ECN Chain¶
This module contains the ECNChain flow analysis chain which can be used by PATHspider’s Observer for recording Explicit Congestion Notification [RFC3168] details.
- class pathspider.chains.ecn.ECNChain[source]¶
This flow analysis chain records details of ECN markings in the IP header.
Field Name
Type
Meaning
ecn_ect0_syn_fwd
bool
An ECT0 mark was seen in the forward direction on a TCP SYN packet
ecn_ect1_syn_fwd
bool
An ECT1 mark was seen in the forward direction on a TCP SYN packet
ecn_ce_syn_fwd
bool
An CE mark was seen in the forward direction on a TCP SYN packet
ecn_ect0_data_fwd
bool
An ECT0 mark was seen in the forward direction on a TCP packet with a payload or a non-TCP packet
ecn_ect1_data_fwd
bool
An ECT1 mark was seen in the forward direction on a TCP packet with a payload or a non-TCP packet
ecn_ce_data_fwd
bool
An CE mark was seen in the forward direction on a TCP packet with a payload or a non-TCP packet
ecn_ect0_syn_rev
bool
An ECT0 mark was seen in the reverse direction on a TCP SYN packet
ecn_ect1_syn_rev
bool
An ECT1 mark was seen in the reverse direction on a TCP SYN packet
ecn_ce_syn_rev
bool
An CE mark was seen in the reverse direction on a TCP SYN packet
ecn_ect0_data_rev
bool
An ECT0 mark was seen in the reverse direction on a TCP packet with a payload or a non-TCP packet
ecn_ect1_data_rev
bool
An ECT1 mark was seen in the reverse direction on a TCP packet with a payload or a non-TCP packet
ecn_ce_data_rev
bool
An CE mark was seen in the reverse direction on a TCP packet with a payload or a non-TCP packet
- ip4(rec, ip, rev)[source]¶
Records ECN markings from an IPv4 header.
- ECN Marking
If an ECT0, ECT1 or CE mark is seen in the IPv4 header, the relevant field will be set to
True
.
- Parameters:
rec (dict) – the flow record
ip (plt.ip) – the IPv4 packet that was observed to be part of this flow
rev (bool) – True if the packet was in the reverse direction, False if in the forward direction
- Returns:
Always
True
- Return type:
bool
- ip6(rec, ip, rev)[source]¶
Records ECN markings from an IPv6 header.
- ECN Marking
If an ECT0, ECT1 or CE mark is seen in the IPv6 header, the relevant field will be set to
True
.
- Parameters:
rec (dict) – the flow record
ip (plt.ip6) – the IPv6 packet that was observed to be part of this flow
rev (bool) – True if the packet was in the reverse direction, False if in the forward direction
- Returns:
Always
True
- Return type:
bool