GoBFD
Production-grade BFD protocol daemon for Go

---

GoBFD is a production-oriented Bidirectional Forwarding Detection (BFD) protocol daemon written in Go 1.27. It detects forwarding path failures between adjacent systems in milliseconds, enabling fast convergence for BGP, OSPF, and other routing protocols.

Four binaries: gobfd (daemon), gobfdctl (CLI), gobfd-haproxy-agent (HAProxy bridge), gobfd-exabgp-bridge (ExaBGP bridge).

Why GoBFD

• Standalone daemon, decoupled from any control plane. GoBFD watches BFD state and drives external actuators (GoBGP DisablePeer/EnablePeer, HAProxy agent-check, ExaBGP route announcements) over a typed gRPC API. A daemon restart does not flap the routing control plane.
• Measured allocation boundaries. Micro-benchmarks report zero allocations for selected codec, FSM, timer, lookup, and caller-buffer paths. Allocating compatibility and authenticated receive paths are documented explicitly; benchmark results are not an end-to-end latency or GC guarantee.
• Documented RFC coverage. The asynchronous RFC 5880 core and several extensions are available with explicit partial or preview boundaries. RFC 9384 wire subcode 10 is not emitted by the current GoBGP v3 API. See RFC Compliance for the exact matrix.
• Operational surfaces. ConnectRPC/gRPC API, Prometheus metrics, structured slog logging, systemd integration, and a runtime flight recorder are available. The current control and metrics defaults are plaintext all-interface listeners; production deployments must isolate or override them and must not expose the debug endpoint publicly.
• Verified interop. The base suite covers FRR 10.7.0, BIRD 3.3.2, immutable Holo 0.9.0, and Thoro/bfd. Separate BGP+BFD coupling tests cover GoBGP, FRR, BIRD3, and ExaBGP. Containerlab profiles cover Arista cEOS, Nokia SR Linux, SONiC-VS, and VyOS.

Background and benchmarks: Competitive Analysis and Performance Analysis.

Quick Start

git clone https://github.com/dantte-lp/gobfd.git && cd gobfd
make build                       # builds all 4 binaries with version ldflags
sudo ./gobfd -config configs/gobfd.example.yml

Local Podman stack with Prometheus + Grafana:

make test
podman compose -f deployments/compose/compose.yml up -d

Requires Linux with CAP_NET_RAW and CAP_NET_ADMIN capabilities. See Deployment.

Architecture

graph TB
    subgraph "gobfd daemon"
        SRV["ConnectRPC<br/>:50051"]
        BFD["BFD Core<br/>FSM + Sessions"]
        NET["Raw Sockets<br/>UDP 3784/4784"]
        BGP["GoBGP Client"]
        MET["Prometheus<br/>:9100"]
    end

    CLI["gobfdctl<br/>CLI"] --> SRV
    HAP["gobfd-haproxy-agent"] --> SRV
    EXA["gobfd-exabgp-bridge"] --> SRV
    SRV --> BFD
    NET --> BFD
    BGP --> GOBGP["GoBGP :50052"]
    NET --> PEER["BFD Peers"]

    style BFD fill:#1a73e8,color:#fff

Loading

Documentation

Full documentation is available in docs/:

#	Document	Description
01	Architecture	System architecture, package diagram, packet flow
02	BFD Protocol	FSM, timers, jitter, packet format, authentication
03	Configuration	YAML config, env vars, GoBGP integration, hot reload
04	CLI Reference	gobfdctl commands, interactive shell
05	Interop Testing	4-peer testing: FRR, BIRD3, Holo, Thoro/bfd
06	Deployment	systemd, Podman Compose, packages, production
07	Monitoring	Prometheus metrics, Grafana dashboard, alerting
08	RFC Compliance	RFC compliance matrix, implementation notes
09	Development	Dev workflow, make targets, testing, linting
10	Changelog Guide	How to maintain CHANGELOG.md, semantic versioning
11	Integrations	BGP failover, HAProxy, observability, ExaBGP, Kubernetes
16	Production Runbooks	Kubernetes, BGP, Prometheus, packet verification, failure drills

Documentation is also available in Russian at docs/ru/.

RFC Source Files

Full RFC texts are available in docs/rfc/: RFC 5880 | RFC 5881 | RFC 5882 | RFC 5883 | RFC 5884 | RFC 5885 | RFC 7130 | RFC 7419 | RFC 9384 | RFC 9468 | RFC 9747 | RFC 8971 | RFC 9521 | RFC 9764 | RFC 9985 | RFC 9986

RFC Compliance

RFC	Title	Status
RFC 5880	BFD Base Protocol	Asynchronous core; partial
RFC 5881	BFD for IPv4/IPv6 Single-Hop	Implemented
RFC 5882	Generic Application of BFD	Implemented
RFC 5883	BFD for Multihop Paths	Implemented
RFC 7419	Common Interval Support	Implemented
RFC 9384	BGP Cease NOTIFICATION for BFD	Not implemented; GoBGP v3 emits Cease/2
RFC 9468	Unsolicited BFD	Preview
RFC 9747	Unaffiliated BFD Echo	Preview
RFC 7130	Micro-BFD for LAG	Preview; owner integration partial
RFC 8971	BFD for VXLAN	Preview userspace backend
RFC 9521	BFD for Geneve	Preview userspace backend
RFC 9764	BFD Large Packets	Partial; authenticated padding incomplete
RFC 5884	BFD for MPLS LSPs	Stub
RFC 5885	BFD for PW VCCV	Stub

Details: RFC Compliance

Performance

GoBFD maintains 34 micro-benchmarks for specific pipeline stages. In particular, RecvDecodeLookupEnqueue measures wire decode, discriminator lookup, and attempted enqueue to the session's buffered channel. It does not measure UDP receive, session processing, FSM commit, timer reset, or state notification, so no end-to-end packet rate or supported session scale is inferred from it.

The micro-benchmarks cover packet codec, FSM transitions, timer operations, overlay encapsulation (VXLAN/Geneve), session management, and the documented allocation boundaries. See BENCHMARKS.md for detailed results.

Key Features

• Table-driven FSM matching RFC 5880 Section 6.8.6 (no if-else chains)
• Five authentication modes (Simple Password, Keyed MD5/SHA1, Meticulous MD5/SHA1)
• RFC 9747 Echo, RFC 7130 Micro-BFD protocol, RFC 8971 VXLAN userspace backend, and RFC 9521 Geneve userspace backend support
• BFD flap dampening for BGP integration (RFC 5882 Section 3.2)
• Zero-allocation packet codec with pre-built cached packets
• ConnectRPC/gRPC API + CLI with interactive shell
• Prometheus metrics + Grafana dashboard
• systemd integration (Type=notify, watchdog, SIGHUP hot reload)
• 4-peer interop testing (FRR, BIRD3, Holo, Thoro/bfd) + 5 integration examples
• Runtime flight recorder for post-mortem debugging

Advanced Linux modes are explicit about dataplane ownership: Micro-BFD detects per-member LAG state but needs a bond/team/OVS actuator for enforcement, while VXLAN/Geneve BFD defaults to an explicit userspace-udp backend. Reserved kernel, OVS/OVN, Cilium, Calico, and NSX backend names fail closed until owner-specific integrations are implemented.

Contributing

See Development for the full workflow. Repository participation is governed by CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, SUPPORT.md, and GOVERNANCE.md.

make up && make all    # Build + test + lint
make interop           # Interoperability tests

License

Apache License 2.0