Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Linux IPSec Tunnel between a GGSN of a network operator and our data center. The IPSec works fine for all traffic but IP Packets coming from our side and are marked with ECN bit set to 0x3 (CE, Congestion experianced) will not encrypted and forwarded to the tunnel.

The Tunnel is setup without ECN support, but for my understanding this should not lead to a packet drop.

Linux Kernel Version is 2.6.18-6-xen-amd64 #1 SMP Fri Dec 12 07:02:03 UTC 2008 x86_64 GNU/Linux (quite old but the xen infrastructure does not allow newer kernels)

Keying Daemon is racoon 0.7.3

Any hints how to overcome this problem?

share|improve this question
did u try tcp_ecn flag ON under /proc/sys/net/ipv4/ – user283964 Apr 27 '15 at 17:25

If you're using Openswan as I presume, you'll get an answer fastest from #openswan on -- that's where the devs hang out, and they will often ask lots of good questions to help you debug your situation.

share|improve this answer
Well its not openswan, but the stock kernel KAME Implementation – Lairsdragon Feb 1 '12 at 20:22
Try openswan then ;-) – mikebabcock Feb 7 '12 at 14:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.