Check the actual VXLAN header and checksum rules
04The VXLAN header is 8 bytes: flags, reserved fields, a 24-bit VNI and one final reserved byte. Format validity, checksum handling and local membership are separate gates.
Separate examples: verify and match allows the checksum gate; verify and mismatch MUST drop; choosing not to verify also allows this gate. A valid format/checksum is not a substitute for trusted endpoint configuration.
Source for this drawing: RFC 7348 · Read RFC section 5 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Senders zero reserved fields; receivers ignore them. A valid VNI still does not authorize a sender.
- The I flag MUST be 1 for a valid VNI. It is bit 0x08 of the first byte. The other 7 flag bits and the 24-bit/8-bit reserved fields MUST be zero on transmission and ignored on receipt.
- The VNI occupies bytes 4–6, in the illustrated network-order header. VNI 100 is 00 00 64; a normal sender emits 08 00 00 00 00 00 64 00.
- For the illustrated IPv4 transport, a zero UDP checksum SHOULD be sent and MUST be accepted for decapsulation at the checksum gate. A supplied nonzero checksum MUST be correctly calculated. A receiver MAY verify it; if verification is chosen and fails, it MUST drop the packet. Otherwise the checksum gate permits decapsulation.
- The source UDP port is recommended to derive from a hash of inner packet fields for load balancing; 49152–65535 is RECOMMENDED for that calculation. The shown 55000 is a chosen fixture, not an implemented hash or mandatory port.
Each step below is a separate field/policy example, not a single packet that is accepted and later rejected. Header parsing and checksum gates do not replace the VNI/local-destination checks. No checksum algorithm, IPv6 zero-checksum policy or production VXLAN stack is implemented by the teaching helper.
Read the RFC section ↗