56
       7.1.5.  Operation of DAO Non-storing Nodes . . . . . . . . . . 60
       7.1.6.  Scheduling to Send DAO (or No-Path) . . . . . . . . . 61
       7.1.7.  Triggering  58
     8.4.   DAO Message from the Sub-DODAG  . Transmission Scheduling  . . . . . 61
       7.1.8.  Sending DAO Messages to DAO Parents . . . . . . . . . 62
       7.1.9.  Multicast Destination Advertisement  59
     8.5.   Triggering DAO Messages  . . . . . 63
   8.  Packet Forwarding and Loop Avoidance/Detection . . . . . . . . 64
     8.1.  Suggestions for Packet Forwarding . . .  59
     8.6.   Structure of DAO Messages  . . . . . . . . . 64
     8.2.  Loop Avoidance and Detection . . . . . .  60
     8.7.   Non-storing Mode . . . . . . . . . 65
       8.2.1.  Source Node Operation . . . . . . . . . . .  60
     8.8.   Storing Mode . . . . . 66
       8.2.2.  Router Operation . . . . . . . . . . . . . . . . .  61
     8.9.   Path Control . . 66
   9.  Multicast Operation . . . . . . . . . . . . . . . . . . . .  62
     8.10.  Multicast Destination Advertisement Messages . 68
   10. Maintenance of Routing Adjacency . . . . .  63
   9.  Security Mechanisms . . . . . . . . . . 69
   11. Guidelines for Objective Functions . . . . . . . . . . .  64
     9.1.   Security Overview  . . . 70
     11.1. Objective Function Behavior . . . . . . . . . . . . . . . 70
   12. RPL Constants and Variables .  64
     9.2.   Installing Keys  . . . . . . . . . . . . . . . . 72
   13. Manageability Considerations . . . .  65
     9.3.   Joining a Secure Network . . . . . . . . . . . . . 73
     13.1. Control of Function and Policy . . .  65
     9.4.   Counter and Counter Compression  . . . . . . . . . . . 73
       13.1.1. Initialization Mode .  66
       9.4.1.  Timestamp Counters  . . . . . . . . . . . . . . . . 73
       13.1.2. DIO Base option  . .  67
     9.5.   Functional Description of Packet Protection  . . . . . .  67
       9.5.1.  Transmission of Outgoing Packets  . . . . . . . . . .  67
       9.5.2.  Reception of Incoming Packets . 74
       13.1.3. Trickle Timers . . . . . . . . . . .  68
       9.5.3.  Cryptographic Mode of Operation . . . . . . . . . 74
       13.1.4. DAG Version Number Increment . .  69

     9.6.   Coverage of Integrity and Confidentiality  . . . . . . .  70
   10. Packet Forwarding and Loop Avoidance/Detection  . . . . 75
       13.1.5. Destination Advertisement Timers . . .  70
     10.1.  Suggestions for Packet Forwarding  . . . . . . . . 75
       13.1.6. Policy Control . . .  70
     10.2.  Loop Avoidance and Detection . . . . . . . . . . . . . .  72
       10.2.1. Source Node Operation . . . 75
       13.1.7. Data Structures . . . . . . . . . . . . .  73
       10.2.2. Router Operation  . . . . . . 75
     13.2. Information and Data Models . . . . . . . . . . . .  73
   11. Multicast Operation . . . 76
     13.3. Liveness Detection and Monitoring . . . . . . . . . . . . 76
       13.3.1. Candidate Neighbor Data Structure . . . . . .  75
   12. Maintenance of Routing Adjacency  . . . . 76
       13.3.2. Directed Acyclic Graph (DAG) Table . . . . . . . . . .  76
       13.3.3. Routing Table  . . . .
   13. Guidelines for Objective Functions  . . . . . . . . . . . . .  76
     13.1.  Objective Function Behavior  . . . 77
       13.3.4. Other RPL Monitoring Parameters . . . . . . . . . . .  77
       13.3.5.
   14. RPL Trickle Timers . Constants and Variables . . . . . . . . . . . . . . . . .  78
     13.4. Verifying Correct Operation  . .
   15. Manageability Considerations  . . . . . . . . . . . . . 78
     13.5. Requirements on Other Protocols and Functional
           Components . . .  79
     15.1.  Introduction . . . . . . . . . . . . . . . . . . . . . 78
     13.6. Impact on Network Operation .  80
     15.2.  Configuration Management . . . . . . . . . . . . . . 78
   14. Security Considerations . .  81
       15.2.1. Initialization Mode . . . . . . . . . . . . . . . . . 78
     14.1. Overview  81
       15.2.2. DIO and DAO Base Message and Options Configuration  .  81
       15.2.3. Protocol Parameters to be configured on every
               router in the LLN . . . . . . . . . . . . . . . . . .  82
       15.2.4. Protocol Parameters to be configured on every
               non-root router in the LLN  . . . . . . 78
     14.2. Functional Description of Packet Protection . . . . . . . 80
       14.2.1. Transmission of Outgoing Packets  82
       15.2.5. Parameters to be configured on the DODAG root . . . .  83
       15.2.6. Configuration of RPL Parameters related to
               DAO-based mechanisms  . . . . . . . 80
       14.2.2. Reception of Incoming Packets . . . . . . . . .  84
       15.2.7. Default Values  . . . 81
       14.2.3. Cryptographic Mode of Operation . . . . . . . . . . . 81
     14.3. Protecting RPL ICMPv6 messages . . . . .  84
     15.3.  Monitoring of RPL Operation  . . . . . . . . . 82
     14.4. Security State Machine . . . . .  85
       15.3.1. Monitoring a DODAG parameters . . . . . . . . . . . .  85
       15.3.2. Monitoring a DODAG inconsistencies and loop
               detection . 83
   15. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 83
     15.1.  86
     15.4.  Monitoring of the RPL Control Message data structures  . . . . . . . . .  86
       15.4.1. Candidate Neighbor Data Structure . . . . . . . . . . 83
     15.2. New Registry for RPL Control Codes  86
       15.4.2. Destination Oriented Directed Acyclic Graph (DAG)
               Table . . . . . . . . . . . . 84
     15.3. New Registry for the Mode of Operation (MOP) DIO
           Control Field . . . . . . . . . . . .  86
       15.4.3. Routing Table and DAO Routing Entries . . . . . . . .  87
     15.5.  Fault Management . . 84
     15.4. RPL Control Message Option . . . . . . . . . . . . . . . . 85
   16. Acknowledgements . .  88
     15.6.  Policy . . . . . . . . . . . . . . . . . . . . . 85
   17. Contributors . . . .  89
     15.7.  Liveness Detection and Monitoring  . . . . . . . . . . .  90
     15.8.  Fault Isolation  . . . . . . . . . . 86
   18. References . . . . . . . . . .  90
     15.9.  Impact on Other Protocols  . . . . . . . . . . . . . . .  90
     15.10. Performance Management . 88
     18.1. Normative References . . . . . . . . . . . . . . . .  90
   16. Security Considerations . . . 88
     18.2. Informative References . . . . . . . . . . . . . . . .  91
     16.1.  Overview . . 88
   Appendix A.  Requirements . . . . . . . . . . . . . . . . . . . . 90
     A.1.  Protocol Properties Overview . .  91
   17. IANA Considerations . . . . . . . . . . . . . 90
       A.1.1.  IPv6 Architecture . . . . . . . .  93
     17.1.  RPL Control Message  . . . . . . . . . . 90
       A.1.2.  Typical LLN Traffic Patterns . . . . . . . .  93
     17.2.  New Registry for RPL Control Codes . . . . . . 90
       A.1.3.  Constraint Based Routing . . . . .  93
     17.3.  New Registry for the Mode of Operation (MOP) DIO
            Control Field  . . . . . . . . . . . 91
     A.2.  Deferred Requirements . . . . . . . . . .  94
     17.4.  RPL Control Message Option . . . . . . . . 91
   Appendix B.  Outstanding Issues . . . . . . .  95
     17.5.  Objective Code Point (OCP) Registry  . . . . . . . . . . 91
     B.1.  Additional Support for P2P  95
     17.6.  ICMPv6: Error in Source Routing Header . . . . . . . . .  95
   18. Acknowledgements  . . . 91
     B.2.  Address / Header Compression . . . . . . . . . . . . . . . 91
     B.3.  Managing Multiple Instances . . . .  95
   19. Contributors  . . . . . . . . . . . 92
   Authors' Addresses . . . . . . . . . . . . .  96
   20. References  . . . . . . . . . . . 92

1.  Introduction

   Low power and Lossy Networks (LLNs) consist of largely of constrained
   nodes (with limited processing power, memory, and sometimes energy
   when they are battery operated).  These routers are interconnected by
   lossy links, typically supporting only low data rates, that are
   usually unstable with relatively low packet delivery rates.  Another
   characteristic of such networks is that the traffic patterns are not
   simply point-to-point, but in many cases point-to-multipoint or
   multipoint-to-point.  Furthermore such networks may potentially
   comprise up to thousands of . . . . . . . . . . . . . .  98
     20.1.  Normative References . . . . . . . . . . . . . . . . . .  98
     20.2.  Informative References . . . . . . . . . . . . . . . . .  98
   Appendix A.  Outstanding Issues . . . . . . . . . . . . . . . . . 101
     A.1.   Additional Support for P2P Routing . . . . . . . . . . . 101
     A.2.   Address / Header Compression . . . . . . . . . . . . . . 101
     A.3.   Managing Multiple Instances  . . . . . . . . . . . . . . 101
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . . 101

1.  Introduction

   Low power and Lossy Networks (LLNs) consist of largely of constrained
   nodes (with limited processing power, memory, and sometimes energy
   when they are battery operated).  These routers are interconnected by
   lossy links, typically supporting only low data rates, that are
   usually unstable with relatively low packet delivery rates.  Another
   characteristic of such networks is that the traffic patterns are not
   simply point-to-point, but in many cases point-to-multipoint or
   multipoint-to-point.  Furthermore such networks may potentially
   comprise up to thousands of nodes.  These characteristics offer
   unique challenges to a routing solution: the IETF ROLL Working Group
   has defined application-specific routing requirements for a Low power
   and Lossy Network (LLN) routing protocol, specified in
   [I-D.ietf-roll-building-routing-reqs], [RFC5826], [RFC5673], and
   [RFC5548].

   This document specifies the IPv6 Routing Protocol for Low power and
   lossy networks (RPL).  Note that although RPL was specified according
   to the requirements set forth in the aforementioned requirement
   documents, its use is in no way limited to these applications.

1.1.  Design Principles

   RPL was designed with the objective to meet the requirements spelled
   out in [I-D.ietf-roll-building-routing-reqs], [RFC5826], [RFC5673],
   and [RFC5548].

   A network may run multiple instances of RPL concurrently.  Each such
   instance may serve different and potentially antagonistic constraints
   or performance criteria.  This document defines how a single instance
   operates.

   In order to be useful in a wide range of LLN application domains, RPL
   separates packet processing and forwarding from the routing
   optimization objective.  Examples of such objectives include
   minimizing energy, minimizing latency, or satisfying constraints.
   This document describes the mode of operation of RPL.  Other
   companion documents specify routing objective functions.  A RPL
   implementation, in support of a particular LLN application, will
   include the necessary objective function(s) as required by the
   application.

   A set of companion documents to this specification will provide
   further guidance in the form of applicability statements specifying a
   set of operating points appropriate to the Building Automation, Home
   Automation, Industrial, and Urban application scenarios.

1.2.  Expectations of Link Layer Type

   In compliance with the layered architecture of IP, RPL does not rely
   on any particular features of a specific link layer technology.  RPL
   is designed to be able to operate over a variety of different link
   layers, including but not limited to, low power wireless or PLC
   (Power Line Communication) technologies.

   Implementers may find [RFC3819] a useful reference when designing a
   link layer interface between RPL and a particular link layer
   technology.

2.  Terminology

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
   "OPTIONAL" in this document are to be interpreted as described in RFC
   2119 [RFC2119].

   Additionally, this document uses terminology from
   [I-D.ietf-roll-terminology], and introduces the following
   terminology:

   DAG:  Directed Acyclic Graph.  A directed graph having the property
         that all edges are oriented in such a way that no cycles exist.
         All edges are contained in paths oriented toward and
         terminating at one or more root nodes.

   DAG root:  A DAG root is a node within the DAG that has no outgoing
         edges.  Because the graph is acyclic, by definition all DAGs
         must have at least one DAG root and all paths terminate at a
         DAG root.

   Destination Oriented DAG (DODAG):  A DAG rooted at a single
         destination, i.e. at a single DAG root (the DODAG root) with no
         outgoing edges.

   DODAG root:  A DODAG root is the DAG root of a DODAG.

   Rank: The rank of a node in a DAG identifies

   Up:   Up refers to the direction from leaf nodes position with
         respect towards DODAG roots,
         following DODAG edges.  This follows the common terminology
         used in graphs and depth-first-search, where vertices further
         from the root are "deeper," or "down," and vertices closer to a
         the root are "shallower," or "up."

   Down: Down refers to the direction from DODAG root.  The farther away a node is roots towards leaf
         nodes, in the reverse direction of DODAG edges.  This follows
         the common terminology used in graphs and depth-first-search,
         where vertices further from the root are "deeper," or "down,"
         and vertices closer to the root are "shallower," or "up."

   Rank: A node's Rank identifies its distance from a DODAG root, root.  Rank
         strictly increases in the higher is down direction and strictly decreases
         in the rank of that node. up direction.  The rank of a
         node may exact way Rank is computed depends on
         the DAG's Objective Function (OF).  Rank can be a simple
         topological distance, or may more commonly be calculated as a function of link
         metrics, and may consider other properties such as described
         later. contraints.

   Objective Function (OF):  Defines which routing metrics, optimization
         objectives, and related functions a DAG uses to compute Rank.

   Objective Code Point (OCP):  An identifier that indicates which
         Objective Function the DODAG parent: uses.

   RPLInstanceID:  A parent of a node unique identifier within a DODAG is one of the
         immediate successors of the node on a path towards network.  Two DODAGs
         with the DODAG
         root.  The DODAG parent of a node will have a lower rank than same RPLInstanceID share the node itself.  (See Section 3.5.2.1).

   DODAG sibling: same Objective Function.

   RPL Instance:  A sibling set of one or more DODAGs that share a
         RPLInstanceID.  A RPL node within a DODAG is defined in this
         specification can belong to be any neighboring node which is located at
         the same rank within a DODAG.  Note that siblings defined in
         this manner do not necessarily share a common most one DODAG parent.
         (See Section 3.5.2.1).

   Sub-DODAG  The sub-DODAG of a node is the set of other nodes in the
         DODAG that might use a path towards the DODAG root that
         contains that node.  Nodes in the sub-DODAG
         RPL Instance.  Each RPL Instance operates independently of
         other RPL Instances.  This document describes operation within
         a node have a
         greater rank than that node itself (although not all nodes of
         greater rank are necessarily in the sub-DODAG of that node).
         (See Section 3.5.2.1). single RPL Instance.

   DODAGID:  The identifier of a DODAG root.  The DODAGID must be unique
         within the scope of a RPL Instance in the LLN.  The tuple
         (RPLInstanceID, DODAGID) uniquely identifies a DODAG.

   DODAG Version:  A specific sequence number iteration ("version") of a
         DODAG with a given DODAGID.

   RPL Instance:  A set of possibly multiple DODAGs.  A network may have
         more than one RPL Instance, and a RPL node can participate in
         multiple RPL Instances.  Each RPL Instance operates
         independently of other RPL Instances.  This document describes
         operation within a single RPL Instance.  In RPL, a node can
         belong to at most one DODAG per RPL Instance.  The tuple
         (RPLInstanceID, DODAGID) uniquely identifies a DODAG.

   RPLInstanceID:  Unique identifier of a RPL Instance.

   DODAGVersionNumber:  A sequential counter that is incremented by the
         root to form a new Version of a DODAG.  A DODAG Version is
         identified uniquely by the (RPLInstanceID, DODAGID,
         DODAGVersionNumber) tuple.

   Up:   Up refers to the direction from leaf nodes towards DODAG roots,
         following

   Goal: The Goal is a application specific goal that is defined outside
         the orientation scope of RPL.  Any node that roots a DODAG will need to
         know about this Goal to decide if the edges within the DODAG.  This
         follows the common terminology used in graphs and depth-first-
         search, where vertices further from the root are "deeper," Goal can be satisfied or
         "down," and vertices closer
         not.  A typical Goal is to construct the root are "shallower," or
         "up."

   Down: Down refers to the direction from DODAG roots towards leaf
         nodes, going against the orientation of the edges within the
         DODAG.  This follows the common terminology used in graphs and
         depth-first-search, where vertices further from the root are
         "deeper," or "down," and vertices closer to the root are
         "shallower," or "up."

   Objective Code Point (OCP):  An identifier, used according to indicate which
         Objective Function is in use for forming a DODAG.  The
         Objective Code Point is further described in
         [I-D.ietf-roll-routing-metrics].

   Objective Function (OF):  Defines which routing metrics, optimization
         objectives,
         specific objective function and related functions are in use in a DODAG.

   Goal: The Goal is to keep connectivity to a host or set
         of hosts that satisfy a particular
         application (e.g. to use an objective (OF).  Whether or not a DODAG can provide
         connectivity function that minimizes ETX
         and to a goal is a property of the DODAG.  For
         example, a goal might be connected to a specific database host serving as a data collection
         point, or a gateway providing connectivity to an external
         infrastructure. store the
         collected data).

   Grounded:  A DODAG is said to be grounded, grounded when the DODAG root can reach
         the Goal of satisfy the objective function.
         Goal.

   Floating:  A DODAG is floating if is not Grounded.  A floating DODAG
         is not expected to reach have IP connectivity to the Goal defined for Goal.  It may,
         however, provide connectivity to other nodes within the OF.
         Typically, DODAG.

   DODAG parent:  A parent of a DAG that node within a DODAG is only intended to provide inner
         connectivity one of the
         immediate successors of the node on a path towards the DODAG
         root.  A DODAG parent's Rank is lower than the node's.  (See
         Section 3.6.2.1).

   Sub-DODAG  The sub-DODAG of a Floating DAG.

   As they form networks, LLN devices often mix node is the roles set of 'host' and
   'router' when compared other nodes whose
         paths to traditional IP networks. the DODAG root pass through that node.  Nodes in the
         sub-DODAG of a node have a greater Rank than that node itself.
         (See Section 3.6.2.1)

   As they form networks, LLN devices often mix the roles of 'host' and
   'router' when compared to traditional IP networks.  In this document,
   'host' refers to an LLN device that can generate but does not forward
   RPL traffic, 'router' refers to an LLN device that can forward as
   well as generate RPL traffic, and 'node' refers to any RPL device,
   either a host or a router.

3.  Protocol Overview

   The aim of this section is to describe RPL in the spirit of
   [RFC4101].  Protocol details can be found in further sections.

3.1.  Topology

   This section describes how the basic RPL topologies, and the rules by
   which these are constructed, i.e. the rules governing DODAG
   formation.

3.1.1.  Topology Identifiers

   RPL uses four identifiers to maintain the topology:

   o  The first is a RPLInstanceID.  A RPLInstanceID identifies a set of
      one or more DODAGs.  All DODAGs in the same RPL Instance use the
      same OF. Objective Function.  A network may have multiple
      RPLInstanceIDs, each of which defines an independent set of
      DODAGs, which may be optimized for different OFs and/or
      applications.  The set of DODAGs identified by a RPLInstanceID is
      called a RPL Instance.

   o  The second is a DODAGID.  The scope of a DODAGID is a RPL
      Instance.  The combination of RPLInstanceID and DODAGID uniquely
      identifies a single DODAG in the network.  A RPL Instance may have
      multiple DODAGs, each of which has an unique DODAGID.

   o  The third is a DODAGVersionNumber.  The scope of a
      DODAGVersionNumber is a DODAG.  A DODAG is sometimes reconstructed
      from the DODAG root, by incrementing the DODAGVersionNumber.  The
      combination of RPLInstanceID, DODAGID, and DODAGVersionNumber
      uniquely identifies a DODAG Version.

   o  The fourth is rank. Rank.  The scope of rank Rank is a DODAG Version.  Rank
      establishes a partial order over a DODAG Version, defining
      individual node positions with respect to the DODAG root.

3.2.  Instances, DODAGs, and DODAG Versions

   Each

   A RPL Instance constructs a routing topology optimized for a
   certain Objective Function (OF) and routing metrics
   [I-D.ietf-roll-routing-metrics]. contains one or more Destination Oriented DAG (DODAG)
   roots.  A RPL Instance may provide routes to certain destination
   prefixes, reachable via the DODAG roots or alternate paths within the
   DODAG.  A single RPL Instance contains one
   or more Destination Oriented DAG (DODAG) roots.  These roots may operate independently, or may coordinate over
   a non-LLN backchannel.

   Each root has a unique identifier, the DODAGID.

   A RPL Instance may comprise:

   o  a single DODAG with a single root

      *  For example, a DODAG optimized to minimize latency rooted at a
         single centralized lighting controller in a home automation
         application.

   o  multiple uncoordinated DODAGs with independent roots (differing
      DODAGIDs)

      *  For example, multiple data collection points in an urban data
         collection application that do not have an always-on backbone
         suitable to coordinate to form a single DODAG, and further use
         the formation of multiple DODAGs as a means to dynamically and
         autonomously partition the network.

   o  a single DODAG with a single virtual root coordinating LLN sinks
      (with the same DODAGID) over some non-LLN backbone

      *  For example, multiple border routers operating with a reliable
         backbone, e.g. in support of a 6LowPAN application, that are
         capable to act as logically equivalent sinks to the same DODAG.

   o  a combination of the above as suited to some application scenario.

   Traffic is bound to a specific

   Each RPL Instance by packet has meta-data that is
   carried with the packet and associates the packet to it with a particular
   RPLInstanceID (Section 8.2). and therefore RPL Instance.(Section 10.2).  The
   provisioning or automated discovery of a mapping between a
   RPLInstanceID and a type or service of application traffic is beyond
   the scope of this specification.

   An

   Figure 1 depicts an example of a RPL Instance comprising a number of three DODAGs is
   depicted in
   with DODAG Roots R1, R2, and R3.  Figure 1.  Revision of 2 depicts how a DODAG Version (two iterations of
   the same DODAG) is depicted in Figure 2.
   version number increment leads to a new DODAG Version.

     +----------------------------------------------------------------+
     |                                                                |
     | +--------------+                                               |
     | |              |                                               |
     | |     (R1)     |            (R2)                   (Rn)                   (R3)        |
     | |     /  \     |            /| \                  / |  \       |
     | |    /    \    |           / |  \                /  |   \      |
     | |  (A)    (B)  |         (C) |  (D)     ...    (F) (G)  (H)    |
     | |  /|\     |\  |         /   |   |\             |   |    |     |
     | | : : :    : : |        :   (E)  : :            :   :    :     |
     | |              |            / \                                |
     | +--------------+           :   :                               |
     |      DODAG                                                     |
     |                                                                |
     +----------------------------------------------------------------+
                                RPL Instance

                          Figure 1: RPL Instance

            +----------------+                +----------------+
            |                |                |                |
            |      (R1)      |                |      (R1)      |
            |      /  \      |                |      /         |
            |     /    \     |                |     /          |
            |   (A)    (B)   |         \      |   (A)          |
            |   /|\     |\   |    ------\     |   /|\          |
            |  : : (C)  : :  |           \    |  : : (C)       |
            |                |           /    |        \       |
            |                |    ------/     |         \      |
            |                |         /      |         (B)    |
            |                |                |          |\    |
            |                |                |          : :   |
            |                |                |                |
            +----------------+                +----------------+
                Version N                        Version N+1

                          Figure 2: DODAG Version

3.3.  Upward Routes and DODAG Construction

   RPL provisions routes up towards DODAG roots, forming a DODAG
   optimized according to the an Objective Function (OF) and routing
   metrics/constraints in use. (OF).  RPL nodes
   construct and maintain these DODAGs through exchange of DODAG Information Object
   (DIO) messages.
   Undirected links between siblings are also identified during this
   process, which can be used to provide additional diversity.

3.3.1.  DAG Repair  Objective Function (OF)

   The Objective Function (OF) defines how RPL supports global repair over the DODAG.  A DODAG Root may
   increment the DODAG Version Number, thereby initiating a new DODAG
   version.  This institutes a global repair operation, revising the
   DODAG and allowing nodes to choose an arbitrary new position select and optimize
   routes within
   the new DODAG version.  Global repair can be seen as a global
   reoptimization mechanism. RPL also supports mechanisms which may be used for local repair
   within the DODAG Instance.  The OF is identified by an Objective
   Code Point (OCP) within the DIO Configuration option.  An OF defines
   how nodes translate one or more metrics and constraints, which are
   themselves defined in [I-D.ietf-roll-routing-metrics], into a value
   called Rank, which approximates the node's distance from a DODAG
   root.  An OF also defines how nodes select parents.  Further details
   may be found in Section 13, [I-D.ietf-roll-routing-metrics],
   [I-D.ietf-roll-of0], and related companion specifications.

3.3.2.  DODAG Repair

   A DODAG Root institutes a global repair operation by incrementing the
   DODAG Version Number.  This initiates a new DODAG version.  Nodes in
   the new DODAG version can choose a new position whose Rank is not
   constrained by their Rank within the old DODAG Version.

   RPL also supports mechanisms which may be used for local repair
   within the DODAG version.  The DIO message specifies the necessary
   parameters as configured from the DODAG root, as controlled by policy
   at the root.

3.3.2.

3.3.3.  Security

   RPL supports message confidentiality and integrity.  It is designed
   such that link-layer mechanisms can be used when available and
   appropriate, yet in their absence RPL can use its own mechanisms.

3.3.4.  Grounded and Floating DODAGs

   DODAGs can be grounded or floating. floating: the DODAG root advertises which
   is the case.  A grounded DODAG offers connectivity to reach a goal. hosts that are
   application-level goals.  A floating DODAG offers no such
   connectivity, and provides routes only to nodes within the DODAG.
   Floating DODAGs may be used, for example, to preserve inner
   connectivity during repair.

3.3.3.

3.3.5.  Local DODAGs

   RPL nodes can optimize routes to a destination within an LLN by
   forming a local DODAG whose DODAG Root is the desired destination.
   Unlike global DAGs, which can consist of multiple DODAGs, local DAGs
   have one and only one DODAG and therefore one DODAG Root.  Local
   DODAGs can be constructed on-demand.

3.3.6.  Administrative Preference

   An implementation/deployment may specify that some DODAG roots should
   be used over others through an administrative preference.
   Administrative preference offers a way to control traffic and
   engineer DODAG formation in order to better support application
   requirements or needs.

3.3.4.  Objective Function (OF)

   The Objective Function (OF) implements

3.3.7.  Datapath Validation and Loop Detection

   RPL uses a hop-by-hop IPv6 header to detect possible loops within a
   DODAG.  Each data packet includes the optimization objectives Rank of
   route selection within the RPL Instance.  The OF is identified by an
   Objective Code Point (OCP) within the DIO.  The OF also specifies the
   procedure used to select parents and compute rank within transmitter.  If a DODAG
   version along
   node receives a data packet with potentially other DODAG characteristics.  Further
   details may be found in Section 11, [I-D.ietf-roll-routing-metrics],
   [I-D.ietf-roll-of0], and related companion specifications.

3.3.5. a Rank less than or equal to its
   own, this indicates a possible loop.  On receiving such a packet, a
   node institutes a local repair operation.

3.3.8.  Distributed Algorithm Operation

   A high level overview of the distributed algorithm, which constructs
   the DODAG, is as follows:

   o  Some nodes are configured to be DODAG roots, with associated DODAG
      configuration.
      configurations.

   o  Nodes advertise their presence, affiliation with a DODAG, routing
      cost, and related metrics by sending link-local multicast DIO
      messages.

   o  Nodes may adjust the rate at which DIO messages are sent in
      response to stability or detection of routing inconsistencies from
      both control or data packets (see Section 8.2 for more).

   o  Nodes listen for DIOs and use their information to join a new
      DODAG, or to maintain an existing DODAG, as according to the
      specified Objective Function and rank-based loop avoidance rules. Rank of their neighbors.

   o  Nodes provision routing table entries, for the destinations
      specified by the DIO, via their DODAG parents in the DODAG
      version.  Nodes MUST provision a DODAG parent as a default route
      for the associated instance.  It is up to the end-to-end
      application to select the RPL instance to be associated to its
      traffic (should there be more than one instance) and thus the
      default route upwards when no longer-match exists.

   o  Nodes may identify DODAG siblings within the DODAG version to
      increase path diversity and decrease convergence time during
      repair.

3.4.  Downward Routes and Destination Advertisement

   RPL constructs and maintains DODAGs with DIO messages to establish
   upward routes: it uses Destination Advertisement Object (DAO) messages to establish
   downward routes along the from DODAG as well as
   other P2P routes. roots.  DAO messages are an optional
   feature for applications that require P2MP or P2P traffic, in either traffic.  RPL
   supports two modes of downward traffic: storing (fully stateful) or
   non-storing (fully source routed
   [I-D.hui-6man-rpl-routing-header]) mode. routed).  Any given RPL Instance is either
   storing or non-storing.  In both cases, P2P packets travel up to a
   DODAG Root then down to the final destination (unless the destination
   is on the upward route).

3.5.  Local DODAGs Route Discovery

   A RPL network can optionally support on-demand discovery of DODAGs to
   specific destinations within an LLN.  Such local DODAGs behave
   slightly differently than global DODAGs.

3.6.  Routing Metrics and Constraints Used By RPL

   Routing metrics are used by routing protocols to compute shortest
   paths.  Interior Gateway Protocols (IGPs) such as IS-IS ([RFC5120])
   and OSPF ([RFC4915]) use static link metrics.  Such link metrics can
   simply reflect the bandwidth or can also be computed according to a
   polynomial function of several metrics defining different link
   characteristics.  Some routing protocols support more than one
   metric: in the vast majority of the cases, one metric is used per
   (sub)topology.  Less often, a second metric may be used as a tie-
   breaker in the presence of Equal Cost Multiple Paths (ECMP).  The
   optimization of multiple metrics is known as an NP complete problem
   and is sometimes supported by some centralized path computation
   engine.

   In contrast, LLNs do require the support of both static and dynamic
   metrics.  Furthermore, both link and node metrics are required.  In
   the case of RPL, it is virtually impossible to define one metric, or
   even a composite metric, that will satisfy all use cases.

   In addition, RPL supports constrained-based routing where constraints
   may be applied to both link and nodes.  If a link or a node does not
   satisfy a required constraint, it is 'pruned' from the candidate
   list, thus leading to a constrained shortest path.

   The set of supported link/node constraints and metrics is specified
   in [I-D.ietf-roll-routing-metrics].

