[Ecn-sane] Anybody has contacts at Dropbox?

[Sebastian Moeller]

Dear All,

I started to look at ECN action on my homelink and I do see the expected ECT(0) and CE marks (mostly under Linix, macos, inspite of what sysctl seems to imply does not use ECN for me any more). BUt I also see the following ECT(1) marked traffic roughly every 5 seconds:

root at turris:/srv/persistent/captures# tcpdump -i pppoe-wan -v -n '(ip6 and (ip6[0:2] & 0x30) >> 4  == 1)' or '(ip and (ip[1] & 0x3) 
== 1)' # ECT(1)
tcpdump: listening on pppoe-wan, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
22:53:07.470573 IP (tos 0x1,ECT(1), ttl 47, id 42039, offset 0, flags [DF], proto TCP (6), length 296)
    162.125.21.3.443 > 77.3.0.223.51272: Flags [P.], cksum 0x0a63 (correct), seq 2630111900:2630112144, ack 2551484650, win 130, options [nop,nop,TS val 808373969 ecr 2543738360], length 244
22:53:08.371720 IP (tos 0x21,ECT(1), ttl 47, id 64288, offset 0, flags [DF], proto TCP (6), length 170)
    162.125.21.3.443 > 77.3.0.223.51276: Flags [P.], cksum 0x06c6 (correct), seq 141475331:141475449, ack 2804301808, win 130, options [nop,nop,TS val 3764736866 ecr 3088513970], length 118
22:53:22.260844 IP (tos 0x1,ECT(1), ttl 47, id 42042, offset 0, flags [DF], proto TCP (6), length 173)
    162.125.21.3.443 > 77.3.0.223.51272: Flags [P.], cksum 0xfa7c (correct), seq 244:365, ack 415, win 130, options [nop,nop,TS val 808388758 ecr 2543769161], length 121
22:53:28.499273 IP (tos 0x1,ECT(1), ttl 48, id 12519, offset 0, flags [DF], proto TCP (6), length 170)
    162.125.21.3.443 > 77.3.0.223.51275: Flags [P.], cksum 0xac16 (correct), seq 2923091763:2923091881, ack 2176795132, win 130, options [nop,nop,TS val 4027691853 ecr 2152611355], length 118
22:53:34.021366 IP (tos 0x1,ECT(1), ttl 48, id 24318, offset 0, flags [DF], proto TCP (6), length 943)
    162.125.21.2.443 > 77.3.0.223.51273: Flags [P.], cksum 0x3498 (correct), seq 4110227536:4110228427, ack 4169408519, win 130, options [nop,nop,TS val 561393037 ecr 811888120], length 891
22:53:38.862554 IP (tos 0x1,ECT(1), ttl 48, id 46323, offset 0, flags [DF], proto TCP (6), length 284)
    162.125.21.2.443 > 77.3.0.223.51274: Flags [P.], cksum 0x7bc6 (correct), seq 3336805019:3336805251, ack 1852591643, win 130, options [nop,nop,TS val 723450354 ecr 2627633601], length 232

Whois tells me 162.125.21.[2|3] belong to dropbox (I have the dropbox client installed on that machine)

So what is going on here?

Is dropbox using ECT(1) for a rfc3168 style response?
Is dropbox silently already using an L4S-style CC for their TCP?
Is dropbox aiming for DSCP decimal 1 (aka LE) and actually setting TOS decimal 1 instead?
Was the assumption that ECT(1) is bot used simply wrong?


Anyway, if anybody from Dropbox is subscribed, or anybody here has contacts into dropbox, this seems like something worth looking into to get it fixed?

Regards
	Sebastian