How to find the cause for ECN-CWR?

[Eric Snijders]

Hi all,

I think i have a simple question. How do you find the (root)cause for ECN-CWR? For example, i have the following PCAP:

Is it safe to say that since the SYN (including the ECN-Echo and CWR flag) is coming from 172.24.138.112, the cause for this is on that side? Or is there a possibility 172.24.0.43 is causing it in this case?

[Georg Pauwen]

Hello,

do you actually see any congestion (in the output of 'show interfaces x') ? I did some research and found the below possible explanation for the ECN/CWR:

"ECN and CWR are related to bandwidth congestion, but in a SYN or SYN/ACK packet they're just parameters to tell the other receiver of that packet that it's a mechanism understood by the sender. So sometimes you see a TCP handshake with those two flags, but that doesn't mean there is congestion."

[amojarra]

Hi, 

For more information you can cehck: 

RFC 3168: The Addition of Explicit Congestion Notification (ECN) to IP (rfc-editor.org)

What is ECN(Explicit Congestion Notification)? - GeeksforGeeks

ECN+, ECN+/Wait, ECN+/TryOnce and Alternative Backoff with ECN (ABE) - GeeksforGeeks