   An Objective Function specifies constraints in use, and how these are
   used, in addition to the objectives used to compute the
   (constrained) path.  Upstream and Downstream metrics may be merged or
   advertised separately depending on the OF and the metrics.  When they
   are advertised separately, it may happen that the set of DIO parents
   is different from the set of DAO parents (a DAO parent is a node to
   which unicast DAO messages are sent).  Yet, all are DODAG parents
   with regards to the rules for Rank computation.

   Example 1: Shortest path: path offering

   The Objective Function itself is decoupled from the routing metrics
   and constraints used by RPL.  Indeed, whereas the OF dictates rules
   such as DODAG parents selection, load balancing and so on, the set of
   metrics and/or constraints used to select a DODAG parent and thus
   determine the preferred path are based on the information carried
   within the DAG container option in DIO messages.

   The set of supported link/node constraints and metrics is specified
   in [I-D.ietf-roll-routing-metrics].

   Example 1: Shortest path: path offering the shortest end-to-end delay

   Example 2: Constrained shortest path: the path that does not traverse
              any battery-operated node and that optimizes the path
              reliability

3.5.1.

3.6.1.  Loop Avoidance

   RPL guarantees neither loop free path selection nor tight delay
   convergence times.  In order to reduce control overhead, however,
   such as the cost of the count-to-infinity problem, RPL avoids
   creating loops when undergoing topology changes.  Furthermore, RPL
   includes rank-based datapath validation mechanisms for detecting
   loops when they do occur.  RPL uses this loop detection to ensure
   that packets make forward progress within the DODAG version and
   trigger repairs when necessary.

3.5.1.1.

3.6.1.1.  Greediness and Rank-based Instabilities

   A node is greedy if it attempts to move deeper in the DODAG version,
   in order to increase the size of the parent set or improve some other
   metric.  Moving deeper in within a DODAG version in this manner could
   result in instability and be detrimental to other nodes.

   Once a node has joined a DODAG version, RPL disallows certain
   behaviors, including greediness, in order to prevent resulting
   instabilities in the DODAG version.

   Suppose a node is willing to receive and process a DIO messages from
   a node in its own sub-DODAG, and in general a node deeper than
   itself.  In this case, a possibility exists that a feedback loop is
   created, wherein two or more nodes continue to try and move in the
   DODAG version while attempting to optimize against each other.  In
   some cases, this will result in instability.  It is for this reason
   that RPL limits the cases where a node may process DIO messages from
   deeper nodes to some forms of local repair.  This approach creates an
   'event horizon', whereby a node cannot be influenced beyond some
   limit into an instability by the action of nodes that may be in its
   own sub-DODAG.

3.5.1.2.

3.6.1.2.  DODAG Loops

   A DODAG loop may occur when a node detaches from the DODAG and
   reattaches to a device in its prior sub-DODAG.  This may happen in
   particular when DIO messages are missed.  Strict use of the DODAG
   Version Number can eliminate this type of loop, but this type of loop
   may possibly be encountered when using some local repair mechanisms.

3.5.1.3.

3.6.1.3.  DAO Loops

   A DAO loop may occur when the parent has a route installed upon
   receiving and processing a DAO message from a child, but the child
   has subsequently cleaned up the related DAO state.  This loop happens
   when a No-Path (a DAO message that invalidates a previously announced
   prefix) was missed and persists until all state has been cleaned up.
   RPL includes an optional mechanism to acknowledge DAO messages, which
   may mitigate the impact of a single DAO message being missed.  RPL
   includes loop detection mechanisms that may mitigate the impact of
   DAO loops and trigger their repair.

   In the case where stateless DAO operation is used, i.e. source
   routing specifies the down routes, then DAO Loops should not occur on
   the stateless portions of the path.

3.5.1.4.  Sibling Loops

   Sibling loops could occur if a group of siblings kept choosing
   amongst themselves as successors such that a packet does not make
   forward progress.  This specification limits the number of times that
   sibling forwarding may be used at a given rank, in order to prevent
   sibling loops.

3.5.2.

3.6.2.  Rank Properties

   The rank of a node is a scalar representation of the location of that
   node within a DODAG version.  The rank is used to avoid and detect
   loops, and as such must demonstrate certain properties.  The exact
   calculation of the rank is left to the Objective Function, and may
   depend on parents, link metrics, and the node configuration and
   policies.

   The rank is not a cost metric, although its value can be derived from
   and influenced by metrics.  The rank has properties of its own that
   are not necessarily those of all metrics:

   Type:   The rank is an abstract decimal value.

   Function:  The rank is the expression of a relative position within a
           DODAG version with regard to neighbors and is not necessarily
           a good indication or a proper expression of a distance or a
           cost to the root.

   Stability:  The stability of the rank determines the stability of the
           routing topology.  Some dampening or filtering might be
           applied to keep the topology stable, and thus the rank does
           not necessarily change as fast as some physical metrics
           would.  A new DODAG version would be a good opportunity to
           reconcile the discrepancies that might form over time between
           metrics and ranks within a DODAG version.

   Granularity:  The portion of the rank that is used to define a node's
           position in the DAG, DAGRank(node), is coarse grained.  A
           fine granularity would make the selection of siblings
           difficult, since siblings must have the exact same rank
           value.

   Properties:  The rank is strictly monotonic, and can be used to
           validate a progression from or towards the root.  A metric,
           like bandwidth or jitter, does not necessarily exhibit this
           property.

   Abstract:  The rank does not have a physical unit, but rather a range
           of increment per hop, where the assignment of each increment
           is to be determined by the Objective Function.

   The rank value feeds into DODAG parent selection, according to the
   RPL loop-avoidance strategy.  Once a parent has been added, and a
   rank value for the node within the DODAG has been advertised, the
   nodes further options with regard to DODAG parent selection and
   movement within the DODAG are restricted in favor of loop avoidance.

3.5.2.1.

3.6.2.1.  Rank Comparison (DAGRank())

   Rank may be thought of as a fixed point number, where the position of
   the decimal point between the integer part and the fractional part is
   determined by MinHopRankIncrease.  MinHopRankIncrease is the minimum
   increase in rank between a node and any of its DODAG parents.  When
   an objective function computes rank, the objective function operates
   on the entire (i.e. 16-bit) rank quantity.  When rank is compared,
   e.g. for determination of parent/sibling parent relationships or loop detection, the
   integer portion of the rank is to be used.  The integer portion of
   the Rank is computed by the DAGRank() macro as
   follows: follows, where
   floor(x) is the function that evaluates to the greatest integer less
   than or equal to x:

              DAGRank(rank) = floor(rank/MinHopRankIncrease)

   MinHopRankIncrease is provisioned at the DODAG Root and propagated in
   the DIO message.  For efficient implementation the MinHopRankIncrease
   MUST be a power of 2.  An implementation may configure a value
   MinHopRankIncrease as appropriate to balance between the loop
   avoidance logic of RPL (i.e. selection of eligible parents and
   siblings) parents) and the
   metrics in use.

   By convention in this document, using the macro DAGRank(node) may be
   interpreted as DAGRank(node.rank), where node.rank is the rank value
   as maintained by the node.

   A node A has a rank less than the rank of a node B if DAGRank(A) is
   less than DAGRank(B).

   A node A has a rank equal to the rank of a node B if DAGRank(A) is
   equal to DAGRank(B).

   A node A has a rank greater than the rank of a node B if DAGRank(A)
   is greater than DAGRank(B).

3.5.2.2.

3.6.2.2.  Rank Relationships

   The computation of the rank MUST be done in such a way so as to
   maintain the following properties for any nodes M and N that are
   neighbors in the LLN:

   DAGRank(M) is less than DAGRank(N):  In this case, the position of M
           is closer to the DODAG root than the position of N. Node M
           may safely be a DODAG parent for Node N without risk of
           creating a loop.  Further, for a node N, all parents in the
           DODAG parent set must be of rank less than DAGRank(N).  In
           other words, the rank presented by a node N MUST be greater
           than that presented by any of its parents.

   DAGRank(M) equals DAGRank(N):  In this case the positions of M and N
           within the DODAG and with respect to the DODAG root are
           similar (identical).  In some cases, Node M may be used as a
           successor by Node N, which however entails the chance of
           creating a loop (which must be detected and resolved by some
           other means).

   DAGRank(M) is greater than DAGRank(N):  In this case, the position of
           M is farther from the DODAG root than the position of N.
           Further, Node M may in fact be in the sub-DODAG of Node N. If
           node N selects node M as DODAG parent there is a risk to
           create a loop.

   As an example, the rank could be computed in such a way so as to
   closely track ETX (Expected Transmission Count, a fairly common
   routing metric used in LLN and defined in
   [I-D.ietf-roll-routing-metrics]) when the objective function is to
   minimize ETX, or latency when the objective function is to minimize
   latency, or in a more complicated way as appropriate to the objective
   function being used within the DODAG.

3.6.

3.7.  Traffic Flows Supported by RPL

3.6.1.

   RPL supports three basic traffic flows: Multipoint-to-Point (MP2P),
   Point-to-Multipoint (P2MP), and Point-to-Point (P2P).

3.7.1.  Multipoint-to-Point Traffic

   Multipoint-to-Point (MP2P) is a dominant traffic flow in many LLN
   applications ([I-D.ietf-roll-building-routing-reqs], [RFC5826],
   [RFC5673], [RFC5548]).  The destinations of MP2P flows are designated
   nodes that have some application significance, such as providing
   connectivity to the larger Internet or core private IP network.  RPL
   supports MP2P traffic by allowing MP2P destinations to be reached via
   DODAG roots.

3.6.2.

3.7.2.  Point-to-Multipoint Traffic

   Point-to-multipoint (P2MP) is a traffic pattern required by several
   LLN applications ([I-D.ietf-roll-building-routing-reqs], [RFC5826],
   [RFC5673], [RFC5548]).  RPL supports P2MP traffic by using a
   destination advertisement mechanism that provisions routes toward
   destination prefixes and away from roots.  Destination advertisements
   can update routing tables as the underlying DODAG topology changes.

3.6.3.

3.7.3.  Point-to-Point Traffic

   RPL DODAGs provide a basic structure for point-to-point (P2P)
   traffic.  For a RPL network to support P2P traffic, a root must be
   able to route packets to a destination.  Nodes within the network may
   also have routing tables to destinations.  A packet flows towards a
   root until it reaches an ancestor that has a known route to the
   destination.  As pointed out later in this document, in the most
   constrained case (when nodes cannot store routes), that common
   ancestor may be the DODAG root.  In other cases it may be a node
   closer to both the source and destination.

   RPL also supports the case where a P2P destination is a 'one-hop'
   neighbor.

   RPL neither specifies nor precludes additional mechanisms for
   computing and installing potentially more optimal routes to support
   arbitrary P2P traffic.

4.  RPL Instance

   Within a given LLN, there may be multiple, logically independent RPL
   instances.  This document describes how a single instance behaves.

   A node may belong to multiple RPL Instances.

   An instance can be either local to a root or global.  When the
   instance is local, the DAG is a single DODAG that is rooted at the
   node that owns the DODAGID.  This is used in particular for the
   construction of a temporary DODAG in support of P2P traffic
   optimization between the root and some other nodes.

   Control and Data Packets that traverse a data packets in RPL network MUST be tagged
   in such a fashion that the instance is to
   unambiguously identified (TBD
   flow label or identify what RPL Hop-by-hop option ([I-D.hui-6man-rpl-option])). Instance they are part of.  The
   identifiers include the RPLInstanceID and and, for local instances, the
   DODAGID.  In some uses the DODAGID is implicit, in other uses it must
   be given explicitly.  Every RPL control message has a RPLInstanceID
   field.  Some RPL control messages may optionally include a DODAGID.
   Data messages routed with RPL have a RPL Hop-by-hop option
   ([I-D.hui-6man-rpl-option]).

   There are two types of RPL Instances: local and global.  Local RPL
   Instances are always a single DODAG whose singular root owns the
   corresponding DODAGID.  Local RPL Instances are intended for
   constructing temporary DODAGs to support on-demand P2P traffic.
   Global RPL Instances have one or more DODAGs and are typically long-
   lived.  RPL divides the RPLInstanceID space between global and local
   instances.
   instances to prevent identifier collisions.

4.1.  RPL Instance ID

   A global RPLInstanceID MUST be unique to the whole LLN.  Mechanisms
   for allocating and provisioning global RPLInstanceID are out of scope
   for this document.  There can be up to 128 global instance in the
   whole network, and up 64 local instances per DODAGID.

   A global RPLinstanceID is encoded in a RPLinstanceID field as
   follows:

        0 1 2 3 4 5 6 7
       +-+-+-+-+-+-+-+-+
       |0|     ID      |  Global RPLinstanceID in 0..127
       +-+-+-+-+-+-+-+-+

        Figure 3: RPL Instance ID field format for global instances

   A local RPLInstanceID is autoconfigured by the node that owns the
   DODAGID and it MUST be unique for that DODAGID.  In that case, the
   DODAGID MUST be a valid address of the root that is used as an
   endpoint of all communications within that instance.

   A local RPLinstanceID is encoded in a RPLinstanceID field as follows:

        0 1 2 3 4 5 6 7
       +-+-+-+-+-+-+-+-+
       |1|D|   ID      |  Local RPLInstanceID in 0..63
       +-+-+-+-+-+-+-+-+

        Figure 4: RPL Instance ID field format for local instances

   The D flag in a Local RPLInstanceID is always set to 0 in RPL control
   messages.  It is used in data packets to indicate whether the DODAGID
   is the source or the destination of the packet.  If the D flag is set
   to 1 then the destination address of the IPv6 packet MUST be the
   DODAGID.  If the D flag is clear then the source address of the IPv6
   packet MUST be the DODAGID.

5.  ICMPv6 RPL Control Message

   This document defines the RPL Control Message, a new ICMPv6 message.
   A RPL Control Message is identified by a code, and composed of a base
   that depends on the code, and a series of options.

   A RPL Control Message has the scope of a link.  The source address is
   a link local address.  The destination address is either all routers
   multicast address (FF02::2) or a link local address.

   In accordance with [RFC4443], the RPL Control Message consists of an
   ICMPv6 header followed by a message body.  The message body is
   comprised of a message base and possibly a number of options as
   illustrated in Figure 5.

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |     Type      |     Code      |          Checksum             |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                                                               |
       .                             Base                              .
       .                                                               .
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                                                               |
       .                           Option(s)                           .
       .                                                               .
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                       Figure 5: RPL Control Message

   The RPL Control message is an ICMPv6 information message with a
   requested Type of 155 (to be confirmed by IANA).

   The Code field identifies the type of RPL Control Message.  This
   document defines codes for the following RPL Control Message types
   (all codes are to be confirmed by the IANA Section 15.2): 17.2):

   o  0x00: DODAG Information Solicitation (Section 5.2)

   o  0x01: DODAG Information Object (Section 5.3)

   o  0x02: Destination Advertisement Object (Section 5.4)

   o  0x03: Destination Advertisement Object Acknowledgment
      (Section 5.5)

   o  0x80: Secure DODAG Information Solicitation (Section 5.2.2)

   o  0x81: Secure DODAG Information Object (Section 5.3.2)

   o  0x82: Secure Destination Advertisement Object (Section 5.4.2)

   o  0x83: Secure Destination Advertisement Object Acknowledgment
      (Section 5.5.2)

   o  0x8A: Consistency Check (Section 5.6)

   The high order bit (0x80) of the code denotes whether the RPL message
   has security enabled.  Secure versions of RPL messages have a
   modified format to support
   confidentiality and integrity, illustrated in Figure Figure 6.

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |     Type      |     Code      |          Checksum             |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                                                               |
       .                           Security                            .
       .                                                               .
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                                                               |
       .                             Base                              .
       .                                                               .
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                                                               |
       .                           Option(s)                           .
       .                                                               .
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                   Figure 6: Secure RPL Control Message

   The remainder of this section describes the currently defined RPL
   Control Message Base formats followed by the currently defined RPL
   Control Message Options.

5.1.  RPL Security Fields

   Each RPL message has a secure version.  The secure versions provide
   integrity and confidentiality.  Because security covers the base
   message as well as options, in secured messages the security
   information lies between the checksum and base, as shown in Figure
   Figure 6.

   The format of the security section is as follows:

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |0|0|C|KIM|
       |C|T| Rsrvd |Sec|KIM|Rsrvd| LVL |                               |
       +-+-+-+-+-+-+-+-+
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               +
       |                            Counter                            |
       .                                                               .
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                                                               |
       .                  Message Authentication Code                  .
       .                                                               .
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                                                               |
       .                        Key Identifier                         .
       .                                                               .
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                        Figure 7: Security Section

   All fields are considered as packet payload from a security
   processing perspective.  The exact placement and format of message
   integrity/authentication codes has not yet been determined.

   Use of the Security section is further detailed in Section 14. 16.

   Security Control Field:  The Security Control Field has one flag and
         two
         three fields:

         Counter Compression (C):  If the Counter Compression flag is
               set then the Counter field is compressed from 4 bytes
               into 1 byte.  If the Counter Compression flag is clear
               then the Counter field is 4 bytes and uncompressed.

         Counter is Time (T):  If the Counter is Time flag is set then
               the Counter field is a timestamp.  If the flag is cleared
               then the Counter is an incrementing counter.  Section 9.4
               describes the details of the 'T' flag and Counter field.

         Security Mode (Sec):  The security algorithm field specifies
               what security mode and algorithms the network uses.
               Supported values of this field are as follows:

                         +----+-----+-------------------+
                         | ID | Sec |     Algorithm     |
                         +----+-----+-------------------+
                         |  0 |  00 | CCM* with AES-128 |
                         |  1 |  01 |      Reserved     |
                         |  2 |  10 |      Reserved     |
                         |  3 |  11 |      Reserved     |
                         +----+-----+-------------------+

                           Security Mode (Sec) Encoding

         Key Identifier Mode (KIM):  The Key Identifier Mode field
               indicates whether the key used for packet protection is
               determined implicitly or explicitly and indicates the
               particular representation of the Key Identifier field.
               The Key Identifier Mode is set one of the non-reserved
               values from the table below:

          +------+-----+-----------------------------+------------+
          | Mode | KIM |           Meaning           |    Key     |
          |      |     |                             | Identifier |
          |      |     |                             |   Length   |
          |      |     |                             |  (octets)  |
          +------+-----+-----------------------------+------------+
          |  0   | 00  | Peer-to-peer Group key determined used.             |     0     1      |
          |      |     | implicitly from originator Key determined by Key Index |            |
          |      |     | and recipient of packet. field.                      |            |
          |      |     |                             |            |
          |      |     | Key Source is not present.  |            |
          |      |     | Key Index is not present.       |            |
          +------+-----+-----------------------------+------------+
          |  1   | 01  | Group Per-pair key determined used.          |     1     0      |
          |      |     | implicitly from Key Index determined by source    |            |
          |      |     | and side information. destination of packet.  |            |
          |      |     |                             |            |
          |      |     | Key Source is not present.  |            |
          |      |     | Key Index is not present.   |            |
          +------+-----+-----------------------------+------------+
          |  2   | 10  | Signature Group key used; group used.             |    0/9     9      |
          |      |     | key Key determined explicitly by Key Index |            |
          |      |     | if encryption used. and Key Source Identifier.  |            |
          |      |     |                             |            |
          |      |     | Key Source may be is present.      |            |
          |      |     | Key Index may be is present.       |            |
          +------+-----+-----------------------------+------------+
          |  3   | 11  | Node's signature key used.  |    0/9     |
          |      |     | If packet is encrypted,     |
          |      |     | group key used. Group key determined   |     9            |
          |      |     | explicitly from determined by Key Source Index and |            |
          |      |     | Identifier and Key Index. Source Identifier.      |            |
          |      |     |                             |            |
          |      |     | Key Source is may be present.  |            |
          |      |     | Key Index is may be present.   |            |
          +------+-----+-----------------------------+------------+

                          Key Identifier Mode (KIM) Encoding

         Security Level (LVL):  The Security Level field indicates the
               provided packet protection.  This value can be adapted on
               a per-packet basis and allows for varying levels of data
               authenticity and, optionally, for data confidentiality.
               When nontrivial protection is provided, replay protection
               is always provided.
               The KIM field indicates whether signatures are used.  The
               Security Level is set to one of the non-reserved values
               in the table below:

                          +--------------------+-------------------+

                     +---------------------------+--------------------+
                     |      Without Signatures   |   With Signatures  |
               +----+-----+-------------+------+-------------+-----+
          +----+-----+--------------------+------+--------------+-----+
          | ID | LVL |     Attributes     | Auth |  Attributes  | Sig |
          |    |     |                    | Len  |              | Len |
               +----+-----+-------------+------+-------------+-----+
          +----+-----+--------------------+------+--------------+-----+
          |  0 | 000 |    None      Reserved      |  0 N/A  |     None   Reserved   | 37 N/A |
          |  1 | 001 |   MIC-32       MAC-32       |  4   |    Sign-32   | 37 40  |
          |  2 | 010 |   MIC-64       MAC-64       |  8   |    Sign-64   | 45 44  |
          |  3 | 011 |    Rsvd      Reserved      | N/A  |      Rsvd   Sign-128   | N/A 52  |
          |  4 | 100 |     ENC      Reserved      |  0 N/A  |     ENC   Reserved   | 37 N/A |
          |  5 | 101 | ENC-MIC-32     ENC-MAC-32     |  4   |  ENC-Sign-32 | 41 40  |
          |  6 | 110 | ENC-MIC-64     ENC-MAC-64     |  8   |  ENC-Sign-64 | 45 44  |
          |  7 | 111 |    Rsvd      Reserved      | N/A  |   Reserved ENC-Sign-128 | N/A 52  |
               +----+-----+-------------+------+-------------+-----+
          +----+-----+--------------------+------+-------------+------+

                         Security Level (LVL) Encoding

   Counter:  The Counter field indicates the non-repeating value (nonce)
         used with the cryptographic mechanism that implements packet
         protection and allows for the provision of semantic security.
         This value is compressed from 4 octets to 1 octet if the
         Counter Compression field of the Security Control Field is set
         to one.

   Message Authentication Code:  The Message Authentication Code field
         contains a cryptographic MAC.  The length of the MAC is defined
         by a combination of the LVL and Sec fields: it can be 0, 4, or
         8 octets long.  In the case of Security Modes where the MAC is
         computed as part of the ciphertext (as in Security Mode 0,
         CCM*), the MAC field is zero bytes long.

   Key Identifier:  The Key Identifier field indicates which key was
         used to protect the packet.  This field provides various levels
         of granularity of packet protection, including peer-to-peer
         keys, group keys, and signature keys.  This field is
         represented as indicated by the Key Identifier Mode field and
         is formatted as follows:

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                                                               |
       .                          Key Source                           .
       .                                                               .
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                                                               |
       .                           Key Index                           .
       .                                                               .
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                            Figure 8: Key Identifier

         Key Source:  The Key Source field, when present, indicates the
               logical identifier of the originator of a group key.
               When present this field is 8 bytes in length.

         Key Index:  The Key Index field, when present, allows unique
               identification of different keys with the same
               originator.  It is the responsibility of each key
               originator to make sure that actively used keys that it
               issues have distinct key indices and that all key indices
               have a value unequal to 0x00.  Value 0x00 is reserved for
               a pre-installed, shared key.  When present this field is
               1 byte in length.

   Unassigned bits of the Security section are reserved.  They MUST be
   set to zero on transmission and MUST be ignored on reception.

5.2.  DODAG Information Solicitation (DIS)

   The DODAG Information Solicitation (DIS) message may be used to
   solicit a DODAG Information Object from a RPL node.  Its use is
   analogous to that of a Router Solicitation as specified in IPv6
   Neighbor Discovery; a node may use DIS to probe its neighborhood for
   nearby DODAGs.  Section 6.3 7.3 describes how nodes respond to a DIS.

5.2.1.  Format of the DIS Base Object

        0                   1                   2
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |           Reserved            |   Option(s)...
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                       Figure 7: 9: The DIS Base Object

   Unassigned bits of the DIS Base are reserved.  They MUST be set to
   zero on transmission and MUST be ignored on reception.

5.2.2.  Secure DIS

   A Secure DIS message follows the format in Figure Figure 6, where the
   base format is the DIS message shown in Figure Figure 7. 9.

5.2.3.  DIS Options

   The DIS message MAY carry valid options.

   This specification allows for the DIS message to carry the following
   options:
      0x00 Pad1
      0x01 PadN
      0x05 RPL Target
      0x07 Solicited Information

5.3.  DODAG Information Object (DIO)

   The DODAG Information Object carries information that allows a node
   to discover a RPL Instance, learn its configuration parameters,
   select a DODAG parent set, and maintain the upward routing topology.

5.3.1.  Format of the DIO Base Object

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       | RPLInstanceID |    Version    |             Rank              |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |G|A|T|MOP| Prf |     DTSN      |           Reserved            |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                                                               |
       +                                                               +
       |                                                               |
       +                            DODAGID                            +
       |                                                               |
       +                                                               +
       |                                                               |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |   Option(s)...
       +-+-+-+-+-+-+-+-+
                      Figure 8: 10: The DIO Base Object

   Control Field:  The DAG Control Field has three flags and two fields:

         Grounded (G):  The Grounded (G) flag indicates whether the
               upward routes this node advertises provide connectivity
               to the set of addresses which are application-defined
               goals.  If the flag is set, the DODAG is grounded and
               provides such connectivity.  If the flag is cleared, the
               DODAG is floating and may not provide such connectivity.

         Destination Advertisement Supported (A):  The Destination
               Advertisement Supported (A) flag indicates whether the
               root of this DODAG can collect and use downward route
               state.  If the flag is set, nodes in the network are
               enabled to exchange destination advertisements messages
               to build downward routes (Section 7). 8).  If the flag is
               cleared, destination advertisement messages are disabled
               and the DODAG maintains only upward routes.

         Destination Advertisement Trigger (T):  The Destination
               Advertisement Trigger (T) flag indicates a complete
               refresh of downward routes.  If the flag is set, then a
               refresh of downward route state is to take place over the
               entire DODAG.  If the flag is cleared, the downward route
               maintenance is in its normal mode of operation.  The
               further details of this process are described in
               Section 7. 8.

         Mode of Operation (MOP):  The Mode of Operation (MOP) field
               identifies the mode of operation of the RPL Instance as
               administratively provisioned at and distributed by the
               DODAG Root.  All nodes who join the DODAG must be able to
               honor the MOP in order to fully participate as a router,
               or else they must only join as a leaf.  MOP is encoded as
               in the table below:

               +-----+-------------------------------------------------+
               | MOP | Meaning                                         |
               +-----+-------------------------------------------------+
               |  00 | Non-storing                                     |
               |  01 | Storing                                         |
               |  10 | Reserved for future specification of mixed-mode                                        |
               |  11 | Reserved                                        |
               +-----+-------------------------------------------------+

                           Mode of Operation (MOP) Encoding

         DODAGPreference (Prf):  A 3-bit unsigned integer that defines
               how preferable the root of this DODAG is compared to
               other DODAG roots within the instance.  DAGPreference
               ranges from 0x00 (least preferred) to 0x07 (most
               preferred).  The default is 0 (least preferred).
               Section 6.2 7.2 describes how DAGPreference affects DIO
               processing.

   Version Number:  8-bit unsigned integer set by the DODAG root.
         Section 6.2 7.2 describes the rules for version numbers and how
         they affect DIO processing.

   Rank: 16-bit unsigned integer indicating the DODAG rank of the node
         sending the DIO message.  Section 6.2 7.2 describes how Rank is set
         and how it affects DIO processing.

   RPLInstanceID:  8-bit field set by the DODAG root that indicates
         which RPL Instance the DODAG is part of.

   Destination Advertisement Trigger Sequence Number (DTSN):  8-bit
         unsigned integer set by the node issuing the DIO message.  The
         Destination Advertisement Trigger Sequence Number (DTSN) flag
         is used as part of the procedure to maintain downward routes.
         The details of this process are described in Section 7. 8.

   DODAGID:  128-bit unsigned integer set by a DODAG root which uniquely
         identifies a DODAG.  Possibly derived from the IPv6 address of
         the DODAG root.

   Unassigned bits of the DIO Base are reserved.  They MUST be set to
   zero on transmission and MUST be ignored on reception.

5.3.2.  Secure DIO

   A Secure DIO message follows the format in Figure Figure 6, where the
   base format is the DIS message shown in Figure Figure 8. 10.

5.3.3.  DIO Options

   The DIO message MAY carry valid options.

   This specification allows for the DIO message to carry the following
   options:
      0x00 Pad1
      0x01 PadN
      0x02 Metric Container
      0x03 Routing Information
      0x04 DODAG Configuration
      0x09 Prefix Information

5.4.  Destination Advertisement Object (DAO)

   The Destination Advertisement Object (DAO) is used to propagate
   destination information upwards along the DODAG.  The DAO message is
   unicast by the child to the selected parent(s).  The DAO message may
   optionally, upon explicit request or error, be acknowledged by the
   parent with a Destination Advertisement Acknowledgement (DAO-ACK)
   message back to the child.

5.4.1.  Format of the DAO Base Object

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       | RPLInstanceID |K|D|         Reserved          | DAOSequence   |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                                                               |
       +                                                               +
       |                                                               |
       +                            DODAGID*                           +
       |                                                               |
       +                                                               +
       |                                                               |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |   Option(s)...
       +-+-+-+-+-+-+-+-+

                      Figure 9: 11: The DAO Base Object

   RPLInstanceID:  8-bit field indicating the topology instance
         associated with the DODAG, as learned from the DIO.

   K:    The 'K' flag indicates that the parent is expected to send a
         DAO-ACK back.

   D:    The 'D' flag indicates that the DODAGID field is present.  This
         would typically only be set when a local RPLInstanceID is used.

   DAOSequence:  Incremented at each unique DAO message, echoed in the
         DAO-ACK message.

   DODAGID*:

   DODAGID (optional):  128-bit unsigned integer set by a DODAG root
         which uniquely identifies a DODAG.  This field is only present
         when the 'D' flag is set.  This field is typically only present
         when a local RPLInstanceID is in use, in order to identify the
         DODAGID that is associated with the RPLInstanceID.  When a
         global RPLInstanceID is in use this field need not be present.

   Unassigned bits of the DAO Base are reserved.  They MUST be set to
   zero on transmission and MUST be ignored on reception.

5.4.2.  Secure DAO

   A Secure DAO message follows the format in Figure Figure 6, where the
   base format is the DAO message shown in Figure Figure 9. 11.

5.4.3.  DAO Options

   The DAO message MAY carry valid options.

   This specification allows for the DAO message to carry the following
   options:
      0x00 Pad1
      0x01 PadN
      0x05 RPL Target
      0x06 Transit Information

   A special case of the DAO message, termed a No-Path, is used to clear
   downward routing state that has been provisioned through DAO
   operation.  The No-Path carries a RPL Transit Information option,
   which identifies the destination to which the DAO is associated, with
   a lifetime of 0x00000000 to indicate a loss of reachability.

