Skip to main content

6.1.1.1 Middlebox Issues

6.1.1.1 Middlebox Issues​

ECN introduces the ECN-Echo and CWR flags in the TCP header (as shown in Figure 3) for initialization. There are some buggy firewalls, load balancers, and intrusion detection systems in the Internet that either drop ECN-setup SYN packets, or respond with a RST, perceiving such packets (with these bits set) as signatures of port-scanning tools that can be used for denial-of-service attacks. Some of the problematic devices have been identified, and the web page [FIXES] contains a list of non-compliant products and vendor-issued fixes, if available. The TBIT web page [TBIT] lists some of the Web servers affected by this buggy equipment. We mention this in this document as a warning to the community about this issue.

To provide robust connectivity even in the presence of such buggy equipment, a host that receives a RST in response to transmitting an ECN-setup SYN packet MAY resend the SYN with CWR and ECE cleared. This may result in a TCP connection being established without the use of ECN.

A host that does not receive a reply to an ECN-setup SYN within the normal SYN retransmission timeout interval MAY resend the SYN and any subsequent SYN retransmissions with CWR and ECE cleared. To overcome normal packet loss that might have caused the original SYN to be dropped, the initiating host may retransmit one or more ECN-setup SYN packets before giving up and retransmitting a SYN with the CWR and ECE bits cleared.

We note that, in this scenario, the following example scenario is possible:

(1) Host A: sends ECN-setup SYN. (2) Host B: sends ECN-setup SYN/ACK, packet is dropped or delayed. (3) Host A: sends non-ECN-setup SYN. (4) Host B: sends non-ECN-setup SYN/ACK.

We note that in this case, following the procedures above, neither host A nor host B can set the ECT bit on packets. Moreover, an important consequence of the rules in Section 6.1.1 regarding ECN-setup and use is that a host is forbidden from using receipt of an ECT packet as an implicit signal that the other host supports ECN.

Last updated on