ECN Chain¶
This module contains the ECNChain flow analysis chain which can be used by PATHspider’s Observer for recording Explicit Congestion Notification [RFC3168] details.
-
class
pathspider.chains.ecn.
ECNChain
[source]¶ This flow analysis chain records details of ECN markings in the IP header.
Field Name Type Meaning ecn_ect0_syn_fwd bool An ECT0 mark was seen in the forward direction on a TCP SYN packet ecn_ect1_syn_fwd bool An ECT1 mark was seen in the forward direction on a TCP SYN packet ecn_ce_syn_fwd bool An CE mark was seen in the forward direction on a TCP SYN packet ecn_ect0_data_fwd bool An ECT0 mark was seen in the forward direction on a TCP packet with a payload or a non-TCP packet ecn_ect1_data_fwd bool An ECT1 mark was seen in the forward direction on a TCP packet with a payload or a non-TCP packet ecn_ce_data_fwd bool An CE mark was seen in the forward direction on a TCP packet with a payload or a non-TCP packet ecn_ect0_syn_rev bool An ECT0 mark was seen in the reverse direction on a TCP SYN packet ecn_ect1_syn_rev bool An ECT1 mark was seen in the reverse direction on a TCP SYN packet ecn_ce_syn_rev bool An CE mark was seen in the reverse direction on a TCP SYN packet ecn_ect0_data_rev bool An ECT0 mark was seen in the reverse direction on a TCP packet with a payload or a non-TCP packet ecn_ect1_data_rev bool An ECT1 mark was seen in the reverse direction on a TCP packet with a payload or a non-TCP packet ecn_ce_data_rev bool An CE mark was seen in the reverse direction on a TCP packet with a payload or a non-TCP packet -
ip4
(rec, ip, rev)[source]¶ Records ECN markings from an IPv4 header.
- ECN Marking
- If an ECT0, ECT1 or CE mark is seen in the IPv4 header, the relevant
field will be set to
True
.
Parameters: - rec (dict) – the flow record
- ip (plt.ip) – the IPv4 packet that was observed to be part of this flow
- rev (bool) – True if the packet was in the reverse direction, False if in the forward direction
Returns: Always
True
Return type: bool
-
ip6
(rec, ip, rev)[source]¶ Records ECN markings from an IPv6 header.
- ECN Marking
- If an ECT0, ECT1 or CE mark is seen in the IPv6 header, the relevant
field will be set to
True
.
Parameters: - rec (dict) – the flow record
- ip (plt.ip6) – the IPv6 packet that was observed to be part of this flow
- rev (bool) – True if the packet was in the reverse direction, False if in the forward direction
Returns: Always
True
Return type: bool
-