The Addition of Explicit Congestion Notification (ECN) to IP
obsoletes
- rfc-2481 — A Proposal to add Explicit Congestion Notification (ECN) to IP
updated by
- rfc-4301 — Security Architecture for the Internet Protocol
- rfc-6040 — Tunnelling of Explicit Congestion Notification
- rfc-8311 — Relaxing Restrictions on Explicit Congestion Notification (ECN) Experimentation
- rfc-9768 — More Accurate Explicit Congestion Notification (AccECN) Feedback in TCP
updates
Extracted elements (31)
Retransmitted data packets are not marked ECT because (1) if an unnecessary retransmission is later dropped, the CE indication would never reach the end nodes, and (2) marking retransmits would enable spoofed out-of-window CE packets to force a denial-of-service congestion-window reduction.
The CE codepoint response MUST equal the packet-drop response to ensure fairness during incremental deployment: if CE triggered a weaker reaction than a drop, flows routed through ECN-capable routers would be advantaged over those routed through drop-only routers.
The ECN-setup SYN sets both ECE and CWR, while the SYN-ACK sets only ECE, to handle a class of faulty TCP implementations that blindly echo the Reserved field of the incoming SYN back in the SYN-ACK. The asymmetry lets the initiator distinguish a genuine ECN-capable response from a reflection.
Two bits are used in the IP header rather than one so that the sender can distinguish ECT from CE and routers can unambiguously signal congestion (CE) without ambiguity with the not-ECT codepoint, while still fitting within the two bits left unused by the Differentiated Services field.
Two ECT codepoints (ECT(0) and ECT(1)) are defined rather than one to support an ECN nonce: routers necessarily erase the nonce when setting CE, making repeated erasure of CE detectable by endpoints. This also helps detect misbehaving receivers that lie about having received CE-marked packets.
CE codepoint should not be set based on instantaneous queue size; it SHOULD be based on average queue size (e.g., RED). ATM/Frame Relay congestion bits are too noisy a signal and SHOULD NOT be directly mapped to CE without an average-queue-based filter.
Some firewalls, load balancers, and intrusion detection systems drop ECN-setup SYN packets or respond with RST. A host MAY fall back to retransmitting a non-ECN-setup SYN (CWR and ECE cleared) if it receives a RST in response to an ECN-setup SYN, or if no reply arrives within the normal SYN retransmission timeout.
The limited-functionality IP tunnel option (not-ECT in outer header) provides backward compatibility with simple tunnels that discard the outer header; without one of the two ECN options, congestion marked by routers inside the tunnel is silently lost at egress.
A host MUST NOT set ECT on data packets unless both sides have exchanged ECN-setup SYN/SYN-ACK packets. A host MUST NOT set ECT on SYN or SYN-ACK packets.
A router MUST NOT set CE instead of dropping a packet when the drop is caused by reasons other than congestion (e.g., a diffserv edge node configured to unconditionally drop certain traffic classes).
All IP tunnels MUST implement the limited-functionality ECN option (setting not-ECT in the outer header regardless of inner header) and SHOULD support the full-functionality option (copying ECN codepoints and propagating CE from outer to inner header at egress).
An ECT codepoint MUST NOT be set in a packet unless the loss of that packet would be detected by the end nodes and interpreted as an indication of congestion. Specifically, 'pure' ACK packets MUST NOT indicate ECN-Capability.
ECN-capable TCP implementations MUST NOT set either ECT codepoint on retransmitted data packets; the TCP receiver SHOULD ignore the ECN field on arriving data packets that are outside the receiver's current window.
IPsec tunnels in tunnel mode MUST support the limited-functionality ECN option and SHOULD support the full-functionality option; ECN usage in the outer header is controlled by a configurable SAD field.
Pure ACK packets MUST be sent with the not-ECT codepoint; window probe packets MUST NOT carry an ECT codepoint or the CWR bit, because losses of these packets are not detected by the receiver.
Reassembly of a fragmented IP packet MUST NOT lose congestion indications: if any fragment carries the CE codepoint, the reassembled packet MUST have CE set (unless another fragment carries Not-ECT, in which case the packet MUST be dropped instead of reassembled).
The TCP sender MUST reset the retransmit timer on receiving an ECN-Echo ACK when the congestion window is one MSS, in order to further reduce the sending rate below one packet per RTT.
Upon receipt of a CE packet, an ECN-Capable transport MUST invoke a congestion control response essentially equivalent to its response to a single dropped packet (e.g., TCP halves its congestion window).
An ECN-setup SYN packet has both ECE and CWR flags set and indicates the sender is willing to participate in ECN as both sender and receiver. An ECN-setup SYN-ACK has only ECE set (not CWR).
ECT(0) and ECT(1) are the two ECN-Capable Transport codepoints set by the data sender in IP packet headers to signal that both endpoints support ECN. Routers treat ECT(0) and ECT(1) as equivalent; senders that need only one codepoint SHOULD use ECT(0).
The CWR (Congestion Window Reduced) flag is set by the TCP sender in the first new data packet sent after reducing the congestion window, to signal to the receiver that the congestion window has been reduced and ECE echoing can stop.
The ECN-Echo (ECE) flag in a TCP ACK informs the sender that a CE packet was received. The receiver continues setting ECE on all subsequent ACKs until it receives a packet with the CWR flag set from the sender.
A new optional IPsec Security Association Attribute is defined for negotiating ECN tunnel mode: 'ECN Tunnel' with values allowed/forbidden, stored in the SAD and negotiable via IKE, indicating whether ECN congestion notifications may propagate through the outer IP header of an IPsec tunnel.
IANA is requested to designate bits 6 and 7 of the IPv4 TOS octet and the IPv6 Traffic Class octet as the ECN field, superseding their 'Currently Unused' designation in RFC 2474, with codepoints Not-ECT (00), ECT(1) (01), ECT(0) (10), and CE (11).
IANA is requested to designate TCP header bits 8 (CWR) and 9 (ECE) from the previously 6-bit Reserved field as the Congestion Window Reduced and ECN-Echo flags respectively, reducing the Reserved field to 4 bits.
A rogue or broken router that erases CE codepoints prevents congestion signals from reaching receivers, disabling congestion control for the affected flow and potentially increasing congestion and packet loss for all flows at the bottleneck.
An attacker that can spoof IP source addresses can inject out-of-window data packets with CE set, forcing the TCP receiver to send ECN-Echo ACKs and causing the sender to unnecessarily halve its congestion window. This denial-of-service attack is mitigated by the rule that retransmitted packets MUST NOT carry ECT and receivers SHOULD ignore CE on out-of-window packets.
The ECN field is not covered by IPsec cryptographic integrity checks; modifying the ECN field in an IPsec-tunneled packet does not cause any integrity verification failure and may constitute a covert channel. Running the tunnel in limited-functionality mode eliminates this channel.
TCP ECN receiver state: on receiving any CE data packet, enter 'echoing' state and set ECE on every ACK; remain in 'echoing' state until a CWR packet is received from the sender; then return to 'idle' state (ECE cleared) for subsequent non-CE packets.
The ECN field occupies bits 6 and 7 of the IPv4 TOS octet (identical to the IPv6 Traffic Class octet), yielding four 2-bit codepoints: 00 (Not-ECT), 01 (ECT(1)), 10 (ECT(0)), and 11 (CE — Congestion Experienced).
Two new flags are added to the TCP header: CWR (Congestion Window Reduced) at bit 8 and ECN-Echo (ECE) at bit 9 of the previously 6-bit Reserved field, reducing the Reserved field to 4 bits (bits 4–7).