5.5.  Destination Advertisement Object Acknowledgement (DAO-ACK)

   The DAO-ACK message is sent as a unicast packet by a DAO parent in
   response to a unicast DAO message from a child.

5.5.1.  Format of the DAO-ACK Base Object
        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       | RPLInstanceID | |D|  Reserved   | DAOSequence   |   Status      |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                                                               |
       +                                                               +
       |                                                               |
       +                            DODAGID*                           +
       |                                                               |
       +                                                               +
       |                                                               |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |   Option(s)...
       +-+-+-+-+-+-+-+-+

                    Figure 10: 12: The DAO ACK Base Object

   RPLInstanceID:  8-bit field indicating the topology instance
         associated with the DODAG, as learned from the DIO.

   DAOSequence:  Incremented at each DAO message from a given child,
         echoed in the DAO-ACK by the parent.

   D:    The DAOSequence serves in
         the 'D' flag indicates that the DODAGID field is present.  This
         would typically only be set when a local RPLInstanceID is used.

   DAOSequence:  Incremented at each DAO message from a given child,
         echoed in the DAO-ACK by the parent.  The DAOSequence serves in
         the parent-child communication and is not to be confused with
         the Transit Information option Sequence that is associated to a
         given target down the DODAG.

   Status:  Indicates the completion. 0 is unqualified acceptance, above
         128 are rejection code indicating that the node should select
         an alternate parent.

   DODAGID (optional):  128-bit unsigned integer set by a DODAG root
         which uniquely identifies a DODAG.  This field is only present
         when the 'D' flag is set.  This field is typically only present
         when a local RPLInstanceID is in use, in order to identify the
         DODAGID that is associated with the RPLInstanceID.  When a
         global RPLInstanceID is in use this field need not be present.

   Unassigned bits of the DAO-ACK Base are reserved.  They MUST be set
   to zero on transmission and MUST be ignored on reception.

5.5.2.  Secure DAO-ACK

   A Secure DAO-ACK message follows the format in Figure Figure 6, where
   the base format is the DAO-ACK message shown in Figure Figure 10. 12.

5.5.3.  DAO-ACK Options

   This specification does not define any options to be carried by the
   DAO-ACK message.

5.6.  RPL Control Message Options  Consistency Check (CC)

   The CC message is used to check secure message counters and issue
   challenge/responses.

5.6.1.  RPL Control Message Option Generic  Format

   RPL Control Message Options all follow this format: of the CC Base Object

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - - 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |  Option Type RPLInstanceID |R|    Reserved   | Option Length           Nonce             | Option Data
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - -
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                                                               |
       +                                                               +
       |                                                               |
       +                            DODAGID                            +
       |                                                               |
       +                                                               +
       |                                                               |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |   Option(s)...
       +-+-+-+-+-+-+-+-+

                       Figure 11: RPL Option Generic Format

   Option Type:  8-bit identifier of the type of option. 13: The Option
         Type values are to be confirmed by the IANA Section 15.4.

   Option Length: CC Base Object

   RPLInstanceID:  8-bit unsigned integer, representing field indicating the length in
         octets of topology instance
         associated with the option, not including DODAG, as learned from the Option Type and Length
         fields.

   Option Data:  A DIO.

   R:    The 'R' flag indicates whether the CC message is a response.  A
         message with the 'R' flag cleared is a request; a message with
         the 'R' flag set is a response.  A CC message with the R bit
         set MUST NOT compress the security Counter field: the C bit of
         the security section MUST be 0.

   Nonce:  16-bit unsigned integer set by a CC request.  The
         corresponding CC response includes the same nonce value as the
         request.

   Unassigned bits of the CC Base are reserved.  They MUST be set to
   zero on transmission and MUST be ignored on reception.

5.6.2.  CC Options

   The CC message MAY carry valid options.  In the scope of this
   specification, there are no valid options for a CC message.

   This specification allows for the CC message to carry the following
   options:
      0x00 Pad1
      0x01 PadN

5.7.  RPL Control Message Options

5.7.1.  RPL Control Message Option Generic Format

   RPL Control Message Options all follow this format:

        0                   1                   2
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - -
       |  Option Type  | Option Length | Option Data
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - -

                   Figure 14: RPL Option Generic Format

   Option Type:  8-bit identifier of the type of option.  The Option
         Type values are to be confirmed by the IANA Section 17.4.

   Option Length:  8-bit unsigned integer, representing the length in
         octets of the option, not including the Option Type and Length
         fields.

   Option Data:  A variable length field that contains data specific to
         the option.

   When processing a RPL message containing an option for which the
   Option Type value is not recognized by the receiver, the receiver
   MUST silently ignore the unrecognized option and continue to process
   the following option, correctly handling any remaining options in the
   message.

   RPL message options may have alignment requirements.  Following the
   convention in IPv6, options with alignment requirements are aligned
   in a packet such that multi-octet values within the Option Data field
   of each option fall on natural boundaries (i.e., fields of width n
   octets are placed at an integer multiple of n octets from the start
   of the header, for n = 1, 2, 4, or 8).

5.6.2.

5.7.2.  Pad1

   The Pad1 option may be present in DIS, DIO, DAO, and DAO-ACK
   messages, and its format is as follows:

        0
        0 1 2 3 4 5 6 7
       +-+-+-+-+-+-+-+-+
       |   Type = 0    |
       +-+-+-+-+-+-+-+-+

                   Figure 12: 15: Format of the Pad 1 Option

   The Pad1 option is used to insert one or two octets of padding into
   the message to enable options alignment.  If more than one octet of
   padding is required, the PadN option should be used rather than
   multiple Pad1 options.

   NOTE! the format of the Pad1 option is a special case - it has
   neither Option Length nor Option Data fields.

5.6.3.

5.7.3.  PadN

   The PadN option may be present in DIS, DIO, DAO, and DAO-ACK
   messages, and its format is as follows:

        0                   1                   2
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - -
       |   Type = 1    | Option Length | 0x00 Padding...
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - -

                   Figure 13: 16: Format of the Pad N Option

   The PadN option is used to insert two or more octets of padding into
   the message to enable options alignment.  PadN Option data MUST be
   ignored by the receiver.

   Option Type:  0x01 (to be confirmed by IANA)

   Option Length:  For N (N > 1) octets of padding, the Option Length
         field contains the value N-2.

   Option Data:  For N (N > 1) octets of padding, the Option Data
         consists of N-2 zero-valued octets.

5.6.4.

5.7.4.  Metric Container

   The Metric Container option may be present in DIO messages, and its
   format is as follows:

        0                   1                   2
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - -
       |   Type = 2    | Option Length | Metric Data
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - -

             Figure 14: 17: Format of the Metric Container Option

   The Metric Container is used to report metrics along the DODAG.  The
   Metric Container may contain a number of discrete node, link, and
   aggregate path metrics and constraints specified in
   [I-D.ietf-roll-routing-metrics] as chosen by the implementer.

   The processing and propagation of the Metric Container is MAY appear more than once in the same RPL
   control message, for example to accommodate a use case where the
   Metric Data is longer than 256 bytes.  More information is in
   [I-D.ietf-roll-routing-metrics]

   The processing and propagation of the Metric Container is governed by
   implementation specific policy functions.

   Option Type:  0x02 (to be confirmed by IANA)

   Option Length:  The Option Length field contains the length in octets
         of the Metric Data.

   Metric Data:  The order, content, and coding of the Metric Container
         data is as specified in [I-D.ietf-roll-routing-metrics].

5.6.5.

5.7.5.  Route Information

   The Route Information option may be present in DIO messages, and is
   equivalent in function to the IPv6 ND Route Information option as
   defined in [RFC4191].  The format of the option is modified slightly
   (Type, Length) in order to be carried as a RPL option as follows:

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |   Type = 3    | Option Length | Prefix Length |Resvd|Prf|Resvd|
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                        Route Lifetime                         |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                                                               |
       .                   Prefix (Variable Length)                    .
       .                                                               .
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

             Figure 15: 18: Format of the Route Information Option

   The Route Information option is used to indicate that connectivity to
   the specified destination prefix is available from the DODAG root.

   In the event that a RPL Control Message may need to specify
   connectivity to more than one destination, the Route Information
   option may be repeated.

   [RFC4191] should be consulted as the authoritative reference with
   respect to the Route Information option.  The field descriptions are
   transcribed here for convenience:

   Option Type:  0x03 (to be confirmed by IANA)

   Option Length:  Variable, length of the option in octets excluding
         the Type and Length fields.  Note that this length is expressed
         in units of single-octets, unlike in IPv6 ND.

   Prefix Length  8-bit unsigned integer.  The number of leading bits in
         the Prefix that are valid.  The value ranges from 0 to 128.
         The Prefix field is 0, 8, or 16 octets depending on Length.

   Prf:  2-bit signed integer.  The Route Preference indicates whether
         to prefer the router associated with this prefix over others,
         when multiple identical prefixes (for different routers) have
         been received.  If the Reserved (10) value is received, the
         Route Information Option MUST be ignored.

   Resvd:  Two 3-bit unused fields.  They MUST be initialized to zero by
         the sender and MUST be ignored by the receiver.

   Route Lifetime  32-bit unsigned integer.  The length of time in
         seconds (relative to the time the packet is sent) that the
         prefix is valid for route determination.  A value of all one
         bits (0xffffffff) represents infinity.

   Prefix  Variable-length field containing an IP address or a prefix of
         an IP address.  The Prefix Length field contains the number of
         valid leading bits in the prefix.  The bits in the prefix after
         the prefix length (if any) are reserved and MUST be initialized
         to zero by the sender and ignored by the receiver.

   Unassigned bits of the Route Information option are reserved.  They
   MUST be set to zero on transmission and MUST be ignored on reception.

5.6.6.

5.7.6.  DODAG Configuration

   The DODAG Configuration option may be present in DIO messages, and
   its format is as follows:

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |   Type = 4    | Option Length |  Resvd  | Resrvd|A| PCS | DIOIntDoubl.  |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |  DIOIntMin.   |   DIORedun.   |        MaxRankIncrease        |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |      MinHopRankIncrease       |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+              OCP              |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

            Figure 16: 19: Format of the DODAG Configuration Option

   The DODAG Configuration option is used to distribute configuration
   information for DODAG Operation through the DODAG.

   The information communicated in this option is generally static and
   unchanging within the DODAG, therefore it is not necessary to include
   in every DIO.  This information is configured at the DODAG Root and
   distributed throughout the DODAG with the DODAG Configuration Option.
   Nodes other than the DODAG Root MUST NOT modify this information when
   propagating the DODAG Configuration option.  This option MAY be
   included occasionally by the DODAG Root (as determined by the DODAG
   Root), and MUST be included in response to a unicast request, e.g. a
   unicast DODAG Information Solicitation (DIS) message.

   Option Type:  0x04 (to be confirmed by IANA)

   Option Length:  8 bytes

   Authentication Enabled (A):  One bit describing the security mode of
         the network.  The bit describe whether a node must authenticate
         with a key authority before joining the network as a router.
         If the DIO is not a secure DIO, the 'A' bit MUST be zero.

   Path Control Size (PCS):  3-bit unsigned integer used to configure
         the number of bits that may be allocated to the Path Control
         field (see Section 7.1.4.2). 8.9).

   DIOIntervalDoublings:  8-bit unsigned integer used to configure Imax
         of the DIO trickle timer (see Section 6.3.1). 7.3.1).

   DIOIntervalMin:  8-bit unsigned integer used to configure Imin of the
         DIO trickle timer (see Section 6.3.1). 7.3.1).

   DIORedundancyConstant:  8-bit unsigned integer used to configure k of
         the DIO trickle timer (see Section 6.3.1). 7.3.1).

   MaxRankIncrease:  16-bit unsigned integer used to configure
         DAGMaxRankIncrease, the allowable increase in rank in support
         of local repair.  If DAGMaxRankIncrease is 0 then this
         mechanism is disabled.

   MinHopRankInc  16-bit unsigned integer used to configure
         MinHopRankIncrease as described in Section 3.5.2.1.

5.6.7. 3.6.2.1.

   Objective Code Point (OCP)  16-bit unsigned integer.  The OCP field
         identifies the OF and is managed by the IANA.

5.7.7.  RPL Target

   The RPL Target option may be present in DAO messages, and its format is as follows:

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |   Type = 5    | Option Length |   Reserved    | Prefix Length |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                                                               |
       +                                                               +
       |                Target Prefix (Variable Length)                |
       .                                                               .
       .                                                               .
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                Figure 17: 20: Format of the RPL Target Option

   The RPL Target Option is used to indicate a target IPv6 address,
   prefix, or multicast group that is reachable or queried along the
   DODAG.  It is used in DIO to identify  In a DIO, the RPL Target Option identifies a resource that
   the root is trying to reach, and in a DAO to indicate reachability.  It is used
   in reach.  In a DAO message to indicate DAO, the RPL Target option
   indicates reachability.

   A set of one or more Transit Information options MAY directly follow
   the Target option in a DAO message in support of constructing source
   routes in a non-
   storing non-storing mode of operation
   [I-D.hui-6man-rpl-routing-header].  When the same set of Transit
   Information options apply equally to a set of DODAG Target options,
   the group of Target options MUST appear first, followed by the
   Transit Information options which apply to those Targets.

   The RPL Target option may be repeated as necessary to indicate
   multiple targets.

   Option Type:  0x05 (to be confirmed by IANA)

   Option Length:  Variable, length of the option in octets excluding
         the Type and Length fields.

   Prefix Length:  8-bit unsigned integer.  Number of valid leading bits
         in the IPv6 Prefix.

   Target Prefix:  Variable-length field identifying an IPv6 destination
         address, prefix, or multicast group.  The Prefix Length field
         contains the number of valid leading bits in the prefix.  The
         bits in the prefix after the prefix length (if any) are
         reserved and MUST be set to zero on transmission and MUST be
         ignored on receipt.

5.6.8.

5.7.8.  Transit Information

   The Transit Information option may be present in DAO messages, and
   its format is as follows:

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |   Type = 6    | Option Length | Path Sequence | Path Control  |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                        Path Lifetime                          |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                                                               |
       +                                                               +
       |                                                               |
       +                        Parent Address*                        +
       |                                                               |
       +                                                               +
       |                                                               |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
            Figure 18: 21: Format of the Transit Information option

   The Transit Information option is used for a node to indicate
   attributes for a path to one or more destinations.  The destinations
   are indicated as by one or more Target options that immediately
   precede the Transit Information option(s).

   The Transit Information option can used for a node to indicate its
   DODAG parents to an ancestor that is collecting DODAG routing
   information, typically for the purpose of constructing source routes.
   In the non-storing mode of operation this ancestor will be the DODAG
   Root, and this option is carried by the DAO message.  The option
   length is used to determine whether the Parent Address is present or
   not.

   A non-storing node that has more than one DAO parent MAY include a
   Transit Information option for each DAO parent as part of the non-
   storing Destination Advertisement operation.  The node may code the
   Path Control field in order to signal a preference among parents.

   One or more Transit Information options MUST be preceded by one or
   more RPL Target options.  In this manner the RPL Target option
   indicates the child node, and the Transit Information option(s)
   enumerate the DODAG parents.

   A typical non-storing node will use multiple Transit Information
   options, and it will send the DAO thus formed to only one parent that
   will forward it to the root.  A typical storing node with use one
   Transit Information option with no parent field, and will send the
   DAO thus formed to multiple parents.

   Option Type:  0x06 (to be confirmed by IANA)

   Option Length:  Variable, depending on whether or not Parent Address
         is present.

   Path-Sequence:  8-bit unsigned integer.  When a RPL Target option is
         issued by the node that owns the Target Prefix (i.e. in a DAO
         message), that node sets the Path-Sequence and increments the
         Path-Sequence each time it issues a RPL Target option.

   Path Control:  8-bit bitfield.  The Path Control field limits the
         number of DAO-Parents to which a DAO message advertising
         connectivity to a specific destination may be sent, as well as
         providing some indication of relative preference.  The limit
         provides some bound on overall DAO fan-out in the LLN.  The
         leftmost bit is associated with a path that contains a most-
         preferred link, and the subsequent bits are ordered down to the
         rightmost bit which is least preferred.

   Path Lifetime:  32-bit unsigned integer.  The length of time in
         seconds (relative to the time the packet is sent) that the
         prefix is valid for route determination.  A value of all one
         bits (0xFFFFFFFF) represents infinity.  A value of all zero
         bits (0x00000000) indicates a loss of reachability.  This is
         referred as a No-Path in this document.

   Parent Address (optional):  IPv6 Address of the DODAG Parent of the
         node originally issuing the Transit Information Option.  This
         field may not be present, as according to the DODAG Mode of
         Operation and indicated by the Transit Information option
         length.

   Unassigned bits of the Transit Information option are reserved.  They
   MUST be set to zero on transmission and MUST be ignored on reception.

5.6.9.

5.7.9.  Solicited Information

   The Solicited Information option may be present in DIS messages, and
   its format is as follows:

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |   Type = 7    | Option Length | RPLInstanceID |V|I|D|  Rsvd   |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                                                               |
       +                                                               +
       |                                                               |
       +                            DODAGID                            +
       |                                                               |
       +                                                               +
       |                                                               |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |    Version    |
       +-+-+-+-+-+-+-+-+

           Figure 19: 22: Format of the Solicited Information Option

   The Solicited Information option is used for a node to request DIO
   messages from a subset of neighboring nodes that meet the specified criteria to
   respond to a DIS message. nodes.  The Solicited
   Information option may specify a number of predicate criteria to be
   matched by a receiving node.  If  These predicates affect whether a node receiving a
   multicast DIS message containing a Solicited Information option
   matches ALL of the predicates, then it MUST reset
   resets its trickle timer
   in order to trigger a DIO response to the DIS message.  When a node
   receives a DIS message containing a Solicited information option, and
   the DIS message is unicast OR the node does not match ALL the
   predicates, then the node MUST NOT reset the trickle timer. timer, as described in Section 7.3
   Option Type:  0x07 (to be confirmed by IANA)

   Option Length:  19 bytes

   Control Field:  The Solicited Information option Control Field has
         three flags:

         V:    If the V flag is set then the Version field is valid and
               a node should only respond matches the predicate if its DODAGVersionNumber
               matches the requested version.  If the V flag is clear
               then the Version field is not valid and the Version field
               MUST be set to zero on transmission and ignored upon
               receipt.

         I:    If the I flag is set then the RPLInstanceID field is
               valid and a node should only respond if it matches the predicate if it matches the
               requested RPLInstanceID.  If the I flag is clear then the
               RPLInstanceID field is not valid and the RPLInstanceID
               field MUST be set to zero on transmission and ignored
               upon receipt.

         D:    If the D flag is set then the DODAGID field is valid and
               a node should only respond matches the predicate if it matches the requested
               DODAGID.  If the D flag is clear then the DODAGID field
               is not valid and the DODAGID field MUST be set to zero on
               transmission and ignored upon receipt.

   Version:  8-bit unsigned integer containing the DODAG Version number
         that is being solicited when valid.

   RPLInstanceID:  8-bit unsigned integer containing the RPLInstanceID
         that is being solicited when valid.

   DODAGID:  128-bit unsigned integer containing the DODAGID that is
         being solicited when valid.

   Unassigned bits of the Solicited Information option are reserved.
   They MUST be set to zero on transmission and MUST be ignored on
   reception.

5.6.10.

5.7.10.  Prefix Information

   The Prefix Information option may be present in DIO messages, and is
   equivalent in function to the IPv6 ND Prefix Information option as
   defined in [RFC4861].  The format of the option is modified slightly
   (Type, Length) in order to be carried as a RPL option as follows:

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |   Type = 8    | Option Length | Prefix Length |L|A| Reserved1 |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                         Valid Lifetime                        |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                       Preferred Lifetime                      |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                           Reserved2                           |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                                                               |
       +                                                               +
       |                                                               |
       +                            Prefix                             +
       |                                                               |
       +                                                               +
       |                                                               |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

            Figure 20: 23: Format of the Prefix Information Option

   The Prefix Information option may be used to distribute the prefix in
   use inside the DODAG, e.g. for address autoconfiguration.

   [RFC4861] should be consulted as the authoritative reference with
   respect to the Prefix Information option.  The field descriptions are
   transcribed here for convenience:

   Option Type:  0x08 (to be confirmed by IANA)

   Option Length:  30.  Note that this length is expressed in units of
         single-octets, unlike in IPv6 ND.

   Prefix Length  8-bit unsigned integer.  The number of leading bits in
         the Prefix that are valid.  The value ranges from 0 to 128.
         The prefix length field provides necessary information for on-
         link determination (when combined with the L flag in the prefix
         information option).  It also assists with address
         autoconfiguration as specified in [RFC4862], for which there
         may be more restrictions on the prefix length.

   L     1-bit on-link flag.  When set, indicates that this prefix can
         be used for on-link determination.  When not set the
         advertisement makes no statement about on-link or off-link
         properties of the prefix.  In other words, if the L flag is not
         set a host MUST NOT conclude that an address derived from the
         prefix is off-link.  That is, it MUST NOT update a previous
         indication that the address is on-link.

   A     1-bit autonomous address-configuration flag.  When set
         indicates that this prefix can be used for stateless address
         configuration as specified in [RFC4862].

   Reserved1  6-bit unused field.  It MUST be initialized to zero by the
         sender and MUST be ignored by the receiver.

   Valid Lifetime  32-bit unsigned integer.  The length of time in
         seconds (relative to the time the packet is sent) that the
         prefix is valid for the purpose of on-link determination.  A
         value of all one bits (0xffffffff) represents infinity.  The
         Valid Lifetime is also used by [RFC4862].

   Preferred Lifetime  32-bit unsigned integer.  The length of time in
         seconds (relative to the time the packet is sent) that
         addresses generated from the prefix via stateless address
         autoconfiguration remain preferred [RFC4862].  A value of all
         one bits (0xffffffff) represents infinity.  See [RFC4862].
         Note that the value of this field MUST NOT exceed the Valid
         Lifetime field to avoid preferring addresses that are no longer
         valid.

   Reserved2  This field is unused.  It MUST be initialized to zero by
         the sender and MUST be ignored by the receiver.

   Prefix  An IP address or a prefix of an IP address.  The Prefix
         Length field contains the number of valid leading bits in the
         prefix.  The bits in the prefix after the prefix length are
         reserved and MUST be initialized to zero by the sender and
         ignored by the receiver.  A router SHOULD NOT send a prefix
         option for the link-local prefix and a host SHOULD ignore such
         a prefix option.

   Unassigned bits of the Prefix Information option are reserved.  They
   MUST be set to zero on transmission and MUST be ignored on reception.

6.  Sequence Counters

   RPL makes use of sequence counters for the DODAGVersionNumber in the
   DIO message, the DAOSequence in the DAO message, and the Path-
   Sequence in the Transit Information option.

   This section describes the general scheme for bootstrap and operation
   of sequence counters in RPL.  The general operations described here
   are to applied to RPL's various sequence counters as enumerated
   above.

   RPL sequence counters are subdivided in a 'lollipop' fashion
   ([Perlman83]), where the values from 0 to 15 are used as a short
   linear sequence to indicate a restart and bootstrap the counter, and
   the remaining values are used as a circular sequence number space as
   in [RFC1982].

   When a sequence counter is initialized, if the node has no other
   basis of persistence for that counter, then the sequence counter is
   initialized to zero.

   When a sequence counter increments past its maximum value, the
   sequence counter wraps back to 16 instead of zero.

   When two sequence counters to be compared are both in [0..15] (the
   'straight' part of the lollipop), a normal arithmetic comparison is
   applied for greater than, less than, and equal.

   When a first sequence counter is in [0..15], and a second sequence
   counter to be compared is >15, then the first sequence counter is
   taken to be fresher, and thus greater, than the second.  The second
   sequence counter is less than the first, and the two are not equal.

   When two sequence counters to be compared are both outside of [0..15]
   (the 'circular' part of the lollipop), a comparison as described in
   [RFC1982] may be used to determine the relationships greater than,
   less than, and equal, with the modification that the sequence
   counters should be compared as if the minimum value is 16 and not 0.

7.  Upward Routes

   This section describes how RPL discovers and maintains upward routes.
   It describes the use of DODAG Information Objects (DIOs), the
   messages used to discover and maintain these routes.  It specifies
   how RPL generates and responds to DIOs.  It also describes DODAG
   Information Solicitation (DIS) messages, which are used to trigger
   DIO transmissions.

6.1.

7.1.  DIO Base Rules

   1.  If the 'A' flag of a DIO Base is cleared, the 'T' flag MUST also
       be cleared.

   2.  For the following DIO Base fields, a node that is not a DODAG
       root MUST advertise the same values as its preferred DODAG parent
       (defined in Section 6.2.1). 7.2.1).  Therefore, if a DODAG root does not
       change these values, every node in a route to that DODAG root
       eventually advertises the same values for these fields.  These
       fields are:
       1.  Grounded (G)
       2.  Destination Advertisement Supported (A)
       3.  Destination Advertisement Trigger (T)
       4.  DAGPreference (Prf)  Mode of Operation (MOP)
       5.  Version  DAGPreference (Prf)
       6.  RPLInstanceID  Version
       7.  RPLInstanceID
       8.  DODAGID

   3.  A node MAY update the following fields at each hop:
       1.  Destination Advertisements Stored (S)  Rank
       2.  DAGRank
       3.  DTSN

   4.  The DODAGID field each root sets MUST be unique within the RPL
       Instance.

6.2.

7.2.  Upward Route Discovery and Maintenance

   Upward route discovery allows a node to join a DODAG by discovering
   neighbors that are members of the DODAG of interest and identifying a
   set of parents.  The exact policies for selecting neighbors and
   parents is implementation-dependent and driven by the OF.  This
   section specifies the set of rules those policies must follow for
   interoperability.

6.2.1.

7.2.1.  Neighbors and Parents within a DODAG Version

   RPL's upward route discovery algorithms and processing are in terms
   of three logical sets of link-local nodes.  First, the candidate
   neighbor set is a subset of the nodes that can be reached via link-
   local multicast.  The selection of this set is implementation-
   dependent and OF-dependent.  Second, the parent set is a restricted
   subset of the candidate neighbor set.  Finally, the preferred parent,
   a set of size one, is an element of the parent set that is the
   preferred next hop in upward routes.

   More precisely:

   1.  The DODAG parent set MUST be a subset of the candidate neighbor
       set.

   2.  A DODAG root MUST have a DODAG parent set of size zero.

   3.  A node that is not a DODAG root MAY maintain a DODAG parent set
       of size greater than or equal to one.

   4.  A node's preferred DODAG parent MUST be a member of its DODAG
       parent set.

   5.  A node's rank MUST be greater than all elements of its DODAG
       parent set.

   6.  When Neighbor Unreachability Detection (NUD), or an equivalent
       mechanism, determines that a neighbor is no longer reachable, a
       RPL node MUST NOT consider this node in the candidate neighbor
       set when calculating and advertising routes until it determines
       that it is again reachable.  Routes through an unreachable
       neighbor MUST be removed from the routing table.

   These rules ensure that there is a consistent partial order on nodes
   within the DODAG.  As long as node ranks do not change, following the
   above rules ensures that every node's route to a DODAG root is loop-
   free, as rank decreases on each hop to the root.

   The OF can guide candidate neighbor set and parent set selection, as
   discussed in [I-D.ietf-roll-routing-metrics] and [I-D.ietf-roll-of0].

6.2.2.

7.2.2.  Neighbors and Parents across DODAG Versions

   The above rules govern a single DODAG version.  The rules in this
   section define how RPL operates when there are multiple DODAG
   versions:

6.2.2.1.

7.2.2.1.  DODAG Version

   1.  The tuple (RPLInstanceID, DODAGID, DODAGVersionNumber) uniquely
       defines a DODAG Version.  Every element of a node's DODAG parent
       set, as conveyed by the last heard DIO message from each DODAG
       parent, MUST belong to the same DODAG version.  Elements of a
       node's candidate neighbor set MAY belong to different DODAG
       Versions.

   2.  A node is a member of a DODAG version if every element of its
       DODAG parent set belongs to that DODAG version, or if that node
       is the root of the corresponding DODAG.

   3.  A node MUST NOT send DIOs for DODAG versions of which it is not a
       member.

   4.  DODAG roots MAY increment the DODAGVersionNumber that they
       advertise and thus move to a new DODAG version.  When a DODAG
       root increments its DODAGVersionNumber, it MUST follow the
       conventions of Serial Number Arithmetic as described in
       [RFC1982].
       Section 6.

   5.  Within a given DODAG, a node that is a not a root MUST NOT
       advertise a DODAGVersionNumber higher than the highest
       DODAGVersionNumber it has heard.  Higher is defined as the
       greater-than operator in [RFC1982]. Section 6.

   6.  Once a node has advertised a DODAG version by sending a DIO, it
       MUST NOT be member of a previous DODAG version of the same DODAG
       (i.e. with the same RPLInstanceID, the same DODAGID, and a lower
       DODAGVersionNumber).  Lower is defined as the less-than operator
       in [RFC1982].

   Within a particular implementation, a DODAG root may increment the
   DODAGVersionNumber periodically, at a rate that depends on the
   deployment, in order to trigger a global reoptimization of the DODAG.
   In other implementations, loop detection may be considered sufficient
   to solve routing issues by triggering local repair mechanisms, and
   the DODAG root may increment the DODAGVersionNumber only upon
   administrative intervention.  Another possibility is that nodes
   within the LLN have some means by which they can signal detected
   routing inconsistencies or suboptimalities to the DODAG root, in
   order to request an on-demand DODAGVersionNumber increment (i.e.
   request a global repair of the DODAG).  Note that such a mechanism is
   for further study and out of the scope of this document. Section 6.

   When the DODAG parent set becomes empty on a node that is not a root,
   (i.e. the last parent has been removed, causing the node to no longer
   be associated with that DODAG), then the DODAG information should not
   be suppressed until after the expiration of an implementation-
   specific local timer in order to observe if the DODAGVersionNumber
   has been incremented, should any new parents appear for the DODAG.
   This will help protect against the possibility of loops that may
   occur of that node were to inadvertently rejoin the old DODAG version
   in its own prior sub-DODAG.

   As the DODAGVersionNumber is incremented, a new DODAG Version spreads
   outward from the DODAG root.  Thus a  A parent that advertises the new
   DODAGVersionNumber cannot possibly belong to the sub-DODAG of a node
   that still advertises
   advertising an older DODAGVersionNumber.  A  Therefore a node may can safely
   add such a parent, without risk parent of forming any Rank with a loop, newer DODAGVersionNumber without regard to
   its relative rank in the prior
   forming a loop.

