ECN Notification – How to Extract Packets with ECN Notification Set

packet-analysistcptcpdumpwireshark

I am trying to understand DCTCP behavior. For that I am using RED queue discipline on switch port. I am generating traffic using iperf3 for 30 seconds. To capture the packets i am using tcpdump. However the tcpdump file is too large.

So, I wish to extract the packets that have been marked with ECN. Can someone please suggest a way so that I can filter only those packets that have ECN bit set in TCP headers ? Thanks in advance.

Best Answer

You can load the packet trace in Wireshark, and apply the filter

tcp.flags.ecn==1

to see only packets with the ECN-Echo bit set in the TCP header, and

tcp.flags.cwr==1

to see only the packets with the ECN-CWR (Congestion Window Reduced) bit set in the TCP header.

Here is the list of TCP filters in Wireshark.

You may also be interested in filtering on ECN-CE flags in the IP header, which you can do with

ip.dsfield.ecn == 0x03

Here is the list of IP filters in Wireshark.

To see what it should look like, you can download this sample capture from the Wireshark Sample Captures page. This capture includes packets with ECN events.

Related Topic