This target can be great, used in the correct way. Simply put, the
ECN target can be used to reset the ECN bits from
the IPv4 header, or to put it correctly, reset them to 0 at least. Since ECN is
a relatively new thing on the net, there are problems with it. For example, it
uses 2 bits that are defined in the original RFC for the TCP protocol to be 0.
Some routers and other internet appliances will not forward packets that have
these bits set to 1. If you want to make use of at least parts of the ECN
functionality from your hosts, you could for example reset the ECN bits to 0
for specific networks that you know you are having troubles reaching because of
ECN.
 | Please do note that it isn't possible to turn ECN on in the middle of a stream.
It isn't allowed according to the RFC's, and it isn't possible anyways. Both
endpoints of the stream must negotiate ECN. If we turn it on, then one of the
hosts is not aware of it, and can't respond properly to the ECN notifications.
|
Table 11-4. ECN target options
| Option | --ecn-tcp-remove |
| Example | iptables -t mangle -A FORWARD -p tcp --dport 80 -j
ECN --ecn-tcp-remove
|
| Explanation | The ECN target only takes one argument, the --ecn-tcp-remove
argument. This tells the target to remove the ECN bits inside the TCP headers.
Read above for more information.
|
| Works under Linux kernel 2.5 and 2.6.
|
