Check both ends before deployment
05The /31 rule is scoped to point-to-point interfaces. Support on only one end can break operation; the address saving is not a universal connectivity or security guarantee.
Eliminating the /31 subnet-directed broadcast removes that replication opportunity on the link. A separate malicious unicast is still possible; no encryption or authentication was added.
Source for this drawing: RFC 3021 · Read RFC section 5 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Check the link model and both implementations before relying on the exception.
- Section 5 warns that a point-to-point link where only one end supports 31-bit prefixes may not operate correctly. It defines no negotiation or automatic capability-discovery handshake.
- The effects on other interface types are not considered. A shared multi-access local-area network (LAN) is outside this RFC’s stated applicability; do not generalize the two-endpoint diagram to it.
- Section 6 describes reduced exposure to packet replication through directed broadcasts on these links. It does not claim to stop all denial of service, authenticate routers or encrypt packets. Section 4’s vendor and ISP test results are historical reports from 2000, not certification of current equipment.
These are operator planning decisions, not packets exchanged by a newly invented negotiation protocol. A rejected plan is stopped at the applicability/support check; it is not a claim that every unsupported device emits a particular error. IPv6 and unnumbered interfaces have separate rules. Use assigned addresses and verify the actual environment before configuration.
Read the RFC section ↗