Use Protective ReRoute to optimize TCP network resiliency

Protective ReRoute (PRR) isa host-based technique to route packets around faults in a multipath network.PRR is deployed across Google's global network, where it works with existingresiliency mechanisms to improve network availability for all users.

Choose a PRR mode

Google Cloud provides PRR in two modes: Hypervisor mode and Guest mode.

Note: PRR in Hypervisor mode is available for both VM instances and bare metal instances.
PRR in hypervisor mode

PRR in hypervisor mode protects most traffic by default, but has the followinglimitations:

  • If an instance has a huge traffic fan-out, for example, if an instanceis actively sending packets to thousands of cross-region instances atthe same time, not all packets are protected.

  • Hypervisor mode PRR protects key segments of the network path but isn'tfully end-to-end.

  • Hypervisor mode PRR reacts within single-digit seconds.

PRR in guest mode

Guest mode PRR can be used for critical applications that are particularlysensitive to short-duration network events, have large fanout patterns, arehighly sensitive to packet loss, or require the fastest possible networkrecovery time (at RTT timescale).

All Google Cloud customers automatically get hypervisor mode PRRwith no configuration actions required.

Configure guest mode PRR

You should use guest mode for applications that are highly sensitive to packetloss, require large fan-out patterns, or need the fastest possible networkrecovery.

To configure guest mode PRR, performing the following steps.

  1. Verify the version of the Linux kernel. Use the following command to confirmthat the instance OS is using version 4.20 or later:

    uname-r

  2. Verify that IPv6 flow labels are automatically generated. Use the followingcommand to check that the/proc/sys/net/ipv6/auto_flowlabelssetting is enabled. Thissysctl setting is often enabled by default.

    cat/proc/sys/net/ipv6/auto_flowlabels

    If the value is not1, then enable it in your system configuration.

  3. Use thegVNIC network interfacedriver for full PRR support. To protect both IPv4 and IPv6 traffic, yourinstance must use a gVNIC network interface. If the instance uses the VirtIOnetwork interface, then PRR protects only IPv6 traffic.

What's next

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-02-19 UTC.