Re: RFC iptables target for selectively removing ECN

[Sebastian Zimmermann <sz@xxxxxxxxxxxxxxxxxxxxxxxx>]

On Tue, 26 Feb 2002 10:12:35 +0100
"Harald Welte" <laforge@xxxxxxxxxxxx> wrote:
>> Instead, I suggest to only clear the ECE and CWR TCP flags
>> on SYN-packets.
> 
> I don't need to clear the ECT codepoint in the IP header as well? Is > it 
> valid to receive an IP packet which has an ECT codepoint set in the
> IP header, but no ECE/CWR bits in the TCP header?

The RFC states that SYN packets MUST NOT set ECT. So when the TCP connection is 
initiated, the ECN-capability is negotiated only by the two TCP flags ECE and 
CWR.

If you clear those, ECN cannot be established. If ECN wasn't established, ECT 
MUST NOT be set on the following packets - and thus CE won't be set.

So if the ECN implementation is conforming to the RFC, your target does not 
have to touch IP headers at all to disable ECN.

Sebastian