   Exactly when a DODAG Version.  This Root increments the DODAGVersionNumber is equivalent to
   jumping to a different DODAG.

   As
   implementation and application-dependent and outside the scope of
   this document.  Examples include incrementing the DODAGVersionNumber
   periodically, upon administrative intervention, or on application-
   level detection of lost connectivity or DODAG inefficiency.

   After a node transitions to and advertises a new DODAG Versions as a consequence of
   following these rules, Version, the node will be
   rules above make it unable to advertise the previous DODAG Version
   (prior DODAGVersionNumber) once it has committed to advertising the
   new DODAG Version.

   During transition to a new

7.2.2.2.  DODAG Version, a node may decide to
   forward packets via 'future parents' that belong to the same Roots

   1.  A DODAG
   (same RPLInstanceID and DODAGID), but are observed to advertise a
   more recent (incremented) DODAGVersionNumber.  In that case, the node
   MUST act as a leaf with regard to the new version for the purpose of
   loop detection as specified in Section 8.2.

6.2.2.2.  DODAG Roots

   1.  A DODAG root that does not have connectivity root without connectivity to the set of
       addresses described as application-level goals,
       Goals MUST NOT set the Grounded bit.

   2.  A DODAG root MUST advertise a rank of ROOT_RANK.

   3.  A node whose DODAG parent set is empty MAY become the DODAG root Root
       of a floating DODAG.  It MAY also set its DAGPreference such that
       it is less preferred.

   An LLN node that is a goal for the Objective Function is the root of
   its own grounded DODAG, at rank ROOT_RANK.

   In a deployment that uses a backbone link to federate a number of LLN
   roots, it is possible to run RPL over that backbone and use one
   router as a "backbone root".  The backbone root is the virtual root
   of the DODAG, and exposes a rank of BASE_RANK over the backbone.  All
   the LLN roots that are parented to that backbone root, including the
   backbone root if it also serves as LLN root itself, expose a rank of
   ROOT_RANK to the LLN, and LLN.  These virtual roots are part of the same DODAG, coordinating
   DODAGVersionNumber DODAG
   and advertise the same DODAGID.  They coordinate DODAGVersionNumbers
   and other DODAG root determined parameters with the virtual root over the backbone.

6.2.2.3.

7.2.2.3.  DODAG Selection

   The DODAGPreference (Prf) provides an administrative mechanism to
   engineer the self-organization objective function of the LLN, for example indicating the
   most a DAG determines how a node selects its
   neighbor set, parent set, and preferred LBR. parents.  This selection
   implicitly also decides the DODAG within a DAG.  Such selection can
   include administrative preference (Prf) as well as metrics or other
   considerations.

   If a node has the option to join a more preferred DODAG while still
   meeting other optimization objectives, then the node will generally
   seek to join the more preferred DODAG as determined by the OF.  All
   else being equal, it is left to the implementation to determine which
   DODAG is most preferred, possibly
   based on additional criteria beyond Prf and the OF.

6.2.2.4. preferred.

7.2.2.4.  Rank and Movement within a DODAG Version

   1.  A node MUST NOT advertise a rank Rank less than or equal to any member
       of its parent set within the DODAG Version.

   2.  A node MAY advertise a rank Rank lower than its prior advertisement
       within the DODAG Version.

   3.  Let L be the lowest rank within a DODAG version that a given node
       has advertised.  Within the same DODAG Version, that node MUST
       NOT advertise an effective rank higher than L +
       DAGMaxRankIncrease.  INFINITE_RANK is an exception to this rule:
       a node MAY advertise an INFINITE_RANK at any time.  (This rule
       corresponds to a limited rank increase for the purpose of local
       repair within the a DODAG Version.) version
       without restriction.  If a node's Rank would be higher than
       allowed by L + DAGMaxRankIncrease, when it advertises Rank it
       MUST advertise its Rank as INFINITE_RANK.

   4.  A node MAY, at any time, choose to join a different DODAG within
       a RPL Instance.  Such a join has no rank restrictions, unless
       that different DODAG is a DODAG Version of which this node has
       previously been a member, in which case the rule of the previous
       bullet (3) must be observed.  Until a node transmits a DIO
       indicating its new DODAG membership, it MUST forward packets
       along the previous DODAG.

   5.  A node MAY, at any time after hearing the next DODAGVersionNumber
       Version
       advertised from suitable DODAG parents, choose to migrate to the
       next DODAG Version within the DODAG.

   Conceptually, an implementation is maintaining a DODAG parent set
   within the DODAG Version.  Movement entails changes to the DODAG
   parent set.  Moving up does not present the risk to create a loop but
   moving down might, so that operation is subject to additional
   constraints.

   When a node migrates to the next DODAG Version, the DODAG parent and
   sibling sets need set
   needs to be rebuilt for the new version.  An implementation could
   defer to migrate for some reasonable amount of time, to see if some
   other neighbors with potentially better metrics but higher rank
   announce themselves.  Similarly, when a node jumps into a new DODAG
   it needs to construct new a DODAG parent/sibling sets parent set for this new DODAG.

   When

   If a node moves needs to improve move down a DODAG that it is attached to,
   increasing its position, Rank, then it must conceptually
   abandon all DODAG parents MAY poison its routes and siblings with a rank larger than
   itself.  As delay before
   moving as described in Section 7.2.2.5.

7.2.2.5.  Poisoning

   1.  A node poisons routes by advertising a consequence Rank of the movement it may also add new
   siblings.  Such a movement may occur at INFINITE_RANK.

   2.  A node MUST NOT have any time to decrease the
   rank, as per the calculation indicated by the OF.  Maintenance nodes with a Rank of the INFINITE_RANK in
       its parent and sibling sets occurs as set.

   Although an implementation may advertise INFINITE_RANK for the rank
   purposes of candidate neighbors poisoning, doing so is
   observed not the same as reported in their DIOs.

   If setting Rank to
   INFINITE_RANK.  For example, a node needs may continue to move down send data packets
   whose meta-data include a DODAG Rank that it is attached to, causing
   the rank to increase, then it MAY poison its routes and delay before
   moving as described not INFINITE_RANK yet still
   advertise INFINITE_RANK in Section 6.2.2.5.

6.2.2.5.  Poisoning a Broken Path its DIOs.

7.2.2.6.  Detaching

   1.  A node MAY poison, in order to avoid being used as an ancestor by
       the nodes in its sub-DODAG, by advertising an effective rank of
       INFINITE_RANK and resetting the associated DIO trickle timer unable to
       cause this INFINITE_RANK stay connected to be announced promptly.

   2.  The node MAY advertise an effective rank of INFINITE_RANK for an
       arbitrary number of DIO timer events, before announcing a new
       rank.

   3.  As per Section 6.2.2.4, the node MUST advertise INFINITE_RANK DODAG within the a given DODAG
       version in which it participates, if its
       revision in rank would exceed the maximum rank increase.

   An implementation may choose to employ MAY detach from this poisoning mechanism when
   a DODAG version.  A node loses all that detaches
       becomes root of its current parents, i.e. the set of own floating DODAG
   parents becomes depleted, and it can not jump to SHOULD immediately
       advertise this new situation in a DIO as an alternate DODAG.
   An alternate mechanism is to form a floating DODAG.

   The motivation for delaying announcement of the revised route through
   multiple DIO events is to (i) increase tolerance to DIO loss, (ii)
   allow time for the poisoning action to propagate, and (iii) to
   develop an accurate assessment of its new rank.  Such gains are
   obtained at the expense of potentially increasing the delay before
   portions of the network are able to re-establish upwards routes.
   Path redundancy in the DODAG reduces the significance of either
   effect, since children with alternate parents should be able to
   utilize those alternates and retain their rank while the detached
   parent re-establishes its rank.

   Although an implementation may advertise INFINITE_RANK for the
   purposes of poisoning, it is not expected to be equivalent to setting
   the rank to INFINITE_RANK, and an implementation would likely retain
   its rank value prior to the poisoning in some form, for purpose of
   maintaining its effective position within (L + DAGMaxRankIncrease).

6.2.2.6.  Detaching

   1.  A node unable to stay connected to a DODAG within a given DODAG
       version MAY detach from this DODAG version.  A node that detaches
       becomes root of its own floating DODAG and SHOULD immediately
       advertise this new situation in a DIO as an alternate to
       poisoning.

6.2.2.7.  Following
       poisoning.

7.2.2.7.  Following a Parent

   1.  If a node receives a DIO from one of its DODAG parents,
       indicating that the parent has left the DODAG, that node SHOULD
       stay in its current DODAG through an alternative DODAG parent, if
       possible.  It MAY follow the leaving parent.

   A DODAG parent may have moved, migrated to the next DODAG Version, or
   jumped to a different DODAG.  A node should give some preference to
   remaining in the current DODAG, if possible via an alternate parent,
   but ought to follow the parent if there are no other options.

6.2.3.

7.2.3.  DIO Message Communication

   When an DIO message is received, the receiving node must first
   determine whether or not the DIO message should be accepted for
   further processing, and subsequently present the DIO message for
   further processing if eligible.

   1.  If the DIO message is malformed, then the DIO message is not
       eligible for further processing and a node MUST be silently discarded.
       A RPL implementation MAY log the reception of a malformed DIO
       message. discard
       it.

   2.  If the sender of the DIO message is a member of the candidate
       neighbor set, then set and the DIO message is eligible for further processing.

6.2.3.1. not malformed, the node MUST
       process the DIO.

7.2.3.1.  DIO Message Processing

   As DIO messages are received from candidate neighbors, the neighbors
   may be promoted to DODAG parents by following the rules of DODAG
   discovery as described in Section 6.2. 7.2.  When a node places a neighbor
   into the DODAG parent set, the node becomes attached to the DODAG
   through the new DODAG parent node.

   The most preferred parent should be used to restrict which other
   nodes may become DODAG parents.  Some nodes in the DODAG parent set
   may be of a rank less than or equal to the most preferred DODAG
   parent.  (This case may occur, for example, if an energy constrained
   device is at a lesser rank but should be avoided as per an
   optimization objective, resulting in a more preferred parent at a
   greater rank).

6.3.

7.3.  DIO Transmission

   RPL nodes transmit DIOs using a Trickle timer
   ([I-D.ietf-roll-trickle]).  A DIO from a sender with a lower DAGRank
   that causes no changes to the recipient's parent set, preferred
   parent, or Rank SHOULD be considered consistent with respect to the
   Trickle timer.

   The following packets and events MUST be considered inconsistencies
   with respect to the Trickle timer, and cause the Trickle timer to
   reset:

   o  When a node detects an inconsistency when forwarding a packet, as
      detailed in Section 8.2. 10.2.

   o  When a node receives a multicast DIS message whose constraints
      (Solicited Information) it satisfies. without a Solicited
      Information option.

   o  When a node receives a multicast DIS with a Solicited Information
      option and the node matches all of the predicates in the Solicited
      Information option.

   o  When a node joins a new DODAG Version (e.g. by updating its
      DODAGVersionNumber, joining a new RPL Instance, etc.)

   Note that this list is not exhaustive, and an implementation MAY
   consider other messages or events to be inconsistencies.

   If

   A node SHOULD NOT reset its DIO trickle timer in response to unicast
   DIS messages.  When a node receives a unicast DIS message whose constraints (Solicited
   Information) it satisfies, without a Solicited
   Information option, it MUST unicast a DIO in response, and
   this to the sender in response.
   This DIO MUST include a DODAG Configuration option.  When a node
   receives a unicast DIS message with a Solicited Information option,
   if it satisfies the RPL instance's predicates of the Solicited Information option it
   MUST unicast a DIO to the sender in response.  This unicast DIO MUST
   include a DODAG Configuration Option.  Thus a node may transmit a
   unicast DIS message to a potential DAO parent in order to probe for
   DODAG Configuration object.

6.3.1. and other parameters.

7.3.1.  Trickle Parameters

   The configuration parameters of the trickle timer are specified as
   follows:

   Imin: learned from the DIO message as (2^DIOIntervalMin)ms.  The
         default value of DIOIntervalMin is DEFAULT_DIO_INTERVAL_MIN.

   Imax: learned from the DIO message as DIOIntervalDoublings.  The
         default value of DIOIntervalDoublings is
         DEFAULT_DIO_INTERVAL_DOUBLINGS.

   k:    learned from the DIO message as DIORedundancyConstant.  The
         default value of DIORedundancyConstant is
         DEFAULT_DIO_REDUNDANCY_CONSTANT.  In RPL, when k has the value
         of 0x00 this is to be treated as a redundancy constant of
         infinity in RPL, i.e.  Trickle never suppresses messages.

6.4.

7.4.  DODAG Selection

   The DODAG selection is implementation and OF dependent.  Nodes SHOULD
   prefer to join DODAGs for RPLInstanceIDs advertising OCPs and
   destinations compatible with their implementation specific
   objectives.  In order to limit erratic movements, and all metrics
   being equal, nodes SHOULD keep their previous selection.  Also, nodes
   SHOULD provide a means to filter out a parent whose availability is
   detected as fluctuating, at least when more stable choices are
   available.

   When connection to a grounded DODAG is not possible or preferable for
   security or other reasons, scattered DODAGs MAY aggregate as much as
   possible into larger DODAGs in order to allow connectivity within the
   LLN.

   A node SHOULD verify that bidirectional connectivity and adequate
   link quality is available with a candidate neighbor before it
   considers that candidate as a DODAG parent.

6.5.

7.5.  Operation as a Leaf Node

   In some cases a RPL node may attach to a DODAG as a leaf node only.
   One example of such a case is when a node does not understand the RPL
   Instance's OF or advertised path metric.  A leaf node does not extend
   DODAG connectivity but still needs to advertise its presence using
   DIOs.  A node operating as a leaf node must obey the following rules:

   1.  It MUST NOT transmit DIOs containing the DAG Metric Container.

   2.  Its DIOs must MUST advertise a DAGRank of INFINITE_RANK.

   3.  It MAY transmit unicast DAOs as described in Section 7.1. 8.2.

   4.  It MAY transmit multicast DAOs to the '1 hop' neighborhood as
       described in Section 7.1.9.

6.6. 8.10.

   In some cases it is necessary for a leaf node to send a DIO, for
   example if that leaf node was a prior member of another DODAG and
   another node forwards a message assuming the old topology, triggering
   an inconsistency.  The leaf node needs to transmit a DIO in order to
   participate in the repair.  It is not expected that such a leaf node
   would advertise itself as a router.

7.6.  Administrative Rank

   In some cases it might be beneficial to adjust the rank advertised by
   a node beyond that computed by the OF based on some implementation
   specific policy and properties of the node.  For example, a node that
   has limited battery should be a leaf unless there is no other choice,
   and may then augment the rank computation specified by the OF in
   order to expose an exaggerated rank.

7.

8.  Downward Routes

   This section describes how RPL discovers and maintains downward
   routes.  The use of messages containing the  RPL constructs and maintains downward routes with
   Destination Advertisement Object (DAO), used to construct downward routes, are described.  The
   downward (DAO) messages.  Downward routes are necessary in
   support of P2MP flows, from the DODAG roots toward the leaves.  It specifies non-storing and storing
   behavior of nodes with respect
   Downward routes also support P2P flows: P2P messages can flow to DAO messaging and DAO routing table
   entries.  Nodes, as according a
   DODAG Root through an upward route, then away from the DODAG Root to their resources and
   a destination through a downward route.

   This specification describes the
   implementation, two modes a RPL Instance may selectively choose
   from for maintaining downward routes.  In the first mode, call
   "storing," nodes store downward routing tables for their sub-DODAG.
   Each hop on a downward route in a storing network examines its
   routing table entries learned
   from DAO messages, or may instead propagate to decide on the DAO information
   upwards and independently next hop.  In the second mode, called
   "non-storing," nodes do not store downward routing tables.  Downward
   packets are routed with source local topology information in routes populated by a new
   DAO message. information.  A further DODAG Root.

   RPL allows a simple one-hop P2P optimization is described
   whereby DAO messages may be used to populate routing table entries for the '1-hop' neighbors, which both storing and
   non-storing networks.  A node may be useful in some cases as send a
   shortcut for P2P flows.

7.1.  Downward Route Discovery and Maintenance

7.1.1.  Overview packet destined to a
   one-hop neighbor directly to that node.

8.1.  Destination Advertisement operation produces Parents

   To establish downward routes, RPL nodes send DAO messages that flow
   up the DODAG, provisioning downward routing state for destination
   prefixes available in the sub-DODAG of the DODAG root, and possibly
   other nodes. upwards.
   The routing state provisioned with this mechanism is in
   the form next hop destinations of soft-state routing table entries. these DAO operation is
   presently defined in two distinct modes messages are called DAO
   parents.  The collection of operation, non-storing and
   storing, and allowance is made for future expansion.

   Destination Advertisement may or may not be enabled over a DODAG
   rooted at a DODAG root.  This node's DAO parents is an a priori configuration determined
   by the implementation/deployment and not generally changed during the
   operation of called the RPL LLN.

   Destination Advertisement may DAO
   parent set.

   o  A node's DAO parent set MUST be configured to operate in either a
   storing or non-storing mode, as reported in the MOP in the DIO
   message.  Every subset of its parent set.

   o  A node in the network participating in Destination
   Advertisement must behave consistently with MUST NOT unicast DAOs to nodes that configured mode are not DAO parents.

   o  A node MAY link-local multicast DAO messages.

   o  The IPv6 Source Address of
   operation, or alternately behave only as a leaf DAO message MUST be the link local
      address of the sending node.  Hybrid or
   mixed-mode operation

   o  If a node sends a DAO to one DAO parent, it MUST send a DAO with
      the same DAOSequence to all other DAO parents.

   The selection of DAO parents is not currently specified.

   When implementation and objective function
   specific.

8.2.  Downward Route Discovery and Maintenance

   Destination Advertisement is enabled:

   1.  The RPL Instance will may be configured a priori as appropriate to
       satisfy the application to operate in either non-storing or a
   storing mode. or non-storing mode, as reported in the MOP in the DIO
   message.

   1.  If the 'A' (Destination Advertisement Supported) flag of DIO
       messages for the RPL Version is not set, nodes MUST NOT transmit
       DAO messages, MAY ignore DAO messages, and MAY ignore the MOP
       field of DIOs.

   2.  All nodes who join the a DODAG MUST abide with the 'A' flag set MUST follow the
       MOP setting from the root.  Nodes that would do not have the capability
       to fully participate as a router (e.g. to operate as a storing node) can
       still MAY join the DODAG as a leaf (i.e. host). leaf.

   3.  In storing mode operation, mode, all non-root non-root, non-leaf nodes are expected to
       either MUST store routing
       table entries for ALL all destinations learned from DAO operation, or to act as a leaf node only. DAOs.

   4.  In non-storing mode operation, no node other than mode, the DODAG Root
       is expected to MUST store source routing
       table entries for all destinations learned from DAO
       messages.  Each node is only responsible to report its own set of
       parents to the DODAG Root.

   5. DAOs.

   A DODAG roots nodes SHOULD be capable to store routing table
       entries learned from DAO operation when the RPL Instance is
       operated in a non-storing mode.

   6.  The mode can have one of operation three settings.  Either it does not support
   downward routes (the 'A' flag in the RPL Instance DIOs is signaled cleared), it supports
   downward routes through source routing from the DODAG Root in Roots (the 'A' flag
   is set and the MOP control field of indicates non-storing), or it supports downward
   routes through in-network routing tables (the 'A' flag is set and the DIO message.

7.1.2.  Mode
   MOP indicates storing).  As of Operation

   o  DAO Operation may not be required for all use cases.

   o  Some applications may only need support for collection/upward/MP2P
      flow with no acknowledgement/reciprocal traffic.

   o  Some DODAGs may this specification RPL does not
   support DAO Operation, which could mean that
      DAO Operation is wasteful overhead.

   o  As a special case, multicast DAO operation may be used to populate
      'one-hop' neighborhood routing table entries, mixed-mode operation, where some nodes source route and is distinct from
      the unicast DAO operation used to establish downward routes along
      the DODAG.  This special case is an exception other
   store routing tables: future extensions to the RPL Instance may support this mode
   of operation as well.

   1.  The 'A' flag in the DIO as conveyed from the DODAG root serves to
       enable/disable operation.

8.3.  DAO operation over the entire DODAG.  This flag
       should be administratively provisioned Base Rules

   1.  Each time a priori at the DODAG root
       as node generates a function of new DAO, the implementation/deployment and not tend to
       change. DAOSequence field MUST
       increment by at least one since the last generated DAO.

   2.  When DAO Operation is disabled,  Each time a node MUST NOT emit DAO
       messages.

   3.  When DAO Operation is disabled, link-local multicasts a node MAY ignore DAO, the MOP field.

   4.  When DAO Operation is disabled, a node MAY ignore received DAO
       messages.

7.1.3.  Destination Advertisement Parents

   o  Nodes will select a subset of their DODAG Parents to whom DAO
      messages will be sent

      *  This subset is the set of 'DAO Parents'

      *  Each DAO parent DAOSequence
       field MUST be a DODAG Parent.  (Not all DODAG parents
         need to be DAO parents).

   o increment by one since the last link local multicast
       DAO.

   3.  The selection RPLInstanceID and DODAGID fields of a DAO parents is implementation specific and may MUST be
      based on selecting the DODAG Parents that offer the best upwards
      cost (as opposed to downwards or mixed), same
       value as determined by the
      metrics in use members of the node's parent set and the Objective Function.

   o  When DIOs it
       transmits.

   4.  A node MAY set the K flag in a unicast DAO messages are message to solicit a
       unicast DAO-ACK in response in order to confirm the attempt.  A
       node receiving a unicast DAO Parent, the identity of
      the DAO Parent (DODAGID and DODAGVersionNumber) combined message with the
      RPLInstanceID in the K flag set SHOULD
       respond with a DAO-ACK.  A node receiving a DAO message unambiguously associates without
       the DAO
      message, K flag set MAY respond with a DAO-ACK, especially to report
       an error condition.

   5.  Nodes SHOULD ignore DAOs without newer sequence numbers and thus MUST
       NOT process them further.

   Unlike the particular destination prefix, with Version field of a DIO, which is incremented only by a
   DODAG
      Version.

7.1.4. Root and repeated unchanged by other nodes, DAOSequence values
   are unique to each node.  The sequence number space for unicast and
   multicast DAO Operation on Storing Nodes

7.1.4.1. messages can be either the same or distinct.

8.4.  DAO Routing Table Entry

   A Transmission Scheduling

   Because DAOs flow upwards, receiving a unicast DAO Routing Table Entry conceptually contains the following
   elements:

   o  Advertising Neighbor Information
      *  IPv6 Address
      *  Interface ID
   o  To which can trigger
   sending a unicast DAO.

   1.  On receiving a unicast DAO Parents has with a new DAOSequence, a node SHOULD
       send a DAO.  It SHOULD NOT send this entry been reported
   o  Retry Counter
   o  Logical equivalent of DAO Content:
      * DAO Sequence
      * immediately.  It SHOULD
       delay sending the DAO Lifetime
      * in order to aggregate DAO Path Control (as learned information from each child)
      *  Destination Prefix (or Address or Mcast Group)

   The DAO Routing Table Entry is logically associated with the
   following states:

   CONNECTED   This entry is 'owned' by the node -
       other nodes for which it is manually
               configured and is considered as a 'self' entry for DAO
               Operation

   REACHABLE   This entry has been reported from parent.

   2.  A node SHOULD delay sending a neighbor of DAO with a timer (DelayDAO).
       Receiving a DAO starts the node.
               This state includes DelayDAO timer.  DAOs received while
       the following substates:

               CONFIRMED This entry is active, newly validated, and
                         usable

               PENDING   This entry is active, awaiting validation, and
                         usable.  A Retry Counter is associated with
                         this substate

   UNREACHABLE This entry DelayDAO timer is being cleaned up.  This entry may be
               suppressed when active do not reset the cleanup process is complete. timer.  When an attempt is to be made to report the DAO entry to DAO Parents, the DAO Entry record is logically marked to indicate that an attempt
   has not yet been made for each parent.  As
       DelayDAO timer expires, the unicast attempts are
   completed for each parent, this mark may be cleared.  This mechanism
   may serve node sends a DAO.

   3.  When a node adds a node to limit its DAO entry updates for each parent to set, it SHOULD schedule
       a subset that
   needs to be reported.

7.1.4.1.1. DAO Routing Table Entry Management

           +---------------------------------+
           |                                 |
           |            REACHABLE            |    +-------------+
           |                                 |    |             |
           |        +-----------+            |    |  CONNECTED  |
     (*)----------->|           |-------+    |    |             |
           |        | Confirmed |       |    |    +-------------+
           |    +-->|           |---+   |    |
           |    |   +-----------+   |   |    |
           |    |                   |   |    |
           |    |                   |   |    |
           |    |                   |   |    |
           |    |   +-----------+   |   |    |    +-------------+
           |    |   |           |<--+   +-------->|             |
           |    +---|  Pending  |            |    | UNREACHABLE |
           |        |           |---------------->|             |--->(*)
           |        +-----------+            |    +-------------+
           |                                 |
           +---------------------------------+
                        DAO Routing Table Entry FSM

7.1.4.1.1.1.  Operation in the CONNECTED state

   1.  CONNECTED transmission.

   DelayDAO's value and calculation is implementation-dependent.

8.5.  Triggering DAO entries are Messages

   Nodes can trigger their sub-DODAG to be provisioned outside of the
       context of RPL, e.g. through a management API.  An implementation
       SHOULD provide send DAO messages.  Each node
   maintains a means to provision/manage CONNECTED DAO entries,
       including whether they are to be redistributed in RPL.

7.1.4.1.1.2.  Operation in the REACHABLE state Trigger Sequence Number (DTSN), which it communicates
   through DIO messages.

   1.  When  If a REACHABLE(*) entry times out, i.e. the node hears one of its DAO Lifetime has
       elapsed, parents increment its DTSN, the entry
       node MUST be placed into the UNREACHABLE state and
       No-Path SHOULD be scheduled to send to the node's schedule a DAO Parents. transmission using rules in Section 8.3
       and Section 8.4.

   2.  When  If a No-Path for node hears one of its parents send a REACHABLE(*) entry is received DIO with the 'T' bit
       set and a newer
       DAO Sequence Number, newly incremented DTSN, the entry node MUST be placed into increment its own
       DTSN, MUST set the
       UNREACHABLE state 'T' bit in its own DIOs, and No-Path SHOULD be scheduled to send to the
       node's DAO Parents.

   3.  When MUST schedule a REACHABLE(*) entry is
       DAO transmission using rules in Section 8.3 and Section 8.4.

   A node may increment DTSN in order to be removed because NUD or
       equivalent has determined that the next-hop neighbor is no longer
       reachable, the entry MUST be placed into the UNREACHABLE state
       and No-Path SHOULD be scheduled to send to the node's reliably trigger a set of DAO
       Parents.

   4.  When
   updates from its immediate children, as part of a REACHABLE(*) entry is to be removed because an associated
       Forwarding Error has been returned by the next-hop neighbor, the
       entry MUST be placed into the UNREACHABLE state routine routing
   table update.  A node may increment DTSN and No-Path
       SHOULD be scheduled to send to set the node's DAO Parents.

   5.  When 'T' bit in order
   to trigger a set of DAO (or No-Path) for updates from its entire sub-DODAG.

   In the case of triggered DAOs, selecting a REACHABLE(*) entry is received with
       an older or unchanged DAO Sequence Number, then proper DAODelay can
   greatly reduce the DAO (or No-
       Path) SHOULD be ignored and number of DAOs transmitted.  The trigger flows
   down the associated entry MUST NOT be
       updated with DODAG; in the stale information.

7.1.4.1.1.2.1.  REACHABLE(Confirmed)

   1.  When a DAO for a previously unknown (or UNREACHABLE) destination
       is received and is to be stored, it MUST be entered into best case the
       routing table in DAOs flow up the REACHABLE(Confirmed) state, and DODAG such that
   leaves send DAOs first, with each node sending a DAO SHOULD only once.  Such
   a scheduling could be scheduled approximated by setting DAODelay inversely
   proportional to send Rank.  Note that this suggestion is intended as an
   optimization to the node's DAO Parents.

   2.  When a DAO for a REACHABLE(Confirmed) entry allow efficient aggregation -- it is received with a
       newer DAO Sequence Number, the entry MUST be updated with not required for
   correct operation in the
       logical equivalent general case.

8.6.  Structure of the DAO contents and Messages

   DAOs follow a DAO SHOULD be
       scheduled to send to common structure in both storing and non-storing
   networks.  Later sections describe further details for each mode of
   operation.

   1.  RPL nodes MUST include one or more RPL Target Options in each DAO
       they transmit.  One RPL Target Option MUST have a prefix that
       includes the node's DAO Parents.

   3.  When IPv6 address.

   2.  A RPL Target Option in a unicast DAO for MUST be followed by a REACHABLE(Confirmed) entry is expected, e.g.
       because
       Transit Information Option.

   3.  Multicast DAOs MUST NOT include Transit Information options.

   4.  If a DIO to request node receives a DAO refresh is sent, then that does not follow the DAO
       entry above three
       rules, it MUST be placed in the REACHABLE(Pending) state and discard the
       associated Retry Counter MUST be set to 0.

7.1.4.1.1.2.2.  REACHABLE(Pending)

   1.  When a DAO for without further processing.

8.7.  Non-storing Mode

   In non-storing mode, RPL routes messages downward using source
   routing.  The following rule applies to nodes that are in non-storing
   mode.  Storing mode has a REACHABLE(Pending) entry is received with separate set of rules, described in
   Section 8.8.

   1.  The Parent Address field of a
       newer DAO Sequence Number, the entry Transit Information Option MUST
       contain one or more addresses.  All of these addresses MUST be updated with the
       logical equivalent
       addresses of the DAO contents and parents of the entry sender.

   2.  On receiving a unicast DAO, a node MUST be
       placed forward the DAO upwards.
       This forwarding MAY use any parent in the REACHABLE(Confirmed) state.

   2. parent set.

   3.  When a node removes a node from its DAO for parent set, it MAY
       generate a REACHABLE(Pending) entry is expected, e.g.
       because new DAO has (again) been triggered with respect an updated Transit Information option.

   In non-storing mode, a node uses DAOs to report its DAO parents to that
       neighbor, then the associated Retry Counter MUST be incremented.

   3.  When
   the associated Retry Counter for a REACHABLE(Pending) entry
       reaches DODAG Root.  The DODAG Root can piece together a maximum threshold, the entry MUST be placed into the
       UNREACHABLE state and No-Path SHOULD be scheduled to send downward route
   to the
       node's a node by using DAO Parents.

7.1.4.1.1.3.  Operation in the UNREACHABLE state

   1.  An implementation SHOULD bound the time that the entry is
       allocated parent sets from each node in the UNREACHABLE state.  Upon the equivalent expiry route.  The
   purpose of this per-hop route calculation is to minimize traffic when
   DAO parents change.  If nodes reported complete source routes, then
   on a DAO parent change the related timer (RemoveTimer), the entry SHOULD be
       suppressed.

