Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am considering to clean these bits on the border of our network. Is this considered harmfull or evil?

Some Backbround:

We have ingress traffic from the Internet to some mobiloe Devices behind a IPSec Tunnel's to mobile network operator GGSN's.

+----+    +--------------+       +------------+ Tunnel via +----+     +------+
|Inet|----| Border router|------>|IPSEC-Router|============|GGSN|-----|mobile|
+----+    +--------------+       +------------+ Internet   +----+     +------+

Some of this ingress traffic from the internet is marked with a TOS of 0x03, remarkably all traffic from a german cable ISP named UnityMedia.

For a at the moment unknown reasons the IPSec Implemetation on the IPSec Router decides to throw away all packages marked with a TOS of 0x01 or 0x03. Regarding this I had a question asked here.

As workaround I would remove the ECN related bits from the TOS field on my border router but on the other side I am not sure if I could generate a new problem by doing so, and therefore my question:

Is this considered harmfull or evil?

share|improve this question
    
just out of interest , why do you want to scrub the ecn bits? –  The Unix Janitor Feb 3 '12 at 13:16

2 Answers 2

up vote 1 down vote accepted

No. This is typically done by engineers clearing dscp bits but it's the same idea. You as the network engineer should be the one who decides what traffic gets priority or special queuing permissions, not the endpoints. It's also very likely that most of the routers in the path don't have ECN queuing enabled, definitely not if it's going over the internet. Some routers and firewalls don't even copy the TOS bits from the unencrypted packet to the encrypted packet header.

Now as far as your case is concerned, are you running any real time applications over your network such as voice or video? What kind of router or firewall are you using to tunnel your traffic? If it's an enterprise class device you should be able to strip the ECN bits as they hit the unencrypted interface of the router. Is this tunnel going out over the internet or a private circuit?

Edit:

It is not considered evil because it is you who is responsible for your network, not your users. Therefore it is up to you to decide what traffic to pass and what speeds and queues to assign to that traffic. It's generally considered best business practice to scrub your users' DSCP bits at the ingress and do your own classification of traffic for queuing and congestion control.

Whether or not it is harmful depends on the scenario. It appears that in your scenario your users are coming in from the internet on a vpn tunnel then leaving back out to the internet in the clear. Since the internet is a best-effort network, ECN bits are essentially useless to you because the internet routers will not honor those bits. Typically QoS and congestion control at the transport level are only useful in a network where you can control the devices end to end or where you have a guaranteed rate or SLA with the provider.

share|improve this answer
    
See my clarifications in the question. –  Lairsdragon Feb 3 '12 at 13:49

Sorry, mod me down if applicable: I don't have enough mod points to vote down or add remarks.

The answer resmon6 gave sounds really bad and ignorant to me. He talks about TOS and DSCP as if it's the same as ECN. ECN is totally different and should be left alone and allowed to work!

resmon6:

You as the network engineer should be the one who decides what traffic gets priority or special queuing permissions"

Really? And that has to do with ECN how exactly?

resmon6:

It's also very likely that most of the routers in the path don't have ECN queuing enabled, definitely not if it's going over the internet.

Very far from the truth as far as I know. All Operating Systems and routers of the last decade or more support ECN and at least Linux has it partially enabled by default if I remember correctly and certainly NOT "all internet routers" disable ECN. There are a few bad apples (black holes) but by and large it works.

It's only ignorant people purposely breaking ECN that make it such problem for others to use it.

resmon6:

It is not considered evil because it is you who is responsible for your network, not your users.

What nonsense! As long as the traffic is not harmful you need to let your users do how they wish: net neutrality and all that. ECN is good for everyone: you and your users. Your statement makes no sense at all!

All you need to do to not f*ck with ECN is ignore it. Simply do nothing. Why in hell would you want to disable it?

Seriously... at least glance over the wikipedia page if you have no clue what ECN is before answering questions pretending to be an expert!

http://en.wikipedia.org/wiki/Explicit_Congestion_Notification

DSCP is not in there at all and the only TOS is in the word 'macintosh'! FCOL!

share|improve this answer
    
Why in hell would you want to disable it? -- Because it causes things not to work, especially in my case where a strange ISP choose to set these bits explicitly even if the originating Computer had set these bis to zero... –  Lairsdragon Feb 6 '12 at 14:48
    
Of course if there's a braindead router upstream, you can't do anything other than workaround it. Sure scrub the bits on that link. My complaint was against resmon6's answer, which went totally overboard advocating disabling any and all features because "it's my network and I decide that scary letters like ECN are bad for my users". –  Jannes Feb 6 '12 at 18:38
    
Cisco routers make up a large majority of networks. TCP ECN wasn't added until 12.3T and by default it is disabled. cisco.com/en/US/docs/ios/ipapp/command/reference/… –  resmon6 Feb 7 '12 at 15:52
    
ECN uses the two least significant (right-most) bits of the DiffServ field in the IPv4 or IPv6 header.... DiffServ uses the 6-bit Differentiated Services Code Point (DSCP) field in the IP header for packet classification purposes. DSCP replaces the outdated Type of Service (TOS) field. –  resmon6 Feb 7 '12 at 16:02
    
Cisco having ECN disabled doesn't mean it will purposely screw with connections with ECN bits. It just means it doesn't do anything special with them and therefore Congestion Encountered will not be set on that hop (but will on other hops). Getting to a global situation where ECN works reliably and effectively is a chicken and egg problem that doesn't need braindead admins actively preventing both from happening! –  Jannes Feb 8 '12 at 11:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.