For ongoing research I'm conducting, I'm measuring the modification of ECT fields of the IPv header. To do this I'm relying on ICMP quotations to inspect what packets 'look like' as they traverse the network.
However, I have noticed, upon sending ECT marked TCP or UDP packets imitating traceroutes. Some of the ICMP responses themselves are marked as ECN capable. Just wondering if anyone else had either noticed or could explain this.