0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
                                +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                                |  Option Type  | Option Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|X|L|E|C|                       Reserved                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Figure 1: ConEx Destination Option Layout

  Option Type

     8-bit identifier of the type of option. The option identifier
     for the ConEx destination option will be allocated by the IANA.

  Option Length

     8-bit unsigned integer.  The length of the option (excluding 
     the Option Type and Option Length fields). This field MUST be
     set to the value 4.

  X Bit

     When this bit is set, the transport sender is using ConEx with 
     this packet. If it is not set, the sender is not using ConEx with 
     this packet.

  L Bit

     When this bit is set, the transport sender has experienced a loss. 

  E Bit

     When this bit is set, the transport sender has experienced 
     ECN-signaled congestion.

  C Bit

     When this bit is set, the transport sender is building up 
     congestion credit in the audit.

  Reserved

     These bits are not used in the current specification. They 
     are set to zero on the sender and are ignored on the receiver.

All packets sent over a ConEx-capable connection MUST carry the CDO. The CDO is immutable. Network devices SHOULD only read the flags. IPSeC Authentication Header (AH) may be used to verify that the CDO has not been modified.

If the X bit is zero all other three bits are undefined and thus should be ignored. The X bit set to zero means that the connection is ConEx-capable but this packet SHOULD NOT be accounted to determine ConEx information in an audit function. This can be the case for e.g. pure control packets not carrying any user data. As an example in TCP pure ACKs are usually not ECN-capable and TCP does not have an mechanism to announce the lost of a pure ACK to the sender. Thus congestion information about ACKs are not available at the sender.

If the X bit is set, all three other bit (L, E, C) MAY be set. Whenever one of these bits is set, the number of bytes carried by this IP packet (including the IP header) SHOULD be accounted for determining congestion or credit information. In IPv6 the number of bytes can easily be calculated by adding the number 40 (length of the IPv6 header in bytes) to the value present in the Payload Length field in the IPv6 header.

Credits are sent previous to the occurence of congestion (loss or ECN-CE marks) and the amount of credits should cover the congestion risk. Note, the maximum congestion risk is that all packets in flight get lost or ECN marked.

If the L or E bit is set, a congestion signal in form of loss or, respectively, an ECN mark was previously expirienced by the same connection.

In principle all of these three bits (L, E, C) MAY be set in the same packet. In this case the packet size MUST be accounted more than once for each respective ConEx information counter.

If a network node extracts the ConEx information from a connection, this node is usually supposed to hold this information byte-wise, e.g. comparing the total number of bytes sent with the number of bytes sent with ConEx congestion mark (L, E) to determine the current whole path congestion level. For ConEx-aware node processing, the CDO MUST use the Payload length field of the preceding IPv6 header for byte-based accounting. When equally sized packets can be assumed, the accounting of the number of packets (instead the number of bytes) should deliver the same result. But a network node must be aware that this estimation can be quite wrong, if e.g. different sized packed are send, and thus is not reliable.

A ConEx sender SHOULD set the reserved bits in the CDO to zero. Other nodes SHOULD not interpret these bits.

5. Implementation in the fast path of ConEx-aware routers

The ConEx information is being encoded into a destination option so that it does not impact forwarding performance in the non-ConEx-aware nodes on the path. Since destination options are not usually processed by routers, the existence of the CDO does not affect the fast path processing of the datagram on non-ConEx-aware routers. i.e. They are not pushed into the slow path towards the control plane for exception processing.

The ConEx-aware nodes still need to process the CDO without severely affecting forwarding. For this to be possible, the ConEx-aware routers need to quickly ascertain the presence of the CDO and process the option if it is present. To efficiently perform this, the CDO needs to be placed in a fairly deterministic location. In order to facilitate forwarding on ConEx-aware routers, ConEx-aware senders who send IPv6 datagrams with the CDO MUST place the CDO as the first destination option in the destination options header.

6. Compatibility with use of IPsec

In IPsec transport mode no action needs to be taken as the CDO is visible to the network. When accounting ConEx information the size of the Authentication Header (AH) SHOULD NOT be accounted as this information has been added later. In the IPsec Tunnel model the CDO SHOULD be copied to the outer IP header as this information is end-to-end. Only the payload of the outer IP header minus the AH SHOULD be accounted.

If the transport network can not be trusted authentication SHOULD be used to ensure integrity of the ConEx information. If an attacker would be able to remove the ConEx marks, this could cause an audit device to penalize the respective connection, while the sender cannot easily detect that ConEx information is missing.

7. DDoS mitigation by using preferential drop

If a router queue experiences very high load so that it has to drop arriving packets, it MAY preferentially drop packets within the same Diffserv PHB using the preference order given in Table 1 (1 means drop first). Additionally, if a router implements preferential drop it SHOULD also support ECN-marking. Preferential dropping can be difficult to implement on some hardware, but if feasible it would discriminate against attack traffic if done as part of the overall policing framework as described in [RFC6789]. If nowhere else, routers at the egress of a network SHOULD implement preferential drop (stronger than the MAY above).