I am trying to understand DCTCP behavior. For that I am using RED queue discipline on switch port. I am generating traffic using iperf3 for 30 seconds. To capture the packets i am using tcpdump. However the tcpdump file is too large.

So, I wish to extract the packets that have been marked with ECN. Can someone please suggest a way so that I can filter only those packets that have ECN bit set in TCP headers ? Thanks in advance.

  • Why do you say the files are too large? You could also generate smaller files (-C <file size> option). You could also only capture TCP segments with the CWR flag set, indicating ECN. Since RED randomly drops IP packets, I'm not sure how that helps you to learn about DCTCP. When you want to experiment to learn, you should have a deterministic way to say that I am dropping this packet, not using randomness. – Ron Maupin Apr 14 '16 at 23:58
  • Hi @RonMaupin , thanks for your help. In tc-red I am setting min=30KB , probability=1 , avgpkt=1500, so that after 20 packets RED starts marking packets. Is this not the right configuration ? What is the queue discipline that I should use if I want to mark packets after a certain threshold number of packets ? Can you please suggest ? – akadam Apr 15 '16 at 3:20
  • RED randomly drops packets to keep a queue from filling up and doing tail drops, in order to prevent synchronization. You could send traffic with ECN marked, or not, at specific points. To study something like this, you really want to be able to start and stop when you want. For instance, how do you know that ENC starts after 20 packets? It will take more than 20 packets to get a queue to fill to 20 packets since the queue is being emptied at the same time as being filled. How many sent packets before the queue is 20 packets deep? – Ron Maupin Apr 15 '16 at 12:50
  • @RonMaupin. I apologize for my previous unclear comment. I meant that after queue itself contains 20 packets or more, RED algorithm starts marking packets with ECN-CE bit set. In order to experiment this I set min_th=30KB, max_th=31.5KB, limit=700KB and probability=1. When the queue reaches the limit value RED starts dropping packets. However as DCTCP marks packet we never drop packets,they are marked and senders reduce their windows thus reducing congestion. We can check dump output for the same to see if ECN-CE is set. Thanks for your help. Please correct me if I am wrong. – akadam Apr 16 '16 at 2:18

You can load the packet trace in Wireshark, and apply the filter


to see only packets with the ECN-Echo bit set in the TCP header, and


to see only the packets with the ECN-CWR (Congestion Window Reduced) bit set in the TCP header.

Here is the list of TCP filters in Wireshark.

You may also be interested in filtering on ECN-CE flags in the IP header, which you can do with

ip.dsfield.ecn == 0x03

Here is the list of IP filters in Wireshark.

To see what it should look like, you can download this sample capture from the Wireshark Sample Captures page. This capture includes packets with ECN events.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.