   2.  While entire sub-DODAG would have to send new
   DAOs to the entry is DODAG Root.  Therefore, in the UNREACHABLE state non-storing mode, a node SHOULD make can
   send a
       reasonable attempt to report a No-Path single DAO, although it might choose to send more than one
   DAO to each of the multiple DAO parents.

   3.  When the node has completed an attempt to report

   Nodes aggregate DAOs by sending a No-Path to
       each of the single DAO parents, the entry SHOULD be suppressed.

7.1.4.2. with multiple RPL Target
   Options.  Each RPL Target Option has its own, immediately following,
   Transit Information options.

8.8.  Storing Mode DAO Message and Path Control

   In storing mode, RPL routes messages downward by the IPv6 destination
   address.  The following rule apply to nodes that are in storing mode mode:

   1.  The Parent Address field of operation, a DAO message from Transmit Information option MUST be
       empty.

   2.  On receiving a unicast DAO, a node will
   contain one or more Target Options, each Target Option specifying
   either a CONNECTED destination or a destination in MUST compute if the sub-DODAG DAO would
       change the set of prefixes that the node.

   For each attempt made to report node itself advertises.  If
       so, the DAO entry to node MUST generate a set of new DAO
   parents, and transmit it, following
       the rules in Section 8.4.  Such a change includes receiving a No-
       Path Control field will be constructed as follows:

   1.  The size of the path control field will be specified by the PCS
       control field DAO.

   3.  When a node generates a new DAO, it SHOULD unicast it to each of
       its DAO parents.  It MUST NOT unicast the DODAG Configuration Option.  The default
       value is DEFAULT_PATH_CONTROL_SIZE.

   2.  For each unique destination DAO to be reported nodes that is CONNECTED, the
       logical equivalent of are
       not DAO parents.

   4.  When a path control bitmap that is the size of
       the path control field shall be initialized with the leftmost
       bits node removes a node from its DAO parent set, where the number of leftmost bits corresponds it SHOULD
       send a No-Path DAO (Section 5.4.3) to that removed DAO parent to
       invalidate the
       size of existing route.

   5.  If messages to an advertised downwards address suffer from a
       forwarding error, neighbor unreachable detected (NUD), or similar
       failure, a node MAY mark the path control field address as specified by PCS.

   3.  For each unique destination to be reported that is not CONNECTED,
       i.e. that unreachable and generate
       an appropriate No-Path DAO.

   DAOs advertise what destination is contained addresses and prefixes a node has
   routes to.  Unlike in non-storing mode, these DAOs do not communicate
   information about the node's sub-DODAG, the
       logical equivalent of a path control bitmap routes themselves: that information is stored
   within the size of network and is implicit from the path control field shall be initialized by ORing IPv6 source address.
   When a storing node generates a DAO, it uses the content stored state of all DAOs
   it has received to produce a set of the RPL Target options and their
   associated Transmit Information options.

   Because this information is stored within a network, in storing mode
   DAOs are communicated directly to DAO parents, who store this
   information.

8.9.  Path Control fields received in

   A DAO messages message from a node contains one or more Target Options.  Each
   Target Option specifies either the node's children for that destination.

   4.  For each DAO Parent that the node shall attempt an update to, prefix, a prefix of
   addresses reachable outside the
       node shall exclusively allocate 1 LLN, or more set bits from a destination in the path
       control bitmap node's
   sub-DODAG.  The Path Control field of the Transit Information option
   allows nodes to that DAO Parent. request multiple downward routes.  A node constructs
   the Path Control field of a Transit Information option as follows:

   1.  The bit width of the path control bits SHOULD field MUST be allocated equal to the
       value specified in order the PCS control field of preference, such that the most
       significant bits, DODAG
       Configuration Option.  Bits greater than or groupings of bits, are allocated equal to the most
       preferred DAO parents as determined by value
       specified in the node.  Once a bit from PCS control field MUST be cleared on
       transmission and MUST be ignored on reception.  Bits below the path
       value in the PCS control bitmap has been allocated to field are considered "active" bits.

   2.  For a DAO Parent for
       this attempt, RPL Target option describing a node's own address or a
       prefix outside the corresponding LLN, at least one active bit MUST be set in of the Path
       Control field in the DAO message sent to that DAO Parent, and
       that bit MUST NOT be allocated to any other DAO Parent.

   5.  A unicast DAO message may be sent for DAO Parents that have a
       non-zero set.  More active bits of the Path Control field.

   6.
       field MAY be set.

   3.  If any DAO Parent is left without any bits set in its a node receives multiple DAOs with the same RPL Target option,
       it MUST bitwise-OR the Path Control field, then that fields it receives.  This
       aggregated bitwise-OR represents the number of downward routes
       the prefix requests.

   4.  When a node sends a unicast DAO message MUST NOT be sent to that DAO parent for this attempt.

7.1.5.  Operation one of its DAO Non-storing Nodes

   1.  In the non-storing mode parents, it MUST select
       one or more of operation, each node sending a the set, active bits in the aggregated Path
       Control field.  The DAO
       message it transmits to its DODAG Parents will include a parent MUST have
       these active bits set and all other active bits cleared.

   5.  For the RPL Target option and DAOSequence number, the DAOs a node
       sends to
       describe itself, followed by RPL Transit Information option(s) different DAO parents MUST have disjoint sets of active
       Path Control bits.  A node MUST NOT set the same active bit on
       DAOs to
       describe its two different DAO parents.  This information is sufficient for

   6.  Path control bits SHOULD be allocated in order of preference,
       such that the
       DODAG Root most significant bits, or groupings of bits, are
       allocated to collect the DODAG topology and construct source
       routes in most preferred DAO parents as determined by the downward direction.

   2.
       node.

   7.  In the a non-storing mode of operation, each node receiving a DAO
       message will arrange to node MAY pass DAOs through
       without performing any further processing on the content of the DAO message along
       to the DODAG Root.  When possible the content of DAO messages may
       be aggregated.

   3.  When Path Control
       field.

   8.  A node MUST NOT unicast a DAO is received from a child by that has no active bits in the Path
       Control field set.

   The Path Control field allows a node who to bound how many downward
   routes will not store be generated to it.  It sets a routing table entry for the DAO, number of bits in the node MUST schedule Path
   Control field equal to pass the DAO contents along to its DAO parents.

7.1.6.  Scheduling maximum number of downward routes it
   prefers.  Each bit is sent to Send at most one DAO (or No-Path)

   1.  An implementation SHOULD arrange to rate-limit the sending parent; clusters of
       DAOs.

   2.  When scheduling
   bits can be sent to send a DAO, an implementation SHOULD
       equivalently start a timer (DelayDAO) to delay sending the DAO.
       If the DelayDAO timer is already running then the single DAO may be
       considered as already scheduled, and implementation SHOULD leave
       the timer running at its present duration.

   o  When computing the delay before sending a DAO, in order parent for it to
      increase the effectiveness divide among its
   own DAO parents.

8.10.  Multicast Destination Advertisement Messages

   A special case of aggregation, an implementation MAY
      allow time to receive DAOs DAO operation, distinct from its sub-DODAG prior to emitting
      DAOs to its unicast DAO Parents.

      *  Suppose there operation,
   is an implementation parameter DAO_LATENCY which
         represents the maximum expected time for a multicast DAO operation which may be used to
         traverse the LLN from the farthest populate '1-hop'
   routing table entries.

   1.  A node MAY multicast a DAO message to the root.  The
         scheduled delay in such cases may be, for example, link-local scope all-
       nodes multicast address FF02::1.

   2.  A multicast DAO message MUST be used only to advertise
       information about self, i.e. prefixes directly connected to or
       owned by this node, such that
         DAO_LATENCY/DAGRank(self_rank) <= DelayDAO < DAO_LATENCY/
         DAGRank(parent_rank), where DAGRank() is defined as in
         Section 3.5.2, such a multicast group that nodes deeper in the DODAG may tend to
         report DAO messages first before their parent nodes will report
         DAO messages.  Note that this suggestion node is intended as an
         optimization
       subscribed to allow efficient aggregation -- it is not
         required for correct operation in or a global address owned by the general case.

7.1.7.  Triggering node.

   3.  A multicast DAO Message message MUST NOT be used to relay connectivity
       information learned (e.g. through unicast DAO) from the Sub-DODAG

   Triggering DAO messages another node.

   4.  Information obtained from a multicast DAO MAY be installed in the Sub-DODAG occurs
       routing table and MAY be propagated by using the
   following control fields with the rules described below:

   The DTSN field from the DIO is a sequence number that is part of the
   mechanism to trigger node in unicast DAOs.

   5.  A node MUST NOT perform any other DAO messages.  The motivation to use related processing on a sequence
   number is to provide some means of reliable signaling to
       received multicast DAO, in particular a node MUST NOT perform the sub-
   DODAG.  Whereas
       actions of a control flag that is activated for DAO parent upon receipt of a short time multicast DAO.

   o  The multicast DAO may be unobserved by the sub-DODAG if used to enable direct P2P communication,
      without needing the triggering DIO messages are
   lost, RPL routing structure to relay the DTSN increment may be observed later even if some
   intervening DIO messages have been lost. packets.

   o  The 'T' flag provides a way to signal the refresh of multicast DAO information
   over the entire does not presume any DODAG version.  Whereas a DTSN increment may only
   trigger a DAO refresh as far as relationship between
      the next storing node (because a
   storing node will not increment its own DTSN in response, as
   described in emitter and the rules below), receiver.

9.  Security Mechanisms

   This section describes the assertion generation and processing of secure RPL
   messages.  The high order bit of the 'T' flag in
   conjunction with an incremented DTSN will result in RPL message code identifies
   whether a DAO refresh
   from the entire DODAG.

   The control fields are used RPL message is secure or not.  In addition to trigger DAO secure
   versions of basic control messages as follows:

   1.  A DAO Trigger Sequence Number (DTSN) MUST be maintained by each
       node per (DIS, DIO, DAO, DAO-Ack), RPL Instance.  The DTSN, has
   several messages which are relevant only in conjunction networks with the 'T'
       flag from the DIO message, provides security
   enabled.

9.1.  Security Overview

   RPL supports three security modes:

   o  Insecure.  In this security mode, RPL uses insecure DIS, DIO, DAO,
      and DAO-Ack messages.

   o  Pre-installed.  In this security mode, RPL uses secure messages.
      To join a RPL Instance, a means by which DAO messages
       may be reliably triggered in the event of topology change.

   2.  The DTSN MUST be advertised by the node in the DIO message.

   3. must have a pre-installed key.
      Nodes use this to provide message confidentiality, integrity, and
      authenticity.  A node keeps track of the DTSN that it has heard from may, using this preinstalled key, join the last
       DIO from each of its DAO Parents.  Note that there is one DTSN
       maintained per DAO Parent- each DAO Parent may independently
       increment it at will.

   4.  DAO Transmission SHOULD be scheduled when a new parent is added
       to the DAO Parent set.

   5.  A node that receives a newly incremented DTSN from
      RPL network as either a DAO Parent
       MUST schedule host or a DAO transmission. router.

   o  Authenticated.  In storing mode operation, when this security mode, RPL uses secure messages.
      To join a RPL Instance, a node sees must have a DTSN increment, it
      is caused to reissue its entire set of routing table entries
      learned from DAO messages (or an aggregated subset thereof), but
      will not need pre-installed key.
      Node use this key to increment its own DTSN.

   o  In either storing or non-storing modes of operation, when provide message confidentiality, integrity,
      and authenticity.  Using this preinstalled key, a node
      sees may join
      the network as a DTSN increment AND host only.  To join the 'T' flag is set, it does increment
      its own DTSN network as well.  The 'T' flag 'punches through' all nodes,
      causing all routing state a router, a
      node must obtain a second key from a key authority.  This key
      authority can authenticate that the entire sub-DODAG to be
      refreshed.

7.1.8.  Sending DAO Messages to DAO Parents

   1.  DAO Messages sent requester is allowed to DAO Parents MUST be unicast.

       *  The IPv6 Source Address is a link local address of
      router before providing it with the node
          sending second key.

   Whether or not the DAO message.

       *  The IPv6 Destination Address RPL Instance uses insecure mode is signaled by
   whether it uses secure RPL messages.  Whether a link local address of secured network uses
   the
          DAO parent.

   2.  A node MUST send pre-installed or authenticated mode is signaled by the DAO with 'A' bit of
   the same sequence to all its DAO
       parents that are to be used on the way back to the DAO target.

   3.  When using source routing, a Destination that builds DAG Configuration option.

   RPL uses CCM* -- Counter with CBC-MAC (Cipher Block Chaining Message
   Authentication Code) -- as the DAO also
       indicates cryptographic basis for its parent in the DAO
   security[RFC3610].  In this specification, CCM uses AES-128 as a Transit Information option.
       If the node has multiple DAO parents, it MAY include one Transit
       Information Option per parent and pass its
   underlying cryptographic algorithm.  There are bits reserved in the DAO
   security section to one or more
       parent.  The Transit Information option indicates the preference
       for that parent encoded specify other algorithms in the Path Control bitfield.

   4.  When the appointed time arrives (DelayDAO) for the transmission
       of DAO future.

   All secured RPL messages (with jitter as appropriate) have a message authentication code (MAC).
   Secured RPL messages optionally also have encryption protection for the requested
       entries, the implementation MAY aggregate the the entries into
   confidentiality.  Secured RPL message formats support both integrated
   encryption/authentication schemes (e.g., CCM*) as well as schemes
   that separately encrypt and authenticate packets.

9.2.  Installing Keys

   Authenticated mode requires a
       reduced numbers of DAOs to be reported would-be router to each parent, and
       perform compression if possible.

   5.  Note: it is NOT RECOMMENDED that dynamically install
   new keys once they have joined a DAO Transmission (No-Path) be
       scheduled when network as a DAO Parent host.

   The exact message exchange to obtain such keys is removed from the DAO Parent set.

   6.  A node MAY set TBD.  It will
   involve communication with a key authority, possibly, using the K flag in pre-
   installed shared key.  The key authority can apply a unicast DAO message security policy
   to solicit a
       unicast DAO-ACK in response in order decide whether to confirm grant the attempt.  A
       node receiving would-be-router a unicast DAO message with the K flag set SHOULD
       respond new key.  These keys
   may have lifetimes (start and end times) associated with them, which
   nodes that support timestamps (described in Section 9.4.1) can use.

9.3.  Joining a Secure Network

   RPL security assumes that a DAO-ACK.  A node receiving wishing to join a DAO message without
       the K flag set MAY respond secured network
   has been preconfigured with a DAO-ACK, especially to report
       an error condition.

7.1.9.  Multicast Destination Advertisement Messages

   A special case of DAO operation, distinct from unicast DAO operation,
   is multicast DAO operation which may be used to populate '1-hop'
   routing table entries.

   1.  A shared key for communicating with
   neighbors and the RPL root.  To join a secure RPL network, a node MAY multicast
   either listens for secure DIOs or triggers secure DIOs by sending a DAO message
   secure DIS.  In addition to the link-local scope all-
       nodes multicast address FF02::1.

   2.  A multicast DAO message DIO/DIS rules in Section 7, secure
   DIO and DIS messages have these rules:

   1.  If sent, this initial secure DIS MUST be used only NOT set the C bit, MUST set
       the KIM field to advertise
       information about self, i.e. prefixes directly connected 0 (00), and MUST set the LVL field to or
       owned by this node, such as a multicast group that 1 (001).
       The key used MUST be the preconfigured group key (Key Index
       0x00).

   2.  When a node is
       subscribed resets its Trickle timer in response to or a global address owned by secure DIS
       (Section 7.3), the node.

   3.  A multicast DAO message next DIO it transmits MUST NOT be used to relay connectivity
       information learned (e.g. through unicast DAO) from another node.

   4.  Information obtained from a multicast DAO MAY be installed in secure DIO
       with the
       routing table and MAY be propagated by same security configuration as the secure DIS.  If a
       node in unicast DAOs.

   5.  A node MUST NOT perform any other DAO related processing on a
       received multicast DAO, in particular receives multiple secure DIS messages before it transmits a node
       DIO, the secure DIO MUST NOT perform have the
       actions of same security configuration as
       the last DIS it is responding to.

   3.  When a DAO parent upon receipt of node sends a multicast DAO.

   o  The multicast DAO may be used to enable direct P2P communication,
      without needing the RPL routing structure DIO in response to relay the packets.

   o  The multicast DAO does not presume any DODAG relationship between
      the emitter and a unicast secure DIS
       (Section 7.3), the receiver.

8.  Packet Forwarding and Loop Avoidance/Detection

8.1.  Suggestions for Packet Forwarding

   When forwarding DIO MUST be a packet to secure DIO.

   The above rules allow a destination, precedence is given node to
   selection of join a next-hop successor as follows:

   1.  This specification only covers how secured RPL Instance using the
   preconfigured shared key.  Once a successor is selected from node has joined the DODAG version that matches using the RPLInstanceID marked in
   preconfigured shared key, the
       IPv6 header 'A' bit of the packet being forwarded.  Routing outside Configuration option
   determines its capabilities.  If the
       instance can be done as long as additional rules are put in place
       such as strict ordering 'A' bit of instances and routing protocols to
       protect against loops.

   2.  If a local administrative preference favors a route that has been
       learned from a different routing protocol than RPL, the Configuration is
   cleared, then nodes can use that
       successor.

   3. this preinstalled, shared key to exchange
   messages normally: it can issue DIOs, DAOs, etc.

   If there is an entry in the routing table matching the
       destination that has been learned from a multicast destination
       advertisement (e.g. 'A' bit of the destination Configuration option is set:

   1.  A node MUST NOT advertise a one-hop neighbor), then
       use that successor.

   4.  If there is an entry Rank besides INFINITE_RANK in the routing table matching the
       destination secure
       DIOs secured with Key Index 0x00.  If a node receives a secure
       DIO that has been learned from advertises a unicast destination
       advertisement (e.g. the destination Rank besides INFINITE_RANK and is located down the sub-
       DODAG), then use that successor.  If there are DAO Path Control
       bits associated secured
       with multiple successors, then consult the Path
       Control bits to order Key Index 0x00, it MUST discard the successors by preference when choosing.

   5.  If there is a DODAG version offering message without further
       processing.

   2.  Secure DAOs using Key Index 0x00 MUST NOT have a route to RPL Target
       option with a prefix matching besides the destination, then select one of those DODAG parents as node's address.  If a
       successor according to node
       receives a secured DAO using the OF and routing metrics.

   6.  Any other as-yet-unattempted DODAG parent may be chosen for preinstalled, shared key where
       the
       next attempt to forward a unicast packet when no better RPL Target option does not match
       exists.

   7.  If there the IPv6 source address, it
       MUST discard the secured DAO without further processing.

   The above rules mean that in RPL Instances where the 'A' bit is set,
   using Key Index 0x00 a DODAG version offering node can join the RPL Instance as a route host but
   not a router.  A node must communicate with a key authority to obtain
   a prefix matching
       the destination, but all DODAG parents have been tried and are
       temporarily unavailable (as determined by the forwarding
       procedure), then select a DODAG sibling key that will enable it to act as a successor (after
       appropriate router.  Obtaining this key
   might require authentication on one or both ends.  This message
   exchange is TBD.

9.4.  Counter and Counter Compression

   Every secured RPL packet marking for loop detection as described in
       Section 8.2.

   8.  Finally, if no DODAG siblings are available, has a Counter field.  Depending on whether
   the packet is
       dropped.  ICMP Destination Unreachable may be invoked (an
       inconsistency 'C' bit is detected).

   TTL must set, this Counter field can be decremented when forwarding. 1 or 4 bits.  RPL nodes
   send CC messages to force uncompressed Counter values, protecting
   against replay attacks and synchronizing counters.

   1.  If the packet a node is being
   forwarded via sending a sibling, then secured RPL packet, and the TTL may be decremented more
   aggressively (by Counter value
       of the packet is more than one) 255 greater than the last secured
       packet to limit the impact of possible
   loops.

   Note that destination address, the chosen successor node MUST NOT be set the neighbor that was 'C'
       bit of the
   predecessor security section of the packet (split horizon), except in packet.

   2.  If a node receives a secure RPL message with the case where
   it C bit set and is intended for
       uncertain of the packet to change from an up 32-bit counter value, it MAY send a CC message
       with the R bit cleared to obtain an down flow,
   such as switching from DIO routes to DAO routes as uncompressed counter value.
       The Nonce field of the destination is
   neared.

8.2.  Loop Avoidance and Detection

   RPL loop avoidance mechanisms are kept simple and designed to
   minimize churn and states.  Loops may form for CC message SHOULD be a number of reasons,
   from control packet loss to sibling forwarding.  RPL includes random or
       pseudorandom number.

   3.  If a
   reactive loop detection technique that protects from meltdown and
   triggers repair of broken paths.

   RPL loop detection uses information that is placed into the packet.
   A future version of this specification will detail how this
   information is carried node receives a unicast CC message with the packet (e.g. R bit cleared,
       and it is a hop-by-hop option
   ([I-D.hui-6man-rpl-option]) member of or summarized somehow into the flow
   label).  For is in the purpose process of RPL operations, joining the information carried
       associated DODAG, it SHOULD respond with a packet is constructed follows:

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |O|S|R|F|0|0|0|0| RPLInstanceID |          SenderRank           |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                          RPL Packet Information

   Down 'O' bit:  1-bit flag indicating whether the packet is expected unicast CC message to progress up or down.  A router sets
       the 'O' bit when the
         packet is expect to progress down (using DAO routes), and
         resets it when forwarding towards sender.  This response MUST have the root C bit of the DODAG
         version.  A host or RPL leaf node security
       section cleared, MUST set have the R bit to 0.

   Sibling 'S' bit:  1-bit flag indicating whether the packet has been
         forwarded via a sibling at set, and MUST have the present rank, same
       Nonce, RPLInstanceID and denotes a risk
         of DODAGID fields as the message it
       received.

   4.  If a sibling loop.  A host or RPL leaf node receives a multicast CC message, it MUST set discard the bit
       message with no further processing.

   These rules allow nodes to
         0.

   Rank-Error 'R' bit:  1-bit flag indicating whether a rank error was
         detected.  A rank error is detected compress the Counter when there destinations who
   received the prior packet can determine the full counter value.  If a
   node cannot determine the full counter value, it can request the full
   counter with a CC message.

9.4.1.  Timestamp Counters

   In the simplest case, the Counter value is an unsigned integer that a mismatch
   node increments by one or more on each secured RPL transmission.  The
   Counter MAY represent a timestamp that has the following properties:

   1.  The timestamp MUST be at least six octets long.

   2.  The timestamp MUST be in 1kHz (millisecond) granularity.

   3.  The timestamp start time MUST be January 1, 2010, 12:00:00AM UTC.

   4.  If the relative ranks and Counter represents such as timestamp, the direction Counter value
       MUST be a value computed as indicated follows.  Let T be the timestamp, S
       be the start time of the key in use, and E be the 'O'
         bit.  A host or RPL leaf end time of the
       key in use.  Both S and E are represented using the same 3 rules
       as the timestamp described above.  If E > T < S, then the Counter
       is invalid and a node MUST set NOT generate a packet.  Otherwise, the bit
       Counter value is equal to 0.

   Forwarding-Error 'F' bit:  1-bit flag indicating that this T-S.

   5.  If the Counter represents such a timestamp, a node can
         not forward MAY set the packet further towards
       'T' flag of the destination.  The
         'F' bit might be set by sibling that can security section of secured RPL packets.

   6.  If the Counter field does not forward to present such a
         parent timestamp, then a packet with
       node MUST NOT set the Sibling 'S' bit set, or by 'T' flag.

   7.  If a child node that does not have a route to destination for a packet
         with local timestamp that satisfies the down 'O' bit
       above requirements, it MUST ignore the 'T' flag.

   If a node supports such timestamps and it receives a message with the
   'T' flag set, it MAY apply the temporal check on the received message
   described in Section 9.5.2.1.  If a node receives a message without
   the 'T' flag set, it MUST NOT apply this temporal check.  A node's
   security policy MAY, for application reasons, include rejecting all
   messages without the 'T' flag set.

9.5.  Functional Description of Packet Protection

9.5.1.  Transmission of Outgoing Packets

   Given an outgoing RPL control packet and required security
   protection, this section describes how RPL generates the secured
   packet to transmit.  It describes the order of cryptographic
   operations to provide the required protection.

   A host or RPL leaf node MUST set the bit security section (KIM, LVL, T, and Sec) in
   the RPL packet to 0.

   RPLInstanceID:  8-bit describe the required protection level.

   The Counter field indicating of the DODAG instance along which security header MUST be an increment of the packet is sent.

   SenderRank:  16-bit
   last Counter field set to zero by transmitted.

   If the source and RPL packet is not a response to
         DAGRank(rank) by a router that forwards inside Consistency Check message,
   the RPL network.

8.2.1.  Source Node Operation

   If node MAY set the source is aware Counter Compression flag of the RPLInstanceID that security option,
   following the rules in Section 9.4.

   If the Key Identifier Mode (KIM) is preferred 3 (signature key used), and the
   Security Level (LVL) calls for encryption, the
   packet, then it transmitter MUST set
   include the RPLInstanceID field associated with Key Source Identifier and Key Index in the
   packet accordingly, otherwise it security
   section and append a signature using its signature key.

   A node MUST set it to replaced the
   RPL_DEFAULT_INSTANCE.

8.2.2.  Router Operation

8.2.2.1.  Instance Forwarding

   Instance IDs are used to avoid loops between DODAGs from different
   origins.  DODAGs that constructed for antagonistic constraints might
   contain paths that, if mixed together, would yield loops.  Those
   loops are avoided by forwarding a original packet along the DODAG payload with that is
   associated to a given instance.

   The RPLInstanceID is associated by payload
   encrypted using the source with security protection, key, and nonce specified in
   the packet. security section.

9.5.2.  Reception of Incoming Packets

   This
   RPLInstanceID MUST match the RPL Instance onto which section describes the packet is
   placed by any node, be it a host or router.  For traffic originating
   outside reception of the RPL domain there may be a mapping occurring at the
   gateway into the secured RPL domain, possibly based on packet.  Given
   an encoding within the
   flow label.  This aspect of incoming RPL operation is to be clarified in a
   future packet, this section describes now RPL generates an
   unencrypted version of this specification.

   When a router receives a the packet that specifies a given RPLInstanceID and validates its integrity.

   The receiver uses the node can forward the packet along security control field of the DODAG associated security section
   to
   that instance, then the router MUST do so and leave the RPLInstanceID
   value unchanged. determine what processing to do.  If any node can the described level of
   security does not forward meet locally maintained security policies, a packet along the DODAG associated to
   the RPLInstanceID, then the node SHOULD
   MAY discard the packet and send
   an ICMP error message.

8.2.2.2.  DAG Inconsistency Loop Detection

   The DODAG is inconsistent if without further processing.  These policies
   can include security levels, keys used, source identifiers, or the direction
   lack of timestamp-based counters (the 'T' flag).

   Using a packet does not match nonce derived from the Counter field and other information
   (as described in Section Figure 24), the rank relationship.  A receiver detects an inconsistency if it
   receives a packet with either: checks the 'O' bit set (to down) from a node
   integrity of the packet.  If this integrity check does not pass, a higher rank.
   node MUST discard the 'O' bit reset (for up) from packet.

   RPL uses the key information described in a RPL message to decrypt
   its contents as necessary.  Once a message has passed its integrity
   checks and been successfully decrypted, the node can update its local
   security information, such as the source's expected counter value for
   counter compression.  A node MUST NOT update security information on
   receipt of a lesser rank. message that fails security policy checks, integrity
   checks, or decryption.

9.5.2.1.  Timestamp Key Checks

   If the 'S' bit 'T' flag of a message is set (to sibling) from and a node of has a different rank.

   When the DODAG root increments local timestamp
   that follows the DODAGVersionNumber requirements in Section 9.4.1, then a temporary
   rank discontinuity may form between the next version and node MAY check
   the prior
   version, in particular if nodes are adjusting their rank in temporal consistency of the next
   version and deferring their migration into message.  The node computes the next version.  A
   router that is still a member
   transmit time of the prior version may choose to
   forward a packet to a (future) parent that is in the next version.
   In some cases this could cause message by adding the parent Counter value to detect an inconsistency
   because the rank-ordering in start
   time of the prior version associated key.  If this transmit time is not necessarily past the
   same as in end
   time of the next version and key, the packet may be judged to not be
   making forward progress. node MAY discard the message without further
   processing.  If the sending router transmit time is aware that the
   chosen successor has already joined the next version, then the
   sending router MUST update too far in the SenderRank past or future
   compared to INFINITE_RANK as it
   forwards the packets across local time on the discontinuity into receiver, it MAY discard the next DODAG
   version in order to avoid a false detection
   message without further processing.

9.5.3.  Cryptographic Mode of rank inconsistency.

   One inconsistency along the path Operation

   The cryptographic mode of operation used is not considered as a critical
   error and the packet may continue.  But a second detection along based on the
   path CCM mode of a same packet should not occur
   operation and the packet is dropped. block-cipher AES-128[RFC3610].  This process mode of
   operation is controlled widely supported by the Rank-Error bit associated existing implementations and
   coincides with the
   packet.  When an inconsistency is detected on CCM* mode of operation[CCMStar].  CCM mode
   requires a packet, if the Rank-
   Error bit was not nonce.

9.5.3.1.  Nonce

   A RPL node constructs a CCM nonce as follows:

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                                                               |
       +                       Source Identifier                       +
       |                                                               |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                            Counter                            |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |Reserved | LVL |
       +-+-+-+-+-+-+-+-+

                           Figure 24: CCM* Nonce

   Source Identifier:  8 bytes.  Source Identifier is set then to the Rank-Error bit logical
         identifier of the originator of the protected packet.

   Counter:  4 bytes.  Counter is set.  If it was set to the packet is discarded and (uncompressed) value of the trickle timer is reset.

8.2.2.3.  Sibling Loop Avoidance

   When a packet is forwarded along siblings, it cannot be checked for
   forward progress and may loop between siblings.  Experimental
   evidence has shown that one sibling hop can be very useful and
         corresponding field in the Security option of the RPL control
         message.

   Security Level (LVL):  3 bits.  Security Level is
   generally sufficient set to avoid loops.  Based on that evidence, this
   specification enforces the simple rule that a packet may not make 2
   sibling hops in a row.

   When a host issues a packet or when a router forwards a packet to a
   non-sibling, value of
         the Sibling bit corresponding field in the packet must Security option of the RPL
         control message.

   Unassigned bits of the nonce are reserved.  They MUST be reset.  When a
   router forwards set to a sibling: if zero
   when constructing the Sibling bit was not set then nonce.

