CM Address Acquisition, Filtering and Forwarding Rules

CM Address Acquisition, Filtering and Forwarding Rules

The CM MUST support forwarding of IP traffic (both IPv4 and IPv6). CMs and CMTSs operate as IP and LLC
hosts as defined by [IEEE 802.1D] for communication over the cable network.

The term "CPE MAC addresses" used in this section includes MAC addresses of both connected CPE devices and
eSAFEs.

The term "CMCI port" describes physical interfaces to which connected CPE devices can attach.

The term "Logical CPE Interface" refers to an interface between the CM and an eSAFE. \

The term "CPE port" refers to an interface that is either a CMCI port or a Logical CPE Interface.

Data forwarding through the CM is link-layer bridging with the rules specified in the following sub-sections.

1: MAC Address Acquisition

The CM maintains a forwarding database (bridging table) including entries for the CM’s own MAC address and
CPE MAC addresses.
The CM MUST acquire CPE Ethernet MAC addresses, either from the provisioning process or from learning, until
the CM acquires its maximum number of CPE MAC addresses (the lesser of the Max CPE from the config file
(Annex C.1.1.7, Max CPE) or a device-dependent value). Once the CM acquires its maximum number of CPE
MAC addresses, then newly discovered CPE MAC addresses MUST NOT replace previously acquired addresses.
The CM MUST support acquisition of at least 64 CPE MAC addresses.
The CM MUST NOT learn any MAC addresses for its forwarding database prior to registration. The CM MUST
allow configuration of CPE MAC addresses during the provisioning process (up to its maximum number of CPE
addresses) to support configurations in which learning is not practical, nor desired. The CM MUST give
provisioned addresses precedence over learned addresses when adding entries to the forwarding database. The CM
MUST NOT age out CPE MAC addresses. The CM MUST place all acquired CPE MAC addresses in its
forwarding database [RFC 1493].
In order to allow modification of user MAC addresses or movement of the CM, addresses are not retained in nonvolatile
storage. On a CM reset (e.g., power cycle), the CM MUST discard all provisioned and learned addresses.

2: CM Filtering Rules

The CM MUST discard frames that are received with CRC or frame format errors. The CM MUST discard packets
based on the configurable filtering mechanisms defined in [DOCSIS OSSIv2.0] and Section 7.5.1.2.2.
Filtering downstream frames received on any of the downstream channels in the CM’s Receive Channel Set
conforms to the following specific rules:
• The CM MUST discard frames with an unknown SAID.
• The CM MUST discard unicast frames addressed to unknown destination MAC addresses (MAC addresses not
contained in the CM’s forwarding database), even if the SAID is known. The CM MUST NOT generate a TEK
Invalid (see [DOCSIS SECv3.0]) or report a CRC error in this case.
• If Multicast DSID Forwarding is enabled (reference Annex C.1.3.1.33), the CM MUST discard all packets
(unicast, multicast, and broadcast) with a DS EHDR containing an unknown DSID value (even if the MAC
destination address or SAID is known). The CM MUST NOT generate a TEK Invalid (see [DOCSIS
SECv3.0]) due to a key sequence error or report a CRC error in this case. Additional CM requirements for the
forwarding of unicast, multicast and broadcast packets that apply when MDF is disabled are detailed in Annex
G.
• The CM MUST discard all DSID labeled packets which are labeled with a Resequencing DSID and received on
a downstream channel not in the Downstream Resequencing Channel List associated with the DSID;
• The CM MUST discard multicast frames from source addresses which are provisioned or learned as supported
CPE devices;
• The CM MUST discard broadcast frames from source addresses which are provisioned or learned as supported
CPE devices.
• The CM MUST discard broadcast frames not labeled with a DSID which are received on any channel other
than the CM’s Primary Downstream Channel.
Forwarding of frames received from any CPE port to the RFI conforms to the following specific rules:
• The CM MUST NOT transmit upstream frames from source MAC addresses other than those provisioned or
learned as supported CPE devices;
• The CM MUST NOT transmit upstream router advertisements (RAs) received on any interface.

3: CM Forwarding Rules

The CM MUST NOT duplicate link-layer frames.

CM Pre-Operational Forwarding Behavior252
Prior to becoming operational as in Figure 10–1, the CM operates per the following rules:
• The CM MUST forward to its IP stack all unicast frames that are received on the Primary Downstream Channel
and addressed to the CM’s MAC address;
• The CM MUST forward from its IP stack to the RF interface the multicast traffic that is necessary for
completing the registration process;
• The CM MUST NOT send any DHCPv4 DHCPDISCOVER or DHCPREQUEST, DHCPv6 Solicit or Request,
TFTP-RRQ, HTTP Request, Time Protocol Request, or IPv6 Router Solicitation messages to any interface
except the RF Interface;

