On Thu, 2014-10-30 at 23:15 +0100, Florian Westphal wrote:

Do you think a fallback to non-ecn for retransmitted syns would help?
If not, do you think having ecn tunable available via route is helpful?

Unfortunately some firewalls are buggy and accept a single SYN per flow.

You would need to blacklist ecn at first sign of a possible ecn problem,
for all following connections attempts.

Note that ECN problems are not only contained in SYN packets being
eventually dropped. You might have a success to establish a flow, and
later get CE marks for all packets and cwnd converges to 1.

This is really a lot of work to get all sorted out.