Purpose
Short reading notes on the end-to-end argument. The note states the argument, why it holds, and the cases where it breaks down.
Citation
- End-to-End Arguments in System Design, Saltzer, Reed, and Clark.
Problem
Where should a function like error checking, encryption, or delivery acknowledgment live in a layered system? The temptation is to push it into the lower layers so every application gets it for free. The paper argues that placement is usually wrong.
Main idea
A function can only be implemented completely and correctly with the knowledge and help of the application at the endpoints. The paper’s running example is careful file transfer: even if the network guarantees reliable delivery, the transfer application still has to check the file end to end, because the file can be corrupted on disk, in memory, or in the file system before it ever reaches the network. Since the endpoint check has to exist anyway, a lower-level implementation of the same function is redundant for correctness. It can only be justified as a performance optimization.
The same reasoning covers crash detection, message sequencing, and duplicate suppression. Only the endpoints know what the application actually needs, so a correct communication system gets built from endpoint checks, whatever the layers below do.
When the argument cuts the other way
If the probability of an error inside the network is low, adding checks in the middle buys little and costs every user of the layer. But the argument is a guideline, and it has real limits:
- Systems that communicate over lossy media should have intermediate checks, because retransmitting a whole transfer from the endpoints costs far more than fixing errors hop by hop.
- Catching errors only at the endpoints delays detection. A corrupted message has to travel the whole path before anyone notices.
- Leaving checks out of the middle hurts maintainability, since failures surface far from where they happen.
Deciding where a function lives
The endpoint check has to exist for correctness no matter what the network does. Put a copy of the function in a lower layer only when it pays off as a performance optimization, as hop-by-hop error recovery does on lossy links where end-to-end retransmission would cost far more.