On Tue, Nov 25, 2003 at 08:12:46PM -0800, Nathan G. Grennan wrote: [snip] I'd argue that the /etc/sysctl.conf line is the real "fix", insofar as disabling ECN at all can be considered a "fix" and not a "workaround". Then people have the option of editing /etc/sysctl.conf to re-enable ECN, without having to recompile the kernel. (Mandrake has been doing this since one of their 8.x releases, BTW.) -Barry K. Nathan <barryn(a)pobox.com&gt;

On Wed, 26 Nov 2003, Nathan G. Grennan wrote: You are using test kernels. You are supposed to know what you are doing. If you are going to test you should test everything possible. Newbies are not supposed to be using test kernels if they do then the problems are on them. Maybe in production but not in test. Otherwise it will never get tested. .....Tom

On Wed, 2003-11-26 at 01:29, Arjan van de Ven wrote: I understand it is a standard, but in this case I take a pragmatist approach instead of a idealist. Past kernels don't have this on by default, and mysteriously breaking many sites is very bad whatever the reason. Another example is that you can set your smtp server to be very strict to RFC, but do most people want to ignore legitimate mail, no. At the very least put a warning in your readme.txt. I and I am sure many others would prefer it set back to disabled by default. If you plan to leave it this way in future official releases, at the bare minimum it should be in the release notes, if not option in the installer/firstboot with a warning. Three sites in two days is bad, and I am sure the list would grow. I know in the past when I had tried ECN I was cut off from a site I do business with, but now that site works just fine with it. I will try e-mailing the webmasters of these sites to get them to talk to their network or security administrators about the issue.

On 2003-12-04 at 10:22:40-0800 Kit Knox <kit(a)rootshell.com&gt; wrote: /sbin/iptables -t mangle -A POSTROUTING -p tcp -d example.com -j ECN --ecn-tcp-remove I forget the exact version of iptables in which the ECN target first appears, but it's supported on RHL9 and RHEL3 as well. (RHL80 doesn't have it.)