ECN-Echo
TCP ECE (ECN-Echo, bit 1) has two distinct meanings depending on context. In a SYN packet it indicates the sender is ECN-capable. In non-SYN packets it signals that a packet with the ECN Congestion Experienced (CE) bit was received – the receiver is notifying the sender to reduce its sending rate.
Abbreviation
ECE
Bit Position
1
tcpdump
[E]
Standard
RFC 3168
Description
ECE (ECN-Echo) is dual-purpose. During the TCP handshake: a client sets ECE+CWR in its SYN to indicate ECN capability. If the server also supports ECN, it sets ECE in its SYN-ACK (without CWR) to confirm. Both sides then use ECN throughout the connection.
During data transfer: when the receiver gets a packet with IP ECN bits set to CE (Congestion Experienced, set by an ECN-capable router detecting queue buildup), it echoes this back to the sender by setting ECE in every ACK it sends until it receives an ACK with CWR set. This feedback loop allows the sender to reduce its congestion window before packet drops occur.
ECE in a non-SYN packet is a congestion warning. The sender receiving ECE must reduce cwnd and set CWR. If ECE continues appearing after CWR was sent, it means the congestion is ongoing.
Key Flag Combinations
| Flags | Meaning |
|---|---|
| ECE (SYN) | Server confirming ECN support in SYN-ACK |
| ECE+CWR (SYN) | Client requesting ECN capability in SYN |
| ECE (ACK) | Receiver notifying sender of ECN congestion – reduce sending rate |
When You See This Flag
- –ECN-capable router set CE bit on an IP packet due to congestion
- –TCP handshake ECN capability negotiation
- –Receiver forwarding congestion signal back to sender