Skip to main content

9.1.2 Changes to the ECN Field within an IP Tunnel

9.1.2 Changes to the ECN Field within an IP Tunnel​

The presence of a copy of the ECN field in the inner header of IP tunnel mode packets provides an opportunity to detect unauthorized modifications to the ECN field in the outer header. For implementations conforming to this document, the comparison of the ECT fields in the inner and outer headers falls into two categories:

  • If the IP tunnel uses the full-functionality option, the not-ECT codepoint SHOULD be set in the outer header if and only if the not-ECT codepoint is also set in the inner header.

  • If the tunnel uses the limited-functionality option, the not-ECT codepoint SHOULD be set in the outer header.

Receiving packets that do not meet the appropriate conditions may be cause for concern.

Consider the case where the tunnel entrance point of an IP tunnel has not been updated to the requirements of this document, while the tunnel exit point has been updated to support ECN. In this case, the IP tunnel is not explicitly configured to support the full-functionality ECN option. However, the behavior of the tunnel entrance point is the same as that of a tunnel entrance point supporting the full-functionality option. If packets from an ECN-capable connection use this tunnel, the ECT codepoint will be set in the outer header at the tunnel entrance point. Congestion within the tunnel may then cause an ECN-capable router to set CE in the outer header. Because the tunnel has not been explicitly configured to support the full-functionality option, the tunnel exit point expects the not-ECT codepoint to be set in the outer header. When an ECN-capable tunnel exit point receives a packet with an ECT or CE codepoint in the outer header on a tunnel that has not been configured to support the full-functionality option, it SHOULD process that packet based on whether the CE codepoint is set, as follows. It is RECOMMENDED that on tunnels that have not been configured to support the full-functionality option, if the CE codepoint is set in the outer header but not in the inner header, the packet SHOULD be dropped at the exit point, otherwise it SHOULD be forwarded.

IP tunnels cannot provide protection against clearing congestion indications based on changing the ECN codepoint from CE to ECT. Clearing congestion indications can affect the network and other flows in ways that are not possible without ECN. It is important to note that clearing congestion indications can only be performed on congestion indications placed by nodes within the tunnel; the copy of the ECN field in the inner header preserves congestion notifications from nodes upstream of the tunnel entrance (unless the inner header is also cleared). If clearing congestion notifications is considered a security risk that outweighs the congestion management benefits of ECN, tunnels can be specified or configured to use the limited-functionality option.

Last updated on