   All fields of the
   Sibling bit nonce shall be represented is set. most-significant-
   octet and most-significant-bit first order.

9.5.3.2.  Signatures

   If the Sibling bit was set then then the router
   SHOULD return Key Identification Mode (KIM) mode indicates the packet use of
   signatures (a value of 3), then a node appends a signature to the sibling that that passed it with
   data payload of the
   Forwarding-Error 'F' bit set and packet.  The Security Level (LVL) field describes
   the 'S' bit left untouched.

8.2.2.4.  DAO Inconsistency Loop Detection and Recovery

   A DAO inconsistency happens when router that has an down DAO route
   via a child that length of this signature.

   The signature scheme in RPL for Security Mode 00 is a remnant from an obsolete state that is not
   matched in the child.  With DAO inconsistency loop recovery, a packet
   can be used to recursively explore and cleanup instantiation
   of the obsolete DAO
   states along a sub-DODAG.

   In a general manner, a packet that goes down should never go up
   again.  If DAO inconsistency loop recovery is applied, then the
   router SHOULD send ECPVS signature scheme[X9.92].  It uses as an elliptic curve
   the packet back to named curve K-283[X9.92].  It uses CCM* mode[CCMStar] as the parent that passed it
   encryption scheme with M=0 (as a stream-cipher).  It uses the Forwarding-Error 'F' bit set Matyas-
   Meyer-Oseas unkeyed hash function[AppliedCryptography].  It uses the
   key derivation function based on this unkeyed hash function specified
   in Section 5.6.3 of [X9.63-2001], and the 'O' bit left untouched.
   Otherwise message encoding rule of
   Section 7.8 or ANSI X9.92 [X9.92].  PadLen is a non-negative integer
   set to M-OctCurve, where OctCurve is the router MUST silently discard byte-length of the packet.

8.2.2.5.  Forward Path Recovery

   Upon receiving curve in
   question (with K-283, one has OctCurve=36).

   Let 'a' be a packet with concatenation of a Forwarding-Error bit set, six-byte representation of Counter
   and the node
   MUST remove message header.  The packet payload is a concatenation of
   packet data 'c' and the routing states that caused forwarding to that
   neighbor, clear signature 's'.  This signature scheme is
   invoked with visible and recoverable message parts a and c, whereas
   the Forwarding-Error bit signature verification is invoked with as received visible and attempt to send
   message representative a, c, and with signature s.

9.6.  Coverage of Integrity and Confidentiality

   For a RPL ICMPv6 message, the entire packet again. is within the scope of
   RPL security.  The packet message authentication code is calculated over the
   entire IPv6 packet.  This calculation is done before any compression
   that lower layers may apply.  The IPv6 and ICMPv6 headers are never
   encrypted.  The body of the RPL ICMPv6 message MAY be sent to an alternate neighbor.  If
   that alternate neighbor still has an inconsistent DAO state via this
   node, encrypted,
   starting from the process will recurse, this node will set first byte after the Forwarding-
   Error 'F' bit security section and
   continuing to the routing state in the alternate neighbor will be
   cleaned up as well.

9.  Multicast Operation

   This section describes further end of the multicast routing operations over
   an IPv6 RPL network, packet.

10.  Packet Forwarding and specifically how unicast DAOs can be used Loop Avoidance/Detection

10.1.  Suggestions for Packet Forwarding

   When forwarding a packet to
   relay group registrations up.  Wherever the following text mentions
   Multicast Listener Discovery (MLD), one can read MLDv1 ([RFC2710]) or
   MLDv2 ([RFC3810]).

   As is traditional, a listener uses destination, precedence is given to
   selection of a protocol such next-hop successor as MLD with a
   router to register to follows:

   1.  This specification only covers how a multicast group.

   Along successor is selected from
       the path between DODAG version that matches the router and RPLInstanceID marked in the DODAG root, MLD requests
   are mapped and transported as DAO messages within
       IPv6 header of the RPL protocol;
   each hop coalesces packet being forwarded.  Routing outside the multiple requests for a same group
       instance can be done as a single
   DAO message to the parent(s), long as additional rules are put in a fashion similar to proxy IGMP, but
   recursively between child router place
       such as strict ordering of instances and parent up to the root.

   A router might select routing protocols to pass
       protect against loops.

   2.  If a listener registration DAO message to
   its preferred parent only, in which case multicast packets coming
   back might be lost for all of its sub-DODAG if the transmission fails
   over local administrative preference favors a route that link.  Alternatively has been
       learned from a different routing protocol than RPL, then use that
       successor.

   3.  If the router might select to copy
   additional parents as it would do for DAO messages advertising
   unicast destinations, in which case there might be duplicates that
   the router will need to prune.

   As packet header specifies a result, multicast routing states are installed in each router on
   the way from source route, then use that
       route [I-D.hui-6man-rpl-routing-header].  If the listeners node fails to
       forward the root, enabling the root to copy a
   multicast packet to all its children routers that had issued a DAO
   message including a DAO for that multicast group, as well as all the
   attached nodes with that registered over MLD.

   For unicast traffic, it is expected specified source route, then that the grounded root of
       packet SHOULD be dropped.  The node MAY log an
   DODAG terminates RPL and error.  The node
       MAY redistribute the RPL routes over send an ICMPv6 Error in Source Routing Header message to the
   external infrastructure using whatever routing protocol
       DODAG root Section 17.6.

   4.  If there is used an entry in the other routing domain.  For multicast traffic, the root MAY proxy
   MLD for all the nodes attached to the RPL domain (this would be
   needed if table matching the
       destination that has been learned from a multicast source is located in destination
       advertisement (e.g. the external
   infrastructure).  For such destination is a source, the packet will be replicated as
   it flows down the DODAG based on one-hop neighbor), then
       use that successor.

   5.  If there is an entry in the multicast routing table entries
   installed from matching the DAO message.

   For
       destination that has been learned from a source inside the DODAG, unicast destination
       advertisement (e.g. the packet destination is passed to located down the preferred
   parents, and if that fails sub-
       DODAG), then to the alternates in use that successor.  If there are DAO Path Control
       bits associated with multiple successors, then consult the DODAG.  The
   packet is also copied Path
       Control bits to all the registered children, except for the
   one that passed order the packet.  Finally, if successors by preference when choosing.

   6.  If there is a listener in the
   external infrastructure then the DODAG root has version offering a route to further propagate
   the packet into the external infrastructure.

   As a result, prefix matching
       the destination, then select one of those DODAG Root acts parents as an automatic proxy Rendezvous
   Point for a
       successor according to the RPL network, OF and as source towards the Internet routing metrics.

   7.  Any other as-yet-unattempted DODAG parent may be chosen for all
   multicast flows started in the RPL LLN.  So regardless of whether
       next attempt to forward a unicast packet when no better match
       exists.

   8.  Finally the
   root packet is actually attached to dropped.  ICMP Destination Unreachable may
       be invoked (an inconsistency is detected).

   TTL must be decremented when forwarding.

   Note that the Internet, and regardless of whether chosen successor MUST NOT be the DODAG is grounded or floating, neighbor that was the root can serve inner multicast
   streams at all times.

10.  Maintenance of Routing Adjacency

   The selection
   predecessor of successors, along the default paths up along packet (split horizon), except in the
   DODAG, or along case where
   it is intended for the paths learned packet to change from destination advertisements
   down along the DODAG, leads an up to the formation of routing adjacencies
   that require maintenance.

   In IGPs an down flow,
   such as OSPF [RFC4915] or IS-IS [RFC5120], the maintenance of
   a routing adjacency involves the use of Keepalive mechanisms (Hellos)
   or other protocols such switching from DIO routes to DAO routes as BFD ([I-D.ietf-bfd-base]) and MANET
   Neighborhood Discovery Protocol (NHDP [I-D.ietf-manet-nhdp]).
   Unfortunately, such an approach the destination is not desirable in constrained
   environments such as LLN
   neared.

10.2.  Loop Avoidance and would lead to excessive control traffic
   in light of the data traffic with a negative impact on both link
   loads Detection

   RPL loop avoidance mechanisms are kept simple and nodes resources.  Overhead to maintain the routing
   adjacency should be minimized.  Furthermore, it is not always
   possible to rely on the link or transport layer to provide
   information of the associated link state.  The network layer needs designed to
   fall back on its own mechanism.

   Thus RPL makes use of
   minimize churn and states.  Loops may form for a different approach consisting number of probing the
   neighbor using reasons,
   e.g. control packet loss.  RPL includes a Neighbor Solicitation message (see [RFC4861]).  The
   reception reactive loop detection
   technique that protects from meltdown and triggers repair of a Neighbor Advertisement (NA) message with the
   "Solicited Flag" set broken
   paths.

   RPL loop detection uses information that is used to verify placed into the validity packet.
   A future version of this specification will detail how this
   information is carried with the routing
   adjacency.  Such mechanism MAY be used prior to sending packet (e.g. a data
   packet.  This allows for detecting whether hop-by-hop option
   ([I-D.hui-6man-rpl-option]) or not summarized somehow into the routing
   adjacency is still valid, and should it not be flow
   label).  For the case, select
   another feasible successor to forward purpose of RPL operations, the packet.

11.  Guidelines for Objective Functions

   An Objective Function (OF) allows for the selection of a DODAG to
   join, and information carried
   with a number of peers in that DODAG as parents.  The OF packet is used constructed follows:

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |O|R|F|0|0|0|0|0| RPLInstanceID |          SenderRank           |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                          RPL Packet Information

   Down 'O' bit:  1-bit flag indicating whether the packet is expected
         to compute an ordered list of parents.  The OF progress up or down.  A router sets the 'O' bit when the
         packet is also responsible expect to
   compute progress down (using DAO routes), and
         resets it when forwarding towards the rank root of the device within the DODAG
         version.

   The Objective Function  A host or RPL leaf node MUST set the bit to 0.

   Rank-Error 'R' bit:  1-bit flag indicating whether a rank error was
         detected.  A rank error is indicated detected when there is a mismatch in
         the DIO message using an
   Objective Code Point (OCP), relative ranks and the direction as specified indicated in
   [I-D.ietf-roll-routing-metrics], and indicates the method that must
   be used to construct 'O'
         bit.  A host or RPL leaf node MUST set the DODAG.  The Objective Code Points are
   specified in [I-D.ietf-roll-routing-metrics], [I-D.ietf-roll-of0],
   and related companion specifications.

11.1.  Objective Function Behavior

   Most Objective Functions are expected bit to follow 0.

   Forwarding-Error 'F' bit:  1-bit flag indicating that this node can
         not forward the same abstract
   behavior:

   o packet further towards the destination.  The parent selection is triggered each time an event indicates
      that a potential next hop information is updated.  This might
      happen upon the reception of a DIO message, a timer elapse, all
      DODAG parents are unavailable, or a trigger indicating that the
      state of a candidate neighbor has changed.

   o  An OF scans all the interfaces on the device.  Although there may
      typically be only one interface in most application scenarios,
      there might be multiple of them and an interface
         'F' bit might be
      configured to be usable or not for RPL operation.  An interface
      can also be configured with a preference or dynamically learned to
      be better than another set by some heuristics a child node that might be link-layer
      dependent and are out of scope.  Finally an interface might or does not
      match have a required criterion for an Objective Function, route
         to destination for instance
      a degree of security.  As a result some interfaces might be
      completely excluded from packet with the computation, while others might be
      more down 'O' bit set.  A host
         or less preferred.

   o  An OF scans all RPL leaf node MUST set the candidate neighbors on bit to 0.

   RPLInstanceID:  8-bit field indicating the possible interfaces DODAG instance along which
         the packet is sent.

   SenderRank:  16-bit field set to check whether they can act as a router for a DODAG.  There
      might be multiple of them zero by the source and a candidate neighbor might need to
      pass some validation tests before it can be used.  In particular,
      some link layers require experience on the activity with
         DAGRank(rank) by a router
      to enable that forwards inside the router as a next hop.

   o  An OF computes self's rank by adding to the rank of the candidate
      a value representing RPL network.

10.2.1.  Source Node Operation

   If the relative locations source is aware of self and the
      candidate in the DODAG version.

      *  The increase in rank must be at least MinHopRankIncrease.

      *  To keep loop avoidance and metric optimization in alignment, RPLInstanceID that is preferred for the increase in rank should reflect any increase in
   packet, then it MUST set the metric
         value.  For example, RPLInstanceID field associated with a purely additive metric such as ETX, the increase in rank can be made proportional
   packet accordingly, otherwise it MUST set it to the increase
         in the metric.

      *  Candidate neighbors
   RPL_DEFAULT_INSTANCE.

10.2.2.  Router Operation

10.2.2.1.  Instance Forwarding

   Instance IDs are used to avoid loops between DODAGs from different
   origins.  DODAGs that constructed for antagonistic constraints might
   contain paths that, if mixed together, would cause self's rank to increase yield loops.  Those
   loops are not considered for parent selection

   o  Candidate neighbors that advertise an OF incompatible with the set
      of OF specified avoided by forwarding a packet along the policy functions are ignored.

   o  As it scans all DODAG that is
   associated to a given instance.

   The RPLInstanceID is associated by the candidate neighbors, source with the OF keeps packet.  This
   RPLInstanceID MUST match the current
      best parent and compares its capabilities with RPL Instance onto which the current
      candidate neighbor.  The OF defines packet is
   placed by any node, be it a number host or router.  For traffic originating
   outside of tests that are
      critical to reach the objective.  A test between RPL domain there may be a mapping occurring at the routers
      determines an order relation.

      *  If
   gateway into the routers are equal for that relation then RPL domain, possibly based on an encoding within the next test
   flow label.  This aspect of RPL operation is attempted between to be clarified in a
   future version of this specification.

   When a router receives a packet that specifies a given RPLInstanceID
   and the routers,

      *  Else node can forward the best of packet along the two routers becomes DODAG associated to
   that instance, then the current best
         parent router MUST do so and leave the scan continues with the next candidate neighbor

      *  Some OFs may include RPLInstanceID
   value unchanged.

   If any node can not forward a test packet along the DODAG associated to compare
   the ranks that would
         result if RPLInstanceID, then the node joined either router

   o  When the scan is complete, SHOULD discard the preferred parent is elected packet and
      self's rank send
   an ICMP error message.

10.2.2.2.  DAG Inconsistency Loop Detection

   The DODAG is computed as inconsistent if the preferred parent rank plus direction of a packet does not match
   the step
      in rank relationship.  A receiver detects an inconsistency if it
   receives a packet with that parent.

   o  Other rounds either:

      the 'O' bit set (to down) from a node of scans might be necessary to elect alternate
      parents and siblings.  In a higher rank.

      the next rounds:

      *  Candidate neighbors that are not in 'O' bit reset (for up) from a node of a lesser rank.

   When the same DODAG are ignored

      *  Candidate neighbors that are of greater root increments the DODAGVersionNumber a temporary
   rank than self discontinuity may form between the next version and the prior
   version, in particular if nodes are
         ignored

      *  Candidate neighbors of an equal rank to self (siblings) are
         ignored for parent selection

      *  Candidate neighbors of a lesser adjusting their rank than self (non-siblings)
         are preferred

12.  RPL Constants in the next
   version and Variables

   Following deferring their migration into the next version.  A
   router that is still a summary member of RPL constants and variables.

   BASE_RANK  This is the rank for prior version may choose to
   forward a virtual root packet to a (future) parent that might is in the next version.
   In some cases this could cause the parent to detect an inconsistency
   because the rank-ordering in the prior version is not necessarily the
   same as in the next version and the packet may be used judged to
         coordinate multiple roots.  BASE_RANK has a value of 0.

   ROOT_RANK  This not be
   making forward progress.  If the sending router is aware that the rank for a DODAG root.  ROOT_RANK
   chosen successor has already joined the next version, then the
   sending router MUST update the SenderRank to INFINITE_RANK as it
   forwards the packets across the discontinuity into the next DODAG
   version in order to avoid a value false detection of MinHopRankIncrease (as advertised by rank inconsistency.

   One inconsistency along the DODAG root), such
         that DAGRank(ROOT_RANK) is 1.

   INFINITE_RANK  This path is not considered as a critical
   error and the constant maximum for the rank.
         INFINITE_RANK has packet may continue.  But a value second detection along the
   path of 0xFFFF.

   RPL_DEFAULT_INSTANCE a same packet should not occur and the packet is dropped.

   This process is controlled by the RPLInstanceID that Rank-Error bit associated with the
   packet.  When an inconsistency is used by this
         protocol by detected on a node without any overriding policy.
         RPL_DEFAULT_INSTANCE has a value of 0.

   DEFAULT_PATH_CONTROL_SIZE  TBD (To be determined)

   DEFAULT_DIO_INTERVAL_MIN  TBD (To be determined)

   DEFAULT_DIO_INTERVAL_DOUBLINGS  TBD (To be determined)
   DEFAULT_DIO_REDUNDANCY_CONSTANT  TBD (To be determined)

   DEFAULT_MIN_HOP_RANK_INCREASE  TBD a power of two (To be determined)

   DIO Timer  One instance per DODAG that a node packet, if the Rank-
   Error bit was not set then the Rank-Error bit is a member of.  Expiry
         triggers DIO message transmission.  Trickle timer with variable
         interval in [0, DIOIntervalMin..2^DIOIntervalDoublings].  See
         Section 6.3.1

   DAG Version Increment Timer  Up to one instance per DODAG that set.  If it was set
   the
         node packet is acting as DODAG root of.  May not be supported in all
         implementations.  Expiry triggers increment of
         DODAGVersionNumber, causing a new series of updated DIO message
         to be sent.  Interval should be chosen appropriate to
         propagation time of DODAG discarded and as appropriate to application
         requirements (e.g. response time vs. overhead).

   DelayDAO Timer  Up to one instance per DAO parent (the subset of
         DODAG parents chosen to receive destination advertisements) per
         DODAG.  Expiry triggers sending of DAO message to the trickle timer is reset.

10.2.2.3.  DAO
         parent.  See Section 7.1.6

   RemoveTimer  Up to one instance per Inconsistency Loop Detection and Recovery

   A DAO entry per neighbor (i.e.
         those neighbors inconsistency happens when router that have given has an down DAO messages to this node as route
   via a
         DODAG parent) Expiry triggers child that is a change in remnant from an obsolete state for that is not
   matched in the child.  With DAO
         entry, setting up inconsistency loop recovery, a packet
   can be used to do unreachable (No-Path) advertisements or
         immediately deallocating recursively explore and cleanup the obsolete DAO entry if there are no
   states along a sub-DODAG.

   In a general manner, a packet that goes down should never go up
   again.  If DAO
         parents.  See Section 7.1.4.1.1.3

13.  Manageability Considerations

   The aim of this section inconsistency loop recovery is to give consideration to applied, then the manageability
   of RPL, and how RPL will be operated in LLN beyond
   router SHOULD send the use of a MIB
   module.  The scope of this section is packet back to consider the following
   aspects of manageability: fault management, configuration, accounting
   and performance.

13.1.  Control of Function parent that passed it with
   the Forwarding-Error 'F' bit set and Policy

13.1.1.  Initialization Mode

   When the 'O' bit left untouched.
   Otherwise the router MUST silently discard the packet.

10.2.2.4.  Forward Path Recovery

   Upon receiving a packet with a Forwarding-Error bit set, the node is first powered up, it may either choose
   MUST remove the routing states that caused forwarding to stay silent that
   neighbor, clear the Forwarding-Error bit and not attempt to send any multicast DIO message until it has joined a DODAG,
   or the
   packet again.  The packet may be sent to immediately root a transient DODAG and start sending multicast
   DIO messages.  A RPL implementation SHOULD allow configuring whether an alternate neighbor.  If
   that alternate neighbor still has an inconsistent DAO state via this
   node, the process will recurse, this node should stay silent or should start advertising DIO messages.

   Furthermore, will set the implementation SHOULD to allow configuring whether
   or not Forwarding-
   Error 'F' bit and the node should start sending an DIS message routing state in the alternate neighbor will be
   cleaned up as an initial
   probe for nearby DODAGs, or should simply wait until it received DIO
   messages from other nodes that are part of existing DODAGs.

13.1.2.  DIO Base option

   RPL specifies a number of protocol parameters.

   A RPL implementation SHOULD allow configuring well.

11.  Multicast Operation

   This section describes further the following multicast routing
   protocol parameters, which are further described in Section 5.3:

   DAGPreference
   RPLInstanceID
   DAGObjectiveCodePoint
   DODAGID
   Routing Information
   Prefix Information
   DIOIntervalDoublings
   DIOIntervalMin
   DIORedundancyConstant

   DAG Root behavior:  In some cases, a node may not want operations over
   an IPv6 RPL network, and specifically how unicast DAOs can be used to permanently
         act as
   relay group registrations up.  Wherever the following text mentions
   Multicast Listener Discovery (MLD), one can read MLDv1 ([RFC2710]) or
   MLDv2 ([RFC3810]).

   As is traditional, a DODAG root if it cannot join listener uses a grounded DODAG.  For
         example protocol such as MLD with a battery-operated node may not want
   router to register to act as a multicast group.

   Along the path between the router and the DODAG
         root for a long period of time.  Thus a root, MLD requests
   are mapped and transported as DAO messages within the RPL implementation MAY
         support protocol;
   each hop coalesces the ability to configure whether or not multiple requests for a node could
         act same group as a DODAG root for a configured period of time.

   DODAG Table Entry Suppression  A RPL implementation SHOULD provide
         the ability single
   DAO message to configure a timer after the expiration of which
         logical equivalent of the DODAG table that contains all the
         records about parent(s), in a DODAG is suppressed, fashion similar to be invoked if the DODAG proxy IGMP, but
   recursively between child router and parent set becomes empty.

13.1.3.  Trickle Timers

   A RPL implementation makes use of trickle timer up to govern the sending
   of DIO message.  Such an algorithm is determined a by root.

   A router might select to pass a set listener registration DAO message to
   its preferred parent only, in which case multicast packets coming
   back might be lost for all of
   configurable parameters its sub-DODAG if the transmission fails
   over that are then advertised by link.  Alternatively the DODAG root
   along router might select to copy
   additional parents as it would do for DAO messages advertising
   unicast destinations, in which case there might be duplicates that
   the DODAG router will need to prune.

   As a result, multicast routing states are installed in DIO messages.

   For each DODAG, a RPL implementation MUST allow for the monitoring of router on
   the following parameters, further described in Section 6.3.1:

   I
   T
   C
   I_min
   I_doublings

   A RPL implementation SHOULD provide a command (for example via API,
   CLI, or SNMP MIB) whereby any procedure that detects an inconsistency
   may cause way from the trickle timer listeners to reset.

13.1.4.  DAG Version Number Increment

   A RPL implementation may allow by configuration at the DODAG root, enabling the root to
   refresh copy a
   multicast packet to all its children routers that had issued a DAO
   message including a DAO for that multicast group, as well as all the
   attached nodes that registered over MLD.

   For unicast traffic, it is expected that the grounded root of an
   DODAG states by updating terminates RPL and MAY redistribute the DODAGVersionNumber.  A RPL
   implementation SHOULD allow configuring whether or not periodic or
   event triggered mechanism are routes over the
   external infrastructure using whatever routing protocol is used by in
   the DODAG root to control
   DODAGVersionNumber change.

13.1.5.  Destination Advertisement Timers

   The following set of parameters of other routing domain.  For multicast traffic, the DAO messages SHOULD be
   configurable:

   o  The DelayDAO timer

   o  The Remove timer

13.1.6.  Policy Control

   DAG discovery enables nodes to implement different policies root MAY proxy
   MLD for
   selecting their DODAG parents.

   A RPL implementation SHOULD allow configuring all the set of acceptable
   or preferred Objective Functions (OF) referenced by their Objective
   Codepoints (OCPs) for a node nodes attached to join a DODAG, and what action should the RPL domain (this would be taken
   needed if none of a node's candidate neighbors advertise one of the
   configured allowable Objective Functions.

   A node in an LLN may learn routing information from different routing
   protocols including RPL.  It multicast source is located in this case desirable to control via
   administrative preference which route should the external
   infrastructure).  For such a source, the packet will be favored.  An
   implementation SHOULD allow for specifying an administrative
   preference for replicated as
   it flows down the DODAG based on the multicast routing protocol table entries
   installed from which the route was learned.

13.1.7.  Data Structures

   Some RPL implementation may limit DAO message.

   For a source inside the size of DODAG, the candidate neighbor
   list in order packet is passed to bound the memory usage, in which case some otherwise
   viable candidate neighbors may not be considered preferred
   parents, and simply dropped
   from the candidate neighbor list.

   A RPL implementation MAY provide an indicator on if that fails then to the size of alternates in the
   candidate neighbor list.

13.2.  Information and Data Models DODAG.  The information and data models necessary
   packet is also copied to all the registered children, except for the operation of RPL
   will be defined in a separate document specifying
   one that passed the RPL SNMP MIB.

13.3.  Liveness Detection and Monitoring

   The aim of this section packet.  Finally, if there is to describe a listener in the various RPL mechanisms
   specified
   external infrastructure then the DODAG root has to monitor further propagate
   the packet into the protocol. external infrastructure.

   As specified in Section 3.1, an implementation is expected to
   maintain a set of data structures in support of DODAG discovery:

   o  The candidate neighbors data structure

   o  For each DODAG:

      *  A set of result, the DODAG parents

13.3.1.  Candidate Neighbor Data Structure

   A node Root acts as an automatic proxy Rendezvous
   Point for the RPL network, and as source towards the Internet for all
   multicast flows started in the candidate neighbor list RPL LLN.  So regardless of whether the
   root is a node discovered by actually attached to the
   some means Internet, and qualified to potentially become regardless of neighbor whether
   the DODAG is grounded or a
   sibling (with high enough local confidence).  A RPL implementation
   SHOULD provide a way monitor floating, the candidate neighbors list with some
   metric reflecting local confidence (the degree root can serve inner multicast
   streams at all times.

12.  Maintenance of stability Routing Adjacency

   The selection of successors, along the
   neighbors) measured by some metrics.

   A RPL implementation MAY provide a counter reporting default paths up along the number of
   times a candidate neighbor has been ignored, should
   DODAG, or along the number of
   candidate neighbors exceeds paths learned from destination advertisements
   down along the maximum authorized value.

13.3.2.  Directed Acyclic Graph (DAG) Table

   For each DAG, a RPL implementation is expected DODAG, leads to keep track of the
   following DODAG table values:

   o  DODAGID

   o  DAGObjectiveCodePoint
   o  A set of prefixes offered upwards along the DODAG

   o  A set formation of DODAG Parents

   o  timer to govern routing adjacencies
   that require maintenance.

   In IGPs such as OSPF [RFC4915] or IS-IS [RFC5120], the sending maintenance of DIO messages for
   a routing adjacency involves the DODAG

   o  DODAGVersionNumber

   The set use of DODAG parents structure Keepalive mechanisms (Hellos)
   or other protocols such as BFD ([RFC5880]) and MANET Neighborhood
   Discovery Protocol (NHDP [I-D.ietf-manet-nhdp]).  Unfortunately, such
   an approach is itself a table with not desirable in constrained environments such as LLN
   and would lead to excessive control traffic in light of the
   following entries:

   o  A reference data
   traffic with a negative impact on both link loads and nodes
   resources.  Overhead to maintain the neighboring device which routing adjacency should be
   minimized.  Furthermore, it is not always possible to rely on the DAG parent

   o  A record of most recent
   link or transport layer to provide information taken from the DAG Information
      Object last processed from the DODAG Parent

   o  A flag reporting if of the Parent is a DAO Parent as described in
      Section 7

13.3.3.  Routing Table

   For each route provisioned by associated link
   state.  The network layer needs to fall back on its own mechanism.

   Thus RPL operation, makes use of a RPL implementation
   MUST keep track different approach consisting of probing the following:

   o  Routing Information (prefix, prefix length, ...)

   o  Lifetime Timer

   o  Next Hop

   o  Next Hop Interface

   o  Flag indicating that the route was provisioned from one of:

      *  Unicast DAO message

      *  DIO message

      *  Multicast DAO
   neighbor using a Neighbor Solicitation message

13.3.4.  Other RPL Monitoring Parameters

   A RPL implementation SHOULD provide (see [RFC4861]).  The
   reception of a counter reporting Neighbor Advertisement (NA) message with the number
   "Solicited Flag" set is used to verify the validity of
   a times the node has detected an inconsistency with respect routing
   adjacency.  Such mechanism MAY be used prior to sending a
   DODAG parent, e.g. if data
   packet.  This allows for detecting whether or not the DODAGID has changed.

   A RPL implementation MAY log routing
   adjacency is still valid, and should it not be the reception of a malformed DIO message
   along with case, select
   another feasible successor to forward the neighbor identification if avialable.

13.3.5.  RPL Trickle Timers

   A RPL implementation operating on a DODAG root MUST allow packet.

13.  Guidelines for Objective Functions

   An Objective Function (OF) allows for the
   configuration selection of the following trickle parameters:

   o  The DIOIntervalMin expressed a DODAG to
   join, and a number of peers in ms

   o that DODAG as parents.  The DIOIntervalDoublings

   o OF is used
   to compute an ordered list of parents.  The DIORedundancyConstant

   A RPL implementation MAY provide a counter reporting OF is also responsible to
   compute the number rank of
   times an inconsistency (and thus the trickle timer has been reset).

13.4.  Verifying Correct Operation

   This section has to be completed device within the DODAG version.

   The Objective Function is indicated in further revision of this document
   to list potential Operations the DIO message using an
   Objective Code Point (OCP), and Management (OAM) tools indicates the method that could must be
   used for verifying to construct the correct operation of RPL.

13.5.  Requirements on Other Protocols DODAG.  The Objective Code Points are specified
   in [I-D.ietf-roll-of0], and Functional Components

   RPL does not have any impact on related companion specifications.

13.1.  Objective Function Behavior

   Most Objective Functions are expected to follow the operation of existing protocols.

13.6.  Impact on Network Operation

   To be completed.