The CM MUST NOT accept any DHCPv4 DHCPOFFER or DHCPACK, DHCPv6 Advertise or Reply, TFTPDATA,
HTTP Response, Time Protocol Response, or IPv6 Router Advertisements from the CMCI ports;
• The CM MUST NOT forward any packets from the RF interface to any CPE port;
• The CM MUST NOT forward any packets from any CPE port to the RF Interface.
CM Operational Forwarding Behavior
Once the CM is operational as in Figure 10–1, CM forwarding in the upstream and downstream directions conforms
to the following rules:
• The CM MAY perform one or more frame/packet processing functions on frames received from the CPE port
prior to classifying them to a Service Flow. Example frame/packet processing functions include: DOCSIS
protocol filtering as specified in [DOCSIS OSSIv3.0], a policy-based filtering service as described in Section
7.5.6.1, and Appendix I, and priority-based queuing to support 802.1P/Q services. Unless specified otherwise,
the CM MUST transmit upstream link-layer frames in the order that they are received on a given Service Flow.
The CM SHOULD support a mechanism by which TCP ACK frames are prioritized or filtered in order to
increase TCP session throughput.
• Unless specified otherwise, the CM MUST deliver downstream sequenced link-layer frames for a particular
DSID in the order indicated by the Packet Sequence Number (see Section 8.2.3.1). The CM MUST deliver
downstream non-sequenced link-layer frames of the same traffic priority in the order that they are received on a
given downstream channel. Relative packet ordering of such frames received on different downstream channels
is not specified (see Section 8.2.1).
• The CM MAY perform one or more frame/packet processing functions on frames received from the RF port
prior to transmitting them on the CPE port. Example frame/packet processing functions include: DOCSIS
protocol filtering as specified in [DOCSIS OSSIv3.0], a policy-based filtering service as described in Section
7.5.6.1, and Appendix I, and priority-based queuing to support 802.1P/Q services.
• The CM MUST NOT forward frames between the RF port and CPE ports if the CM config file sets Network
Access Control Object (NACO) to 0. The CM MUST forward frames between the CPE ports and CM IP stack
even if NACO is 0. The CM MUST forward frames between the RF port and CM IP stack even if NACO is 0.
Forwarding of non-DSID labeled downstream frames received on any of the downstream channels in the CM’s
Receive Channel Set conforms to the following specific rules:
• The CM MUST forward unicast frames addressed to the CM’s MAC address to the CM’s IP stack;
• The CM MUST forward unicast frames addressed to learned MAC addresses to the CPE port on which the
address was learned;
• The CM MUST forward unicast frames addressed to provisioned MAC addresses to all CPE ports, until that
MAC address is learned on a particular CPE port;
• The CM MUST forward broadcast frames not labeled with a DSID which are received on the Primary
Downstream Channel to the CPE ports and the CM IP stack.
Forwarding of DSID-labeled downstream frames received on any of the downstream channels in the CM’s Receive
Channel Set conforms to the following specific rules:
• The CM MUST forward unicast packets which are labeled with a known DSID and addressed to the CM’s
MAC address to the CM’s IP stack;
• The CM MUST forward unicast packets labeled with a known DSID to the CPE port on which the destination
MAC address was learned;

The CM MUST forward unicast frames which are labeled with a known DSID and addressed to provisioned
MAC addresses to all CPE ports, until that MAC address is learned on a particular CPE port;
• A CM MUST forward broadcast packets labeled with a known DSID to only the union of: all interfaces
identified in the Multicast CM Interface Mask associated with that DSID; and all interfaces identified by the list
of client MAC addresses associated with that DSID.
Forwarding of frames received from any CPE port conforms to the following specific rules:
• The CM MUST forward frames addressed to unknown destination MAC addresses only to the RF Interface;
• The CM MUST forward broadcast frames to all ports (including the CM IP stack) except the port which
received the frame;
• The CM MUST forward frames addressed to known destination MAC addresses to the port on which the
destination address was learned;
• The CM MUST NOT accept any DHCPv4 DHCPOFFER or DHCPACK, DHCPv6 Advertise or Reply, TFTPDATA,
HTTP Response, Time Protocol Response, or IPv6 Router Advertisements from any of the CPE ports
for the purposes of configuration, secure software download, or address renewal.
Forwarding of frames received from any CMCI port(s) conforms to the following specific rules:
• The CM MUST forward multicast frames to the RF port, the CM IP stack, and all CMCI ports except the port
which received the frame;
• The CM MUST NOT forward multicast frames to any Logical CPE Interfaces.
Forwarding of frames received from any Logical CPE Interface conforms to the following specific rules:
• The CM MUST forward multicast frames to the RF port;
• The CM MUST NOT forward multicast frames to any ports other than the RF port.
Forwarding of frames being sent by the CM IP stack conforms to the following specific rules:
• The CM MUST forward frames addressed to unknown destinations only to the RF port;
• The CM MUST forward broadcast frames to all ports;
• The CM MUST forward multicast frames to the RF port;
• The CM MUST NOT forward multicast frames to any ports other than the RF port.
• The CM MUST forward frames to the port on which the destination address was learned;
• The CM MUST NOT forward any DHCPv4 DHCPDISCOVER or DHCPREQUEST, DHCPv6 Solicit or
Request, TFTP-RRQ, HTTP Request, Time Protocol Request, or Router Solicitation messages to any ports
except the RF port.