Correctness of EIGRP Generalized for Arbitrary Routing Metrics and Policies

Among the routing protocols deployed in the wired infrastructure of the Internet, the Enhanced Interior Gateway Routing Protocol (EIGRP) has the distinction of being the only one that guarantees loop-free routing of data-packets during transient periods of convergence. However, there is no good proof of this fact and no knowledge of whether the actions and behaviors of EIGRP extend beyond its specific composite metric combining delay and bandwidth. This paper generalizes EIGRP for operation with arbitrary metrics and policies. It shows that generalized-EIGRP (gEIGRP) can be used with a broad class of such metrics and policies, but less so than the protocol to which it is closest in kind, the Border Gateway Protocol (BGP). To reason reliably about the behaviors induced by the actions of gEIGRP, the paper resorts to assertional proof methods. For the class of routing metrics and policies mentioned above, it presents an invariant of gEIGRP from which two safety properties are deduced: loop-free routing at all times, and routing on destination-optimal paths in stable state. Outside that class of metrics and policies, gEIGRP may deadlock in states harboring persistent forwarding loops.