14.  Security Considerations

      +----------------------------------------------------------------+
      |                                                                |
      |                             TBD                                |
      |                     Under Construction                         |
      |            Deference given to Security Design Team             |
      |                                                                |
      +----------------------------------------------------------------+

14.1.  Overview

   From a security perspective, RPL networks are no different from any
   other network.  They are vulnerable to passive eavesdropping attacks
   and potentially even active tampering when physical access to same abstract
   behavior:

   o  The parent selection is triggered each time an event indicates
      that a wire potential next hop information is not required to participate in communications.  The very nature of
   ad hoc networks and their cost objectives impose additional security
   constraints, which perhaps make these networks updated.  This might
      happen upon the most difficult
   environments to secure.  Devices are low-cost and have limited
   capabilities in terms reception of computing power, available storage, and
   power drain; and it cannot always be assumed they have neither a
   trusted computing base nor DIO message, a high-quality random number generator
   aboard.  Communications cannot rely on the online availability of timer elapse, all
      DODAG parents are unavailable, or a
   fixed infrastructure and might involve short-term relationships
   between devices trigger indicating that may never have communicated before.  These
   constraints might severely limit the choice of cryptographic
   algorithms and protocols and influence the design
      state of a candidate neighbor has changed.

   o  An OF scans all the security
   architecture because interfaces on the establishment and maintenance device.  Although there may
      typically be only one interface in most application scenarios,
      there might be multiple of trust
   relationships between devices need them and an interface might be
      configured to be addressed with care.  In
   addition, battery lifetime and cost constraints put severe limits on
   the security overhead these networks usable or not for RPL operation.  An interface
      can tolerate, something also be configured with a preference or dynamically learned to
      be better than another by some heuristics that is might be link-layer
      dependent and are out of far less concern with higher bandwidth networks.  Most scope.  Finally an interface might or not
      match a required criterion for an Objective Function, for instance
      a degree of these
   security architectural elements can security.  As a result some interfaces might be implemented at higher layers
   and may, therefore,
      completely excluded from the computation, while others might be considered
      more or less preferred.

   o  An OF scans all the candidate neighbors on the possible interfaces
      to check whether they can act as a router for a DODAG.  There
      might be outside the scope multiple of this
   standard.  Special care, however, needs them and a candidate neighbor might need to
      pass some validation tests before it can be exercised with respect
   to interfaces to these higher layers.

   The security mechanisms in this standard are based used.  In particular,
      some link layers require experience on symmetric-key
   and public-key cryptography and use keys that are the activity with a router
      to be provided enable the router as a next hop.

   o  An OF computes self's rank by
   higher layer processes.  The establishment and maintenance of these
   keys are outside adding to the scope rank of this standard.  The mechanisms assume the candidate
      a
   secure implementation value representing the relative locations of cryptographic operations and secure self and
   authentic storage of keying material.

   The security mechanisms specified provide particular combinations of the following security services:

   Data confidentiality:  Assurance that transmitted information is only
               disclosed to parties for which it is intended.

   Data authenticity:  Assurance of
      candidate in the source of transmitted
               information (and, hereby, that information was not
               modified DODAG version.

      *  The increase in transit).

   Replay protection:  Assurance that a duplicate of transmitted
               information is detected.

   Timeliness (delay protection):  Assurance that transmitted
               information was received rank must be at least MinHopRankIncrease.

      *  To keep loop avoidance and metric optimization in alignment,
         the increase in rank should reflect any increase in the metric
         value.  For example, with a timely manner.

   The actual protection provided purely additive metric such as ETX,
         the increase in rank can be adapted on a per-packet basis
   and allows for varying levels of data authenticity (to minimize
   security overhead made proportional to the increase
         in transmitted packets where required) and the metric.

      *  Candidate neighbors that would cause self's rank to increase
         are not considered for
   optional data confidentiality.  When nontrivial protection is
   required, replay protection is always provided.

   Replay protection is provided via parent selection

   o  Candidate neighbors that advertise an OF incompatible with the use set
      of a non-repeating value
   (nonce) in OF specified by the packet protection process policy functions are ignored.

   o  As it scans all the candidate neighbors, the OF keeps the current
      best parent and storage of some status
   information for each originating device on compares its capabilities with the receiving device,
   which allows detection current
      candidate neighbor.  The OF defines a number of whether this particular nonce value was
   used previously by tests that are
      critical to reach the originating device.  In addition, so-called
   delay protection is provided amongst those devices that have a
   loosely synchronized clock on board.  The acceptable time delay can
   be adapted on a per-packet basis and allows objective.  A test between the routers
      determines an order relation.

      *  If the routers are equal for varying latencies (to
   facilitate longer latencies in packets transmitted over a multi-hop
   communication path).

   Cryptographic protection may use a key shared that relation then the next test
         is attempted between two peer
   devices (link key) or a key shared among a group the routers,

      *  Else the best of devices (group
   key), thus allowing some flexibility and application-specific
   tradeoffs between key storage the two routers becomes the current best
         parent and key maintenance costs versus the
   cryptographic protection provided.  If scan continues with the next candidate neighbor

      *  Some OFs may include a group key test to compare the ranks that would
         result if the node joined either router

   o  When the scan is used for peer-
   to-peer communication, protection complete, the preferred parent is provided only against outsider
   devices elected and not against potential malicious devices in the key-
   sharing group.

   Data authenticity may be provided using symmetric-key based or
   public-key based techniques.  With public-key based techniques (via
   signatures), one corroborates evidence
      self's rank is computed as to the unique originator of
   transmitted information, whereas preferred parent rank plus the step
      in rank with symmetric-key based techniques
   data authenticity is only provided relative that parent.

   o  Other rounds of scans might be necessary to devices elect alternate
      parents.  In the next rounds:

      *  Candidate neighbors that are not in a key-
   sharing group.  Thus, public-key based authentication may be useful
   in scenarios that require a more fine-grained authentication than can
   be provided with symmetric-key based authentication techniques alone,
   such as with group communications (broadcast, multicast), or in
   scenarios the same DODAG are ignored

      *  Candidate neighbors that require non-repudiation.

14.2.  Functional Description of Packet Protection

14.2.1.  Transmission are of Outgoing Packets

   This section describes the transmission greater rank than self are
         ignored

      *  Candidate neighbors of secured RPL control
   packets.  Give an outgoing equal rank to self are ignored for
         parent selection

      *  Candidate neighbors of a lesser rank than self are preferred

14.  RPL control packet Constants and required security
   protection, this section describes how RPL generates the secured
   packet to transmit.  It describes the order Variables

   Following is a summary of cryptographic
   operations to provide the required protection.

   A RPL node MUST set the security section in constants and variables.

   BASE_RANK  This is the RPL packet rank for a virtual root that might be used to
   describes the required protection level.

   The Counter field
         coordinate multiple roots.  BASE_RANK has a value of 0.

   ROOT_RANK  This is the security header MUST be an increment rank for a DODAG root.  ROOT_RANK has a value
         of MinHopRankIncrease (as advertised by the
   last Counter field transmitted.

   If the RPL packet DODAG root), such
         that DAGRank(ROOT_RANK) is 1.

   INFINITE_RANK  This is not a response to a Consistency Check message, the node MAY set constant maximum for the Counter Compression field rank.
         INFINITE_RANK has a value of 0xFFFF.

   RPL_DEFAULT_INSTANCE  This is the security
   option.  If the packet RPLInstanceID that is used by this
         protocol by a response to a Consistency Check message,
   the node MUST clear the Counter Compression field.

   A node sets the Key Identifier Mode (KIM) without any overriding policy.
         RPL_DEFAULT_INSTANCE has a value of the packet based on its
   understanding 0.

   DEFAULT_PATH_CONTROL_SIZE  TBD (To be determined)

   DEFAULT_DIO_INTERVAL_MIN  TBD (To be determined)

   DEFAULT_DIO_INTERVAL_DOUBLINGS  TBD (To be determined)

   DEFAULT_DIO_REDUNDANCY_CONSTANT  TBD (To be determined)

   DEFAULT_MIN_HOP_RANK_INCREASE  TBD a power of what keys destinations have.

   A two (To be determined)

   DIO Timer  One instance per DODAG that a node MUST replaced the original packet payload is a member of.  Expiry
         triggers DIO message transmission.  Trickle timer with variable
         interval in [0, DIOIntervalMin..2^DIOIntervalDoublings].  See
         Section 7.3.1

   DAG Version Increment Timer  Up to one instance per DODAG that payload
   encrypted using the security protection, key, and nonce specified
         node is acting as DODAG root of.  May not be supported in
   the security section.

14.2.2.  Reception of Incoming Packets

   This section describes the reception all
         implementations.  Expiry triggers increment of
         DODAGVersionNumber, causing a secured RPL packet.  Given
   an incoming RPL packet, this section describes now RPL generates an
   unencrypted version new series of the packet and validates its integrity.

   The receiver uses the security control field updated DIO message
         to be sent.  Interval should be chosen appropriate to
         propagation time of the security section DODAG and as appropriate to determine what processing application
         requirements (e.g. response time vs. overhead).

   DelayDAO Timer  Up to do.  If the described level one instance per DAO parent (the subset of
   security does not meet locally maintained security policies, a node
   MAY discard
         DODAG parents chosen to receive destination advertisements) per
         DODAG.  Expiry triggers sending of DAO message to the packet without further processing.  These policies
   can include security levels, keys used, or source identifiers.

   Using DAO
         parent.  See Section 8.4

   RemoveTimer  Up to one instance per DAO entry per neighbor (i.e.
         those neighbors that have given DAO messages to this node as a nonce derived from the Counter field and other information
   (as described
         DODAG parent) Expiry triggers a change in Section Figure 21), state for the receiver checks DAO
         entry, setting up to do unreachable (No-Path) advertisements or
         immediately deallocating the
   integrity DAO entry if there are no DAO
         parents.

15.  Manageability Considerations

   The aim of the packet by comparing the received MAC with the
   computed MAC.  If this integrity check does not pass, a node MUST
   discard section is to give consideration to the packet. manageability
   of RPL, and how RPL uses the key information described will be operated in a RPL message LLN.  The scope of this
   section is to decrypt
   its contents as necessary.  Once a message has passed its integrity
   checks consider the following aspects of manageability:
   configuration, monitoring, fault management, accounting, and been successfully decrypted,
   performance of the node can update its local
   security information, such as protocol in light of the source's expected counter value for
   counter compression.  A node MUST NOT update security information on
   receipt recommendations set forth
   in [RFC5706].

15.1.  Introduction

   Most of a message that fails security policy checks, integrity
   checks, or decryption.

14.2.3.  Cryptographic Mode the existing IETF management standards are Structure of Operation

   The cryptographic mode
   Management Information (SMI) based data models (MIB modules) to
   monitor and manage networking devices.

   For a number of operation protocols, the IETF community has used is based on the CCM mode of
   operation specified with [TBDREF] and IETF
   Standard Management Framework, including the block-cipher AES-128
   [TBDREF].  This mode Simple Network
   Management Protocol [RFC3410], the Structure of operation is widely supported by existing
   implementations Management
   Information [RFC2578], and coincides with MIB data models for managing new
   protocols.

   As pointed out in [RFC5706], the CCM* mode common policy in terms of operation
   specified with [TBDREF].

14.2.3.1.  Nonce

   The so-called nonce is constructed as follows:

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                                                               |
       +                       Source Identifier                       +
       |                                                               |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                            Counter                            |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |Reserved | LVL |
       +-+-+-+-+-+-+-+-+

                           Figure 21: CCM* Nonce

   Source Identifier:  8 bytes.  Source Identifier is set
   and management has been expanded to the logical
         identifier of the originator of the protected packet.

   Counter:  4 bytes.  Counter a policy that is set more open to the (uncompressed) value a
   set of tools and management protocols rather than strictly relying on
   a single protocol such as SNMP.

   In 2003, the
         corresponding field in Internet Architecture Board (IAB) held a workshop on
   Network Management [RFC3535] that discussed the Security option strengths and
   weaknesses of the RPL control
         message.

   Security Level (LVL):  3 bits.  Security Level is set some IETF network management protocols and compared
   them to operational needs, especially configuration.

   One issue discussed was the value user-unfriendliness of the corresponding field in the Security option binary format
   of SNMP [RFC3410].  In the RPL
         control message.

   Unassigned bits case of the nonce are reserved.  They MUST LLNs, it must be set to zero
   when constructing noted that at the nonce.

   All fields
   time of writing, the nonce shall be represented is most-significant-
   octet and most-significant-bit first order.

14.3.  Protecting RPL ICMPv6 messages

   For a RPL ICMPv6 message, the entire packet CoRE Working Group is within the scope actively working on
   resource management of
   RPL security.  The message authentication code devices in LLNs.  Still, it is calculated over the
   entire IPv6 packet.  This calculation is done before any compression felt that lower layers may apply.  The IPv6 and ICMPv6 headers are never
   encrypted.  The body of the this
   section provides important guidance on how RPL ICMPv6 message MAY should be encrypted,
   starting from the first byte after the security information deployed,
   operated, and
   continuing to the end of the packet.

14.4.  Security State Machine

   A DAG root starting managed.

   As stated in [RFC5706], "A management information model should
   include a DODAG sets the RPL routing security policy for
   the entire DODAG.

   A member discussion of what is manageable, which aspects of a secure DODAG MUST conform to the policy set by the DAG
   root.  When starting a secure DODAG, the DAG root will send secure
   DIO messages.  A node attempting to join the DODAG will send a secure
   Authentication Request (AREQ)
   protocol need to the DAG root.  Nodes that be configured, what types of operations are not
   authenticated in a secure DODAG will allowed,
   what protocol-specific events might occur, which events can be unable to generate properly
   constructed secured RPL packets.
   counted, and for which events an operator should be notified".  These nodes
   aspects are discussed in state
   "unauthenticated".  A member detail in the following sections.

   RPL will be used on a variety of devices that may have resources such
   as memory varying from a secure DODAG MUST forward an AREQ
   packet very few Kbytes to the DAG root, and MUST NOT forward any other type several hundreds of packet
   from an unauthenticated node.

   The DAG root
   Kbytes and even Mbytes.  When memory is highly constrained, it may choose to respond
   not be possible to satisfy all the AREQ with requirements listed in this
   section.  Still it is worth listing all of these in an ARSP packet.
   This packet exhaustive
   fashion, and implementers will provide then determine which of these
   requirements could be satisfied according to the authenticating node with the
   cryptographic materials necessary to participate in RPL routing.
   Some authentication flows may involve the exchange of more than one
   AREQ or ARSP packets.

   The simplest authentication flow will involve available resources
   on the use of a single
   pre-installed network-wide authentication key.  The installation of
   this key is out of scope device.

15.2.  Configuration Management

15.2.1.  Initialization Mode

   "Architectural Principles of this document.  The authenticating node
   will use the pre-installed key to calculate a MIC for the AREQ
   packet.  The DODAG root will verify Internet" [RFC1958], Section 3.8,
   states: "Avoid options and parameters whenever possible.  Any options
   and parameters should be configured or negotiated dynamically rather
   than manually.  This especially true in LLNs where the authenticity number of the
   authenticating node using the same key.  The DODAG root, having
   previously chosen a single random instance-wide shared key, will send
   this key, encrypted
   devices may be large and authenticated with the pre-installed key, manual configuration is infeasible.  This
   has been taken into account in the ARSP packet.  The authenticating node, decoding this packet with
   the pre-installed key, will verify the authenticity design of RPL whereby the DODAG
   root.

   It is assumed that additional authentication and key exchange
   mechanisms will be included in future drafts
   root provides a number of parameters to the document.

   Periodic key updates will use devices joining the secure KU packet code.  The
   responsibility for initiating key update will reside with
   DODAG, thus avoiding cumbersome configuration on the DODAG
   root, routers and is out
   potential sources of scope misconfiguration (e.g. values of this document.

15.  IANA Considerations

15.1.  RPL Control Message

   The trickle timers,
   ...).  Still there are additional RPL Control Message is an ICMP information message type parameters that is a RPL
   implementation should allow to be used carry DODAG Information Objects, DODAG Information
   Solicitations, and Destination Advertisement Objects configured, which are discussed in support
   this section.

15.2.1.1.  DIS mode of
   RPL operation.

   IANA has defined an ICMPv6 Type Number Registry.  The suggested type
   value for the RPL Control Message operation upon boot-up

   When a node is 155, first powered up, it may either choose to be confirmed by IANA.

15.2.  New Registry for RPL Control Codes

   IANA is requested stay silent
   and not send any multicast DIO messages until it has joined a DODAG,
   or to create immediately root a registry, transient DODAG and start sending multicast
   DIO messages.  A RPL Control Codes, implementation SHOULD allow configuring whether
   the node should stay silent or should start advertising DIO messages.

   Furthermore, the implementation SHOULD allow configuring whether or
   not the node should start sending an DIS (optionally requesting DIO
   for a specific DODAG) message as an initial probe for nearby DODAGs,
   or should simply wait until it receives DIO messages from other
   neighboring nodes that are part of existing DODAGs.

15.2.2.  DIO and DAO Base Message and Options Configuration

   RPL specifies a number of protocol parameters considering the
   Code field large
   spectrum of applications where it will be used.  That said,
   particular attention has been given to limiting the ICMPv6 number of these
   parameters that must be configured on each RPL Control Message.

   New codes may router.  Instead, a
   number of the default values can be allocated only by an IETF Consensus action.  Each
   code should used, and when required these
   parameters can be tracked with provided by the DODAG root thus allowing for
   dynamic parameter setting.

   A RPL implementation SHOULD allow configuring the following qualities:

   o  Code

   o  Description routing
   protocol parameters.  As pointed out above, note that a large set of
   parameters is configured on the DODAG root.

15.2.3.  Protocol Parameters to be configured on every router in the LLN

   o  Defining RFC

   Three codes are currently defined:

   +------+----------------------------------------------+-------------+
   | Code | Description                                  | Reference   |
   +------+----------------------------------------------+-------------+
   | 0x00 | DODAG Information Solicitation               | This        |
   |      |                                              | document    |
   | 0x01 | DODAG Information Object                     | This        |
   |      |                                              | document    |
   | 0x02 | Destination Advertisement Object             | This        |
   |      |                                              | document    |
   | 0x80 | Secure DODAG Information Solicitation        | This        |
   |      |                                              | document    |
   | 0x81 | Secure DODAG Information Object              | This        |
   |      |                                              | document    |
   | 0x82 | Secure Destination Advertisement Object      | This        |
   |      |                                              | document    |
   | 0x83 | Secure Destination Advertisement Object      | This        |
   |      | Acknowledgment                               | document    |
   +------+----------------------------------------------+-------------+

                             RPL Control Codes

15.3.  New Registry for the Mode of Operation (MOP)  RPLInstanceID [DIO message, in DIO Control Field

   IANA is requested to create a registry for base message].  Although the Mode of Operation
   (MOP) DIO Control Field, which is contained in
      RPLInstanceID must be configured on the DIO Base.

   New fields may DODAG root, it must also
      be allocated only by an IETF Consensus action.  Each
   field configured as a policy on every node in order to determine
      whether or not the node should join a particular DODAG.  Note that
      a second RPLInstance can be tracked with configured on the following qualities: node, should it
      become root of a floating DODAG.

   o  Mode  Objective Code Point (OCP)

   o  DODAGID [DIO, DIO base option] and [DAO message when the D flag of Operation
      the DAO message is set).

   o  Capability description  Route Information (and preference) [DIO message, in Route
      Information option]

   o  Defining RFC

   Two values are currently defined:

          +-----+-------------------------------+---------------+
          | MOP | Description                   | Reference     |
          +-----+-------------------------------+---------------+
          |  00 | Non-Storing mode  Solicited Information [DIS message, in Solicited Information
      option].  Note that an RPL implementation SHOULD allow configuring
      when such messages should be sent and under which circumstances,
      along with the value of operation | This document |
          |  01 | Storing mode the RPLInstance ID, V/I/D flags.

   o  [I-D.ietf-roll-routing-metrics] specifies a number of operation     | This document |
          +-----+-------------------------------+---------------+

                              DIO Base Flags

15.4. metrics and
      constraints that could be used.  Thus a RPL Control Message Option

   IANA implementation should
      allow configuring the list of metrics that a node can accept and
      understand.  If a DIO is requested to create received with a registry for metric and/or constraint
      that is not understood, as specified in Section 7.5, the RPL Control Message
   Options

            +-------+-------------------------+---------------+
            | Value | Meaning                 | Reference     |
            +-------+-------------------------+---------------+
            |   0   | Pad1                    | This document |
            |   1   | PadN                    | This document |
            |   2   | DAG Metric Container    | This Document |
            |   3   | Routing Information     | This Document |
            |   4   | DAG Timer Configuration | This Document |
            |   5   | node
      would join as a leaf node.

   o  K flag [DAO message, in DAO base message].

   o  MOP (Mode of Operation) [DIO message, in DIO base message]

15.2.4.  Protocol Parameters to be configured on every non-root router
         in the LLN

   o  Target prefix [DAO, in RPL Target              | This Document |
            |   6   | option and DIO messages]

   o  Transit Information     | This Document |
            |   7   | Solicited Information   | This Document |
            |   8   | Prefix Information      | This Document |
            +-------+-------------------------+---------------+ information [DAO, Transit information option]: A RPL Control Message Options

16.  Acknowledgements

   The authors would like
      implementation SHOULD allow configuring whether a non-storing node
      provides the transit information in DAO messages.

   A node whose DODAG parent set is empty may become the DODAG root of a
   floating DODAG.  It may also set its DAGPreference such that it is
   less preferred.  Thus a RPL implementation MUST allow configuring the
   set of actions that the node should initiate in this case:

   o  Start its own (floating) DODAG: the new DODAGID must be configured
      in addition to acknowledge its DAGPreference

   o  Poison the review, feedback, and
   comments from Roger Alexander, Emmanuel Baccelli, Dominique Barthel,
   Yusuf Bashir, Phoebus Chen, Mathilde Durvy, Manhar Goindi, Mukul
   Goyal, Anders Jagd, JeongGil (John) Ko, Quentin Lampin, Jerry
   Martocci, Matteo Paris, Alexandru Petrescu, Joseph Reddy, and Don
   Sturek.

   The authors would like broken path (see procedure in Section 7.2.2.5)

   o  Trigger a local repair

15.2.5.  Parameters to acknowledge be configured on the guidance and input provided
   by DODAG root

   In addition, several other parameters are configured only on the ROLL Chairs, David Culler
   DODAG root and JP Vasseur.

   The authors would like to acknowledge prior contributions advertised in options carried in DIO messages.

   As specified in Section 7.3, a RPL implementation makes use of Robert
   Assimiti, Mischa Dohler, Julien Abeille, Ryuji Wakikawa, Teco Boot,
   Patrick Wetterwald, Bryan Mclaughlin, Carlos J. Bernardos, Thomas
   Watteyne, Zach Shelby, Caroline Bontoux, Marco Molteni, Billy Moon,
   and Arsalan Tavakoli, which have provided useful design
   considerations
   trickle timers to RPL.

17.  Contributors

   RPL is govern the result sending of the contribution DIO messages.  The operation
   of the following members trickle algorithm is determined by a set of the
   RPL Author Team, including the editors, and additional contributors
   as listed below:

   JP Vasseur
   Cisco Systems, Inc
   11, Rue Camille Desmoulins
   Issy Les Moulineaux,   92782
   France

   Email: jpv@cisco.com

   Thomas Heide Clausen
   LIX, Ecole Polytechnique, France

   Phone: +33 6 6058 9349
   EMail: T.Clausen@computer.org
   URI:   http://www.ThomasClausen.org/

   Philip Levis
   Stanford University
   358 Gates Hall, Stanford University
   Stanford, CA  94305-9030
   USA

   Email: pal@cs.stanford.edu

   Richard Kelsey
   Ember Corporation
   Boston, MA
   USA

   Phone: +1 617 951 1225
   Email: kelsey@ember.com

   Jonathan W. Hui
   Arch Rock Corporation
   501 2nd St. Ste. 410
   San Francisco, CA  94107
   USA

   Email: jhui@archrock.com

   Kris Pister
   Dust Networks
   30695 Huntwood Ave.
   Hayward,   94544
   USA

   Email: kpister@dustnetworks.com

   Anders Brandt
   Sigma Designs
   Emdrupvej 26A, 1.
   Copenhagen, DK-2100
   Denmark

   Email: abr@sdesigns.dk

   Stephen Dawson-Haggerty
   UC Berkeley
   Soda Hall, UC Berkeley
   Berkeley, CA  94720
   USA

   Email: stevedh@cs.berkeley.edu

18.  References
18.1.  Normative References

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

18.2.  Informative References

   [I-D.hui-6man-rpl-option]
              Hui, J. configurable
   parameters, which MUST be configurable and J. Vasseur, "RPL Option for Carrying RPL
              Information that are then advertised
   by the DODAG root along the DODAG in Data-Plane Datagrams",
              draft-hui-6man-rpl-option-00 (work DIO messages.

   o  DIOIntervalDoublings [DIO, in progress),
              March 2010.

   [I-D.hui-6man-rpl-routing-header]
              Hui, J., Vasseur, J., and D. Culler, "A Source Routing
              Header DODAG configuration option]

   o  DIOIntervalMin [DIO, in DODAG configuration option]

   o  DIORedundancyConstant [DIO, in DODAG configuration option]

   In addition, a RPL implementation SHOULD allow for RPL", draft-hui-6man-rpl-routing-header-00
              (work configuring the
   following set of RPL parameters:

   o  Path Control Size [DIO, in progress), May 2010.

   [I-D.ietf-bfd-base]
              Katz, D. and D. Ward, "Bidirectional Forwarding
              Detection", draft-ietf-bfd-base-11 (work DODAG configuration option]

   o  MinHopRankIncrease [DIO, in progress),
              January 2010.

   [I-D.ietf-manet-nhdp]
              Clausen, T., Dearlove, C., and J. Dean, "Mobile Ad Hoc
              Network (MANET) Neighborhood Discovery Protocol (NHDP)",
              draft-ietf-manet-nhdp-12 (work in progress), March 2010.

   [I-D.ietf-roll-building-routing-reqs]
              Martocci, J., Riou, N., Mil, P., and W. Vermeylen,
              "Building Automation Routing Requirements in Low Power and
              Lossy Networks", draft-ietf-roll-building-routing-reqs-09
              (work in progress), January 2010.

   [I-D.ietf-roll-of0]
              Thubert, P., "RPL Objective Function 0",
              draft-ietf-roll-of0-01 (work DODAG configuration option]

   o  The following flags: A, MOP (Mode of Operation), DODAGPreference
      field [DIO message, DIO Base object]

   o  Route information (list of prefixes with preference) [DIO message,
      in progress), February 2010.

   [I-D.ietf-roll-routing-metrics]
              Vasseur, J., Kim, M., Networks, D., Route Information option]

   o  The T flag allows for triggering a refresh of the downward routes.
      A RPL implementation SHOULD support manual setting of the T flag
      or upon the occurrence of a set of event such as the expiration of
      a configurable periodic timer.

   o  List of metrics and H. Chong, "Routing
              Metrics constraints used for Path Calculation in Low Power and Lossy
              Networks", draft-ietf-roll-routing-metrics-06 (work in
              progress), April 2010.

   [I-D.ietf-roll-terminology]
              Vasseur, J., "Terminology in Low power And Lossy
              Networks", draft-ietf-roll-terminology-03 (work in
              progress), March 2010.

   [I-D.ietf-roll-trickle]
              Levis, P., Clausen, T., Hui, J., and J. Ko, "The Trickle
              Algorithm", draft-ietf-roll-trickle-01 (work in progress),
              April 2010.

   [RFC1982]  Elz, R. the DODAG.

   o  Prefix information along with valid and R. Bush, "Serial Number Arithmetic", RFC 1982,
              August 1996.

   [RFC2710]  Deering, S., Fenner, W., preferred lifetime and B. Haberman, "Multicast
              Listener Discovery (MLD) for IPv6", RFC 2710,
              October 1999.

   [RFC3810]  Vida, R. the
      L and L. Costa, "Multicast Listener Discovery
              Version 2 (MLDv2) A flags.  [DIO message, Prefix Information option].  A RPL
      implementation SHOULD allow configuring if the Prefix Information
      Option must be carried with the DIO message to distribute the
      prefix information for IPv6", RFC 3810, June 2004.

   [RFC3819]  Karn, P., Bormann, C., Fairhurst, G., Grossman, D.,
              Ludwig, R., Mahdavi, J., Montenegro, G., Touch, J., auto-configuration.  In that case, the RPL
      implementation MUST allow the list of prefixes to be advertised in
      the Prefix Information Option along with the corresponding flags.

   DAG Root behavior: in some cases, a node may not want to permanently
   act as a floating DODAG root if it cannot join a grounded DODAG.  For
   example a battery-operated node may not want to act as a floating
   DODAG root for a long period of time.  Thus a RPL implementation MAY
   support the ability to configure whether or not a node could act as a
   floating DODAG root for a configured period of time.

   DAG Version Number Increment: a RPL implementation may allow by
   configuration at the DODAG root to refresh the DODAG states by
   updating the DODAGVersionNumber.  A RPL implementation SHOULD allow
   configuring whether or not periodic or event triggered mechanisms are
   used by the DODAG root to control DODAGVersionNumber change (which
   triggers a global repair as specified in Section 3.3.2.

15.2.6.  Configuration of RPL Parameters related to DAO-based mechanisms

   DAO messages are optional and used in DODAGs that require downward
   routing operation.  This section deals with the set of parameters
   related to DAO message and provides recommendations on their
   configuration.

   An implementation SHOULD bound the time that the entry is allocated
   in the UNREACHABLE state.  Upon the equivalent expiry of the related
   timer (RemoveTimer), the entry SHOULD be suppressed.  Thus a RPL
   implementation MAY allow for the configuration of the RemoveTimer.

   While the entry is in the UNREACHABLE state a node SHOULD make a
   reasonable attempt to report a No-Path to each of the DAO parents.
   That number of attempts MAY be configurable.

   When the associated Retry Counter for a REACHABLE(Pending) entry
   reaches a maximum threshold, the entry is placed into the UNREACHABLE
   state and No-Path should be scheduled to send to the node's DAO
   Parents.  The maximum threshold MAY be configurable.

   An implementation should support rate-limiting the sending of DAO
   messages.  The related parameters MAY be configurable.

   When scheduling to send a DAO, an implementation should equivalently
   start a timer (DelayDAO) to delay sending the DAO, thus helping to
   potentially aggregate DAOs.  The DelayDAO timer MAY be configurable.

15.2.7.  Default Values
15.3.  Monitoring of RPL Operation

   Several RPL parameters should be monitored to verify the correct
   operation of the routing protocol and the network itself.  This
   section lists the set of monitoring parameters of interest.

15.3.1.  Monitoring a DODAG parameters

   A RPL implementation SHOULD provide information about the following
   parameters:

   o  DODAG Version number [DIO message, in DIO base message]

   o  Status of the G flag [DIO message, in DIO base message]

   o  Status of the A flag [DIO message, in DIO base message]

   o  Value of the DTSN [DIO message, in DIO base message]

   o  Value of the rank [DIO message, in DIO base message]

   o  DAOSequence: Incremented at each unique DAO message, echoed in the
      DAO-ACK message [DAO and DAO-ACK messages]

   o  Route Information [DIO message, Route Information option] (list of
      IPv6 prefixes per parent along with lifetime and preference]

   o  Trickle parameters:

      *  DIOIntervalDoublings [DIO, in DODAG configuration option]

      *  DIOIntervalMin [DIO, in DODAG configuration option]

      *  DIORedundancyConstant [DIO, in DODAG configuration option]

   o  Path Control Size [DIO, in DODAG configuration option]

   o  MinHopRankIncrease [DIO, in DODAG configuration option]

   Values that may be monitored only on the DODAG root

   o  Transit Information [DAO, Transit Information option]: A RPL
      implementation SHOULD allow configuring whether the set of
      received Transit Information options should be displayed on the
      DODAG root.  In this case, the RPL database of received Transit
      Information should also contain: the path-sequence, path control,
      path lifetime and parent address.

