# A Fresh Look at ECN Traversal in the Wild

Hyoyoung Lim<EMAIL_ADDRESS>University of Colorado Boulder ,
Seonwoo Kim<EMAIL_ADDRESS>University of Colorado Boulder ,
Jackson Sippe<EMAIL_ADDRESS>University of Colorado Boulder ,
Junseon Kim<EMAIL_ADDRESS>UNIST ,  Greg White<EMAIL_ADDRESS>CableLabs ,  Chul-Ho Lee<EMAIL_ADDRESS>Texas State University ,
Eric Wustrow<EMAIL_ADDRESS>University of Colorado Boulder ,  Kyunghan
Lee<EMAIL_ADDRESS>Seoul National University ,  Dirk Grunwald
<EMAIL_ADDRESS>University of Colorado Boulder and  Sangtae Ha
<EMAIL_ADDRESS>University of Colorado Boulder

###### Abstract.

The Explicit Congestion Notification (ECN) field has taken on new importance
due to Low Latency, Low Loss, and Scalable throughput (L4S) technology
designed for extremely latency-sensitive applications (such as cloud games and
cloud-rendered VR/AR). ECN and L4S need to be supported by the client and
server but also all devices in the network path. We have identified that “ECN
bleaching”, where an intermediate network device clears or “bleaches” the ECN
flags, occurs and quantified how often that happens, why it happens and
identified where in the network it happens.

In this research, we conduct a comprehensive measurement study on end-to-end
traversal of the ECN field using probes deployed on the Internet across
different varied clients and servers. Using these probes, we identify and
locate instances of ECN bleaching on various network paths on the Internet. In
our six months of measurements, conducted in late 2021 and early 2022, we
found the prevalence varied considerably from network to network. One cloud
provider and two cellular providers bleach the ECN field as a matter of
policy. Of the rest, we found 1,112 out of 129,252 routers, $4.17\%$ of paths
we measured showed ECN bleaching.

††copyright: none

##  1\. Introduction

RFC 3168 (Ramakrishnan et al., 2001) specifies the incorporation of Explicit
Congestion Notification (ECN) to TCP/IP, which allows routers to signal
impending congestion to endpoints before buffers overflow or packets get
dropped by routers. The IP header contains a 2-bit field known as the ECN
field to enable such an end-to-end notification of impending network
congestion without dropping packets. To enable ECN, a sender marks its packets
as ECN-Capable and then reacts to congestion signaled by the network. As
packets traverse the network, congested devices mark ECN-enabled packets to
indicate congestion rather than dropping those packets. The receiver monitors
received packets for ECN congestion signals and sends congestion feedback to
the sender. ECN relies on the network devices to either pass along packets
with the ECN information unmodified if there is no congestion or to indicate
congestion by marking the ECN bits. It only takes one misbehaving device in a
network path to eliminate the benefit of ECN – if any network device between a
sender and receiver clear the ECN bits, the sender and receiver will not learn
about the impending congestion.

There are several benefits to ECN (Fairhurst and Welzl, 2017), particularly as
a congestion signal that reduces application latency by foregoing dropping
packets to signal congestion. Congestion control algorithms treat ECN
congestion signals identically to packet drops as far as congestion response.
Most OSs have ECN enabled by default (Learmonth et al., 2016; Mandalari et
al., 2018), meaning they respond to and use ECN if requested by the sender.

Recently, the L4S (Low Latency, Low Loss, and Scalable throughput) standard
proposal (Briscoe et al., 2022) recognized that the original definition of ECN
could be improved to significantly reduce latency and latency variation, and
could improve the scalability of congestion control designs for wide-area
networks using the mechanisms previously used in Datacenter TCP (Alizadeh et
al., 2010; Bensley et al., 2017) while coexisting with the existing TCP and
QUIC traffic on the Internet. L4S aims to enable high-bandwidth, extremely
latency-sensitive applications, such as cloud games and cloud-rendered VR/AR,
to achieve their performance objectives to a degree that has not been
practically feasible with existing congestion feedback mechanisms and is a key
element of proposed access network technologies such as Low-Latency DOCSIS.
L4