15.3.2.  Monitoring a DODAG inconsistencies and loop detection

   Detection of DODAG inconsistencies is particularly critical in RPL
   networks.  Thus it is recommended for a RPL implementation to provide
   appropriate monitoring tools.  A RPL implementation SHOULD provide a
   counter reporting the number of a times the node has detected an
   inconsistency with respect to a DODAG parent, e.g. if the DODAGID has
   changed.

   When possible more granular information about inconsistency detection
   should be provided.  A RPL implementation MAY provide counters
   reporting the number of following inconsistencies:

   o  Packets received with O bit set (to down) from a node with a
      higher rank

   o  Packets received with O bit reset (to up) from a node with a lower
      rank

   o  Number of packets with the F bit set

   o  Number of packets with the R bit set

15.4.  Monitoring of the RPL data structures

15.4.1.  Candidate Neighbor Data Structure

   A node in the candidate neighbor list is a node discovered by the
   some means and qualified to potentially become a parent (with high
   enough local confidence).  A RPL implementation SHOULD provide a way
   to monitor the candidate neighbor list with some metric reflecting
   local confidence (the degree of stability of the neighbors) as
   measured by some metrics.

   A RPL implementation MAY provide a counter reporting the number of
   times a candidate neighbor has been ignored, should the number of
   candidate neighbors exceeds the maximum authorized value.

15.4.2.  Destination Oriented Directed Acyclic Graph (DAG) Table

   For each DODAG, a RPL implementation is expected to keep track of the
   following DODAG table values:

   o  RPLInstanceID

   o  DODAGID
   o  DODAGVersionNumber

   o  Rank

   o  Objective Code Point

   o  A set of DODAG Parents

   o  A set of prefixes offered upwards along the DODAG

   o  Trickle timers used to govern the sending of DIO messages for the
      DODAG

   o  List of DAO parents

   o  DTSN

   o  Node status (router versus leaf)

   A RPL implementation SHOULD allow for monitoring the set of
   parameters listed above.

15.4.3.  Routing Table and DAO Routing Entries

   A RPL implementation maintains several information elements related
   to the DODAG and the DAO entries (for storing nodes).  In the case of
   a non storing node, a limited amount of information is maintained
   (the routing table is mostly reduced to a set of DODAG parents along
   with characteristics of the DODAG as mentioned above) whereas in the
   case of storing nodes, this information is augmented with routing
   entries.

   A RPL implementation SHOULD provide the ability to monitor the
   following parameters:

   o  Next Hop (DODAG parent)

   o  Next Hop Interface

   o  Path metrics value for each DODAG parent

   A DAO Routing Table Entry conceptually contains the following
   elements (for storing nodes only):

   o  Advertising Neighbor Information

   o  IPv6 Address
   o  Interface ID to which DAO Parents has this entry been reported

   o  Retry Counter

   o  Logical equivalent of DAO Content:

      *  DAO Sequence

      *  DAO Lifetime

      *  DAO Path Control

   o  Destination Prefix (or Address or Mcast Group)

   A RPL implementation SHOULD provide information about the state of
   each DAO Routing Table entry states.

15.5.  Fault Management

   Fault management is a critical component used for troubleshooting,
   verification of the correct mode of operation of the protocol,
   network design, and is also a key component of network performance
   monitoring.  A RPL implementation SHOULD allow providing the
   following information related to fault managements:

   o  Memory overflow along with the cause (e.g. routing tables
      overflow, ...)

   o  Number of times a packet could not be sent to a DODAG parent
      flagged as valid

   o  Number of times a packet has been received for which the router
      did not have a corresponding RPLInstanceID

   o  Number of times a local repair procedure was triggered

   o  Number of times a global repair was triggered by the DODAG root

   o  Number of received malformed messages

   o  Number of seconds with packets to forward and no next hop (DODAG
      parent)

   o  Number of seconds without next hop (DODAG parent)

15.6.  Policy

   Policy rules can be used by a RPL implementation to determine whether
   or not the node is allowed to join a particular DODAG advertised by a
   neighbor by means of DIO messages.

   This document specifies operation within a single DODAG.  A DODAG is
   characterized by the following tuple (RPLInstanceID, DODAGID).
   Furthermore, as pointed out above, DIO messages are used to advertise
   other DODAG characteristics such as the routing metrics and
   constraints used to build to the DODAG and the Objective Function in
   use (specified by OCP).

   The first policy rules consists of specifying the following
   conditions that a RPL node must satisfy to join a DODAG:

   o  RPLInstanceID

   o  DODAGID

   o  List of supported routing metrics and constraints

   o  Objective Function (OCP values)

   A RPL implementation MUST allow configuring these parameters and
   SHOULD specify whether the node must simply ignore the DIO if the
   advertised DODAG is not compliant with the local policy or whether
   the node should join as the leaf node if only the list of supported
   routing metrics and constraints, and the OF is not supported.

   A RPL implementation SHOULD allow configuring the set of acceptable
   or preferred Objective Functions (OF) referenced by their Objective
   Codepoints (OCPs) for a node to join a DODAG, and what action should
   be taken if none of a node's candidate neighbors advertise one of the
   configured allowable Objective Functions.

   A node in an LLN may learn routing information from different routing
   protocols including RPL.  It is in this case desirable to control via
   administrative preference which route should be favored.  An
   implementation SHOULD allow for specifying an administrative
   preference for the routing protocol from which the route was learned.

   Internal Data Structures: some RPL implementations may limit the size
   of the candidate neighbor list in order to bound the memory usage, in
   which case some otherwise viable candidate neighbors may not be
   considered and simply dropped from the candidate neighbor list.

   A RPL implementation MAY provide an indicator on the size of the
   candidate neighbor list.

15.7.  Liveness Detection and Monitoring

   By contrast with several other routing protocols, RPL does not define
   any 'keep-alive' mechanisms to detect routing adjacency failure: this
   is in most cases, because such a mechanism may be too expensive in
   terms of bandwidth and even more importantly energy (a battery
   operated device could not afford to send periodic Keep alive).  Still
   RPL requires mechanisms to detect that a neighbor is no longer
   reachable: this can be performed by using mechanisms such as NUD
   (Neighbor Unreachability Detection) or even some form of Keep-alive
   that are outside of this document.

15.8.  Fault Isolation

   It is RECOMMENDED to quarantine neighbors that start emitting
   malformed messages at unacceptable rates.

15.9.  Impact on Other Protocols

   RPL has very limited impact on other protocols.  Where more than one
   routing protocol is required on a router such as a LBR, it is
   expected for the device to support routing redistribution functions
   between the routing protocols to allow for reachability between the
   two routing domains.  Such redistribution SHOULD be governed by the
   use of user configurable policy.

   With regards to the impact in terms of traffic on the network, RPL
   has been designed to limit the control traffic thanks to mechanisms
   such as Trickle timers (Section 7.3).  Thus the impact of RPL on
   other protocols should be extremely limited.

15.10.  Performance Management

   Performance management is always an important aspect of a protocol
   and RPL is not an exception.  Several metrics of interest have been
   specified by the IP Performance Monitoring (IPPM) Working Group: that
   being said, they will be hardly applicable to LLN considering the
   cost of monitoring these metrics in terms of resources on the devices
   and required bandwidth.  Still, RPL implementation MAY support some
   of these, and other parameters of interest are listed below:

   o  Number of repairs and time to repair in seconds (average,
      variance)

   o  Number of times and duration during which a devices could not
      forward a packet because of a lack of reachable neighbor in its
      routing table

   o  Monitoring of resources consumption by RPL itself in terms of
      bandwidth and required memory

   o  Number of RPL control messages sent and received

16.  Security Considerations

      +----------------------------------------------------------------+
      |                                                                |
      |                             TBD                                |
      |                     Under Construction                         |
      |            Deference given to Security Design Team             |
      |                                                                |
      +----------------------------------------------------------------+

16.1.  Overview

   From a security perspective, RPL networks are no different from any
   other network.  They are vulnerable to passive eavesdropping attacks
   and potentially even active tampering when physical access to a wire
   is not required to participate in communications.  The very nature of
   ad hoc networks and their cost objectives impose additional security
   constraints, which perhaps make these networks the most difficult
   environments to secure.  Devices are low-cost and have limited
   capabilities in terms of computing power, available storage, and
   power drain; and it cannot always be assumed they have neither a
   trusted computing base nor a high-quality random number generator
   aboard.  Communications cannot rely on the online availability of a
   fixed infrastructure and might involve short-term relationships
   between devices that may never have communicated before.  These
   constraints might severely limit the choice of cryptographic
   algorithms and protocols and influence the design of the security
   architecture because the establishment and maintenance of trust
   relationships between devices need to be addressed with care.  In
   addition, battery lifetime and cost constraints put severe limits on
   the security overhead these networks can tolerate, something that is
   of far less concern with higher bandwidth networks.  Most of these
   security architectural elements can be implemented at higher layers
   and may, therefore, be considered to be outside the scope of this
   standard.  Special care, however, needs to be exercised with respect
   to interfaces to these higher layers.

   The security mechanisms in this standard are based on symmetric-key
   and public-key cryptography and use keys that are to be provided by
   higher layer processes.  The establishment and maintenance of these
   keys are outside the scope of this standard.  The mechanisms assume a
   secure implementation of cryptographic operations and secure and
   authentic storage of keying material.

   The security mechanisms specified provide particular combinations of
   the following security services:

   Data confidentiality:  Assurance that transmitted information is only
               disclosed to parties for which it is intended.

   Data authenticity:  Assurance of the source of transmitted
               information (and, hereby, that information was not
               modified in transit).

   Replay protection:  Assurance that a duplicate of transmitted
               information is detected.

   Timeliness (delay protection):  Assurance that transmitted
               information was received in a timely manner.

   The actual protection provided can be adapted on a per-packet basis
   and allows for varying levels of data authenticity (to minimize
   security overhead in transmitted packets where required) and for
   optional data confidentiality.  When nontrivial protection is
   required, replay protection is always provided.

   Replay protection is provided via the use of a non-repeating value
   (nonce) in the packet protection process and storage of some status
   information for each originating device on the receiving device,
   which allows detection of whether this particular nonce value was
   used previously by the originating device.  In addition, so-called
   delay protection is provided amongst those devices that have a
   loosely synchronized clock on board.  The acceptable time delay can
   be adapted on a per-packet basis and allows for varying latencies (to
   facilitate longer latencies in packets transmitted over a multi-hop
   communication path).

   Cryptographic protection may use a key shared between two peer
   devices (link key) or a key shared among a group of devices (group
   key), thus allowing some flexibility and application-specific
   tradeoffs between key storage and key maintenance costs versus the
   cryptographic protection provided.  If a group key is used for peer-
   to-peer communication, protection is provided only against outsider
   devices and not against potential malicious devices in the key-
   sharing group.

   Data authenticity may be provided using symmetric-key based or
   public-key based techniques.  With public-key based techniques (via
   signatures), one corroborates evidence as to the unique originator of
   transmitted information, whereas with symmetric-key based techniques
   data authenticity is only provided relative to devices in a key-
   sharing group.  Thus, public-key based authentication may be useful
   in scenarios that require a more fine-grained authentication than can
   be provided with symmetric-key based authentication techniques alone,
   such as with group communications (broadcast, multicast), or in
   scenarios that require non-repudiation.

17.  IANA Considerations

17.1.  RPL Control Message

   The RPL Control Message is an ICMP information message type that is
   to be used carry DODAG Information Objects, DODAG Information
   Solicitations, and Destination Advertisement Objects in support of
   RPL operation.

   IANA has defined an ICMPv6 Type Number Registry.  The suggested type
   value for the RPL Control Message is 155, to be confirmed by IANA.

17.2.  New Registry for RPL Control Codes

   IANA is requested to create a registry, RPL Control Codes, for the
   Code field of the ICMPv6 RPL Control Message.

   New codes may be allocated only by an IETF Consensus action.  Each
   code should be tracked with the following qualities:

   o  Code

   o  Description

   o  Defining RFC

   Three codes are currently defined:

   +------+----------------------------------------------+-------------+
   | Code | Description                                  | Reference   |
   +------+----------------------------------------------+-------------+
   | 0x00 | DODAG Information Solicitation               | This        |
   |      |                                              | document    |
   | 0x01 | DODAG Information Object                     | This        |
   |      |                                              | document    |
   | 0x02 | Destination Advertisement Object             | This        |
   |      |                                              | document    |
   | 0x03 | Destination Advertisement Object             | This        |
   |      | Acknowledgment                               | document    |
   | 0x80 | Secure DODAG Information Solicitation        | This        |
   |      |                                              | document    |
   | 0x81 | Secure DODAG Information Object              | This        |
   |      |                                              | document    |
   | 0x82 | Secure Destination Advertisement Object      | This        |
   |      |                                              | document    |
   | 0x83 | Secure Destination Advertisement Object      | This        |
   |      | Acknowledgment                               | document    |
   +------+----------------------------------------------+-------------+

                             RPL Control Codes

17.3.  New Registry for the Mode of Operation (MOP) DIO Control Field

   IANA is requested to create a registry for the Mode of Operation
   (MOP) DIO Control Field, which is contained in the DIO Base.

   New fields may be allocated only by an IETF Consensus action.  Each
   field should be tracked with the following qualities:

   o  Mode of Operation

   o  Capability description

   o  Defining RFC

   Two values are currently defined:

          +-----+-------------------------------+---------------+
          | MOP | Description                   | Reference     |
          +-----+-------------------------------+---------------+
          |  00 | Non-Storing mode of operation | This document |
          |  01 | Storing mode of operation     | This document |
          +-----+-------------------------------+---------------+

                              DIO Base Flags

17.4.  RPL Control Message Option

   IANA is requested to create a registry for the RPL Control Message
   Options

            +-------+-------------------------+---------------+
            | Value | Meaning                 | Reference     |
            +-------+-------------------------+---------------+
            |   0   | Pad1                    | This document |
            |   1   | PadN                    | This document |
            |   2   | DAG Metric Container    | This Document |
            |   3   | Routing Information     | This Document |
            |   4   | DAG Timer Configuration | This Document |
            |   5   | RPL Target              | This Document |
            |   6   | Transit Information     | This Document |
            |   7   | Solicited Information   | This Document |
            |   8   | Prefix Information      | This Document |
            +-------+-------------------------+---------------+

                        RPL Control Message Options

17.5.  Objective Code Point (OCP) Registry

   IANA is requested to create a registry to manage the codespace of the
   Objective Code Point (OCP) field.

   No OCP codepoints are defined in this specification.

17.6.  ICMPv6: Error in Source Routing Header

   In some cases RPL will return an ICMPv6 error message when a message
   cannot be delivered as specified by its source routing header.  This
   ICMPv6 error message is "Error in Source Routing Header"

   IANA has defined an ICMPv6 "Code" Fields Registry for ICMPv6 Message
   Types.  ICMPv6 Message Type 1 describes "Destination Unreachable"
   codes.  The "Error in Source Routing Header" code is suggested to be
   allocated from the ICMPv6 Code Fields Registry for ICMPv6 Message
   Type 1, with a suggested code value of 7, to be confirmed by IANA.

18.  Acknowledgements

   The authors would like to acknowledge the review, feedback, and
   comments from Roger Alexander, Emmanuel Baccelli, Dominique Barthel,
   Yusuf Bashir, Phoebus Chen, Mathilde Durvy, Manhar Goindi, Mukul
   Goyal, Anders Jagd, JeongGil (John) Ko, Quentin Lampin, Jerry
   Martocci, Matteo Paris, Alexandru Petrescu, Joseph Reddy, and L.
              Wood, "Advice for Internet Subnetwork Designers", BCP 89,
              RFC 3819, July 2004.

   [RFC4101]  Rescorla, E. Don
   Sturek.

   The authors would like to acknowledge the guidance and IAB, "Writing Protocol Models", input provided
   by the ROLL Chairs, David Culler and JP Vasseur.

   The authors would like to acknowledge prior contributions of Robert
   Assimiti, Mischa Dohler, Julien Abeille, Ryuji Wakikawa, Teco Boot,
   Patrick Wetterwald, Bryan Mclaughlin, Carlos J. Bernardos, Thomas
   Watteyne, Zach Shelby, Caroline Bontoux, Marco Molteni, Billy Moon,
   and Arsalan Tavakoli, which have provided useful design
   considerations to RPL.

19.  Contributors

   RPL is the result of the contribution of the following members of the
   RPL Author Team, including the editors, and additional contributors
   as listed below:

   JP Vasseur
   Cisco Systems, Inc
   11, Rue Camille Desmoulins
   Issy Les Moulineaux,   92782
   France

   Email: jpv@cisco.com

   Thomas Heide Clausen
   LIX, Ecole Polytechnique, France

   Phone: +33 6 6058 9349
   EMail: T.Clausen@computer.org
   URI:   http://www.ThomasClausen.org/

   Philip Levis
   Stanford University
   358 Gates Hall, Stanford University
   Stanford, CA  94305-9030
   USA

   Email: pal@cs.stanford.edu

   Richard Kelsey
   Ember Corporation
   Boston, MA
   USA

   Phone: +1 617 951 1225
   Email: kelsey@ember.com

   Jonathan W. Hui
   Arch Rock Corporation
   501 2nd St. Ste. 410
   San Francisco, CA  94107
   USA

   Email: jhui@archrock.com

   Kris Pister
   Dust Networks
   30695 Huntwood Ave.
   Hayward,   94544
   USA

   Email: kpister@dustnetworks.com

   Anders Brandt
   Sigma Designs
   Emdrupvej 26A, 1.
   Copenhagen, DK-2100
   Denmark

   Email: abr@sdesigns.dk

   Stephen Dawson-Haggerty
   UC Berkeley
   Soda Hall, UC Berkeley
   Berkeley, CA  94720
   USA

   Email: stevedh@cs.berkeley.edu

20.  References
20.1.  Normative References

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 4101,
              June 2005.

   [RFC4191]  Draves, R. and D. Thaler, "Default Router Preferences 2119, March 1997.

20.2.  Informative References

   [AppliedCryptography]
              Menzes, AJ., van Oorschot, PC., and SA. Vanstone,
              "Handbook of Applied Cryptography", CRC Press , 1997.

   [CCMStar]  IEEE, "IEEE Std. 802.15.4-2006, IEEE Standard for
              Information Technology - Telecommunications and
              More-Specific Routes", RFC 4191, November 2005.

   [RFC4443]  Conta, A., Deering, S.,
              Information Exchange between Systems - Local and M. Gupta, "Internet
              Metropolitan Area Networks - Specific requirements Part
              15.4: Wireless Medium Access Control
              Message Protocol (ICMPv6) (MAC) and Physical
              Layer (PHY) Specifications for the Internet Protocol
              Version 6 (IPv6) Specification", RFC 4443, March Low-Rate Wireless Personal
              Area Networks (WPANs)", IEEE Press Revision of IEEE Std
              802.15.4-2003, 2006.

   [RFC4861]  Narten, T., Nordmark, E., Simpson, W.,

   [I-D.hui-6man-rpl-option]
              Hui, J. and H. Soliman,
              "Neighbor Discovery J. Vasseur, "RPL Option for IP version 6 (IPv6)", RFC 4861,
              September 2007.

   [RFC4862]  Thomson, S., Narten, T., and T. Jinmei, "IPv6 Stateless
              Address Autoconfiguration", RFC 4862, September 2007.

   [RFC4915]  Psenak, P., Mirtorabi, S., Roy, A., Nguyen, L., Carrying RPL
              Information in Data-Plane Datagrams",
              draft-hui-6man-rpl-option-01 (work in progress),
              June 2010.

   [I-D.hui-6man-rpl-routing-header]
              Hui, J., Vasseur, J., and P.
              Pillay-Esnault, "Multi-Topology (MT) D. Culler, "An IPv6 Routing
              Header for Source Routes with RPL",
              draft-hui-6man-rpl-routing-header-01 (work in OSPF",
              RFC 4915, progress),
              June 2007.

   [RFC5120]  Przygienda, 2010.

   [I-D.ietf-manet-nhdp]
              Clausen, T., Shen, N., Dearlove, C., and N. Sheth, "M-ISIS: Multi
              Topology (MT) Routing J. Dean, "Mobile Ad Hoc
              Network (MANET) Neighborhood Discovery Protocol (NHDP)",
              draft-ietf-manet-nhdp-12 (work in Intermediate System to
              Intermediate Systems (IS-ISs)", RFC 5120, February 2008.

   [RFC5548]  Dohler, M., Watteyne, T., Winter, T., progress), March 2010.

   [I-D.ietf-roll-building-routing-reqs]
              Martocci, J., Riou, N., Mil, P., and D. Barthel,
              "Routing W. Vermeylen,
              "Building Automation Routing Requirements for Urban Low-Power in Low Power and
              Lossy Networks", RFC 5548, May 2009.

   [RFC5673]  Pister, K., draft-ietf-roll-building-routing-reqs-09
              (work in progress), January 2010.

   [I-D.ietf-roll-of0]
              Thubert, P., Dwars, S., and T. Phinney,
              "Industrial Routing Requirements "RPL Objective Function 0",
              draft-ietf-roll-of0-02 (work in Low-Power and Lossy
              Networks", RFC 5673, October 2009.

   [RFC5826]  Brandt, A., Buron, progress), June 2010.

   [I-D.ietf-roll-routing-metrics]
              Vasseur, J., Kim, M., Networks, D., and G. Porcu, "Home Automation
              Routing Requirements H. Chong, "Routing
              Metrics used for Path Calculation in Low-Power Low Power and Lossy
              Networks",
              RFC 5826, April draft-ietf-roll-routing-metrics-07 (work in
              progress), June 2010.

Appendix A.  Requirements

A.1.  Protocol Properties Overview

   RPL demonstrates the following properties, consistent with the
   requirements specified by the application-specific requirements
   documents.

A.1.1.  IPv6 Architecture

   RPL is strictly compliant with layered IPv6 architecture.

   Further, RPL is designed with consideration to the practical support
   and implementation of IPv6 architecture on devices which may operate
   under severe resource constraints, including but not limited to
   memory, processing power, energy, and communication.  The RPL design
   does not presume high quality reliable links, and operates over lossy
   links (usually low bandwidth with low packet delivery success rate).

A.1.2.  Typical LLN Traffic Patterns

   Multipoint-to-Point (MP2P) and Point-to-multipoint (P2MP) traffic
   flows from nodes within the LLN from and to egress points are very
   common

   [I-D.ietf-roll-terminology]
              Vasseur, J., "Terminology in LLNs. Low power And Lossy
              Networks", draft-ietf-roll-terminology-03 (work in
              progress), March 2010.

   [I-D.ietf-roll-trickle]
              Levis, P., Clausen, T., Hui, J., and lossy network Border Router (LBR)
   nodes may typically be at the root of such flows, although such flows
   are not exclusively rooted at LBRs as determined on an application-
   specific basis.  In particular, several applications such as building
   or home automation do require P2P (Point-to-Point) communication.

   As required by the aforementioned routing requirements documents, RPL
   supports the installation of multiple paths.  The use of multiple
   paths include sending duplicated traffic along diverse paths, as well
   as to support advanced features such as Class of Service (CoS) based
   routing, or simple load balancing among a set of paths (which could
   be useful for the LLN to spread traffic load and avoid fast energy
   depletion on some, e.g. battery powered, nodes).  Conceptually,
   multiple instances of RPL can be used to send traffic along different
   topology instances, the construction of which is governed by
   different Objective Functions (OF).  Details of RPL operation J. Ko, "The Trickle
              Algorithm", draft-ietf-roll-trickle-01 (work in
   support progress),
              April 2010.

   [Perlman83]
              Perlman, R., "Fault-Tolerant Broadcast of multiple instances are beyond the scope Routing
              Information", North-Holland Computer Networks 7: 395-405,
              1983, <http://www.cs.illinois.edu/~pbg/courses/cs598fa09/
              readings/p83.pdf>.

   [RFC1958]  Carpenter, B., "Architectural Principles of the present
   specification.

A.1.3.  Constraint Based Routing

   The RPL design supports constraint based routing, based on a set Internet",
              RFC 1958, June 1996.

   [RFC1982]  Elz, R. and R. Bush, "Serial Number Arithmetic", RFC 1982,
              August 1996.

   [RFC2578]  McCloghrie, K., Ed., Perkins, D., Ed., and J.
              Schoenwaelder, Ed., "Structure of
   routing metrics Management Information
              Version 2 (SMIv2)", STD 58, RFC 2578, April 1999.

   [RFC2710]  Deering, S., Fenner, W., and constraints.  The routing metrics B. Haberman, "Multicast
              Listener Discovery (MLD) for IPv6", RFC 2710,
              October 1999.

   [RFC3410]  Case, J., Mundy, R., Partain, D., and B. Stewart,
              "Introduction and Applicability Statements for Internet-
              Standard Management Framework", RFC 3410, December 2002.

   [RFC3535]  Schoenwaelder, J., "Overview of the 2002 IAB Network
              Management Workshop", RFC 3535, May 2003.

   [RFC3610]  Whiting, D., Housley, R., and N. Ferguson, "Counter with
              CBC-MAC (CCM)", RFC 3610, September 2003.

   [RFC3810]  Vida, R. and L. Costa, "Multicast Listener Discovery
              Version 2 (MLDv2) for IPv6", RFC 3810, June 2004.

   [RFC3819]  Karn, P., Bormann, C., Fairhurst, G., Grossman, D.,
              Ludwig, R., Mahdavi, J., Montenegro, G., Touch, J., and L.
              Wood, "Advice for Internet Subnetwork Designers", BCP 89,
              RFC 3819, July 2004.

   [RFC4101]  Rescorla, E. and IAB, "Writing Protocol Models", RFC 4101,
              June 2005.

   [RFC4191]  Draves, R. and D. Thaler, "Default Router Preferences and
              More-Specific Routes", RFC 4191, November 2005.

   [RFC4443]  Conta, A., Deering, S., and M. Gupta, "Internet Control
              Message Protocol (ICMPv6) for the Internet Protocol
              Version 6 (IPv6) Specification", RFC 4443, March 2006.

   [RFC4861]  Narten, T., Nordmark, E., Simpson, W., and constraints H. Soliman,
              "Neighbor Discovery for links IP version 6 (IPv6)", RFC 4861,
              September 2007.

   [RFC4862]  Thomson, S., Narten, T., and nodes with capabilities supported by RPL are specified T. Jinmei, "IPv6 Stateless
              Address Autoconfiguration", RFC 4862, September 2007.

   [RFC4915]  Psenak, P., Mirtorabi, S., Roy, A., Nguyen, L., and P.
              Pillay-Esnault, "Multi-Topology (MT) Routing in a companion document to this specification,
   [I-D.ietf-roll-routing-metrics].  RPL signals the metrics,
   constraints, OSPF",
              RFC 4915, June 2007.

   [RFC5120]  Przygienda, T., Shen, N., and related Objective Functions (OFs) N. Sheth, "M-ISIS: Multi
              Topology (MT) Routing in use Intermediate System to
              Intermediate Systems (IS-ISs)", RFC 5120, February 2008.

   [RFC5548]  Dohler, M., Watteyne, T., Winter, T., and D. Barthel,
              "Routing Requirements for Urban Low-Power and Lossy
              Networks", RFC 5548, May 2009.

   [RFC5673]  Pister, K., Thubert, P., Dwars, S., and T. Phinney,
              "Industrial Routing Requirements in a
   particular implementation by means of an Objective Code Point (OCP).
   Both the routing metrics, constraints, Low-Power and the OF help determine the
   construction Lossy
              Networks", RFC 5673, October 2009.

   [RFC5706]  Harrington, D., "Guidelines for Considering Operations and
              Management of the Directed Acyclic Graphs (DAG) using a distributed
   path computation algorithm.

A.2.  Deferred New Protocols and Protocol Extensions",
              RFC 5706, November 2009.

   [RFC5826]  Brandt, A., Buron, J., and G. Porcu, "Home Automation
              Routing Requirements

   NOTE: RPL is still a work in progress.  At this time there remain
   several unsatisfied application requirements, but these are to be
   addressed as RPL is further specified. Low-Power and Lossy Networks",
              RFC 5826, April 2010.

   [RFC5880]  Katz, D. and D. Ward, "Bidirectional Forwarding Detection
              (BFD)", RFC 5880, June 2010.

   [X9.63-2001]
              "ANSI X9.63-2001, Public Key Cryptography for the
              Financial Services Industry - Key Agreement and Key
              Transport Using Elliptic Curve Cryptography", 2001.

   [X9.92]    "ANSI X9.92, Public Key Cryptography for the Financial
              Services Industry - Digital Signature Algorithms Giving
              Partial Message Recovery - Part 1: Elliptic Curve Pintsov-
              Vanstone Signatures (ECPVS)", 2009.

Appendix B. A.  Outstanding Issues

   This section enumerates some outstanding issues that are to be
   addressed in future revisions of the RPL specification.

B.1.

A.1.  Additional Support for P2P Routing

   In some situations the baseline mechanism to support arbitrary P2P
   traffic, by flowing upwards along the DODAG until a common ancestor
   is reached and then flowing down, may not be suitable for all
   application scenarios.  A related scenario may occur when the down
   paths setup along the DODAG by the destination advertisement
   mechanism are not the most desirable downward paths for the specific
   application scenario (in part because the DODAG links may not be
   symmetric).  It may be desired to support within RPL the discovery
   and installation of more direct routes 'across' the DAG.  Such
   mechanisms need to be investigated.

B.2.

A.2.  Address / Header Compression

   In order to minimize overhead within the LLN it is desirable to
   perform some sort of address and/or header compression, perhaps via
   labels, addresses aggregation, or some other means.  This is still
   under investigation.

B.3.

A.3.  Managing Multiple Instances

   A network may run multiple instances of RPL concurrently.  Such a
   network will require methods for assigning and otherwise managing
   RPLInstanceIDs.  This will likely be addressed in a separate
   document.

Authors' Addresses

   Tim Winter (editor)

   Email: wintert@acm.org

   Pascal Thubert (editor)
   Cisco Systems
   Village d'Entreprises Green Side
   400, Avenue de Roumanille
   Batiment T3
   Biot - Sophia Antipolis  06410
   FRANCE

   Phone: +33 497 23 26 34
   Email: pthubert@cisco.com

   RPL Author Team
   IETF ROLL WG

   Email: rpl-authors@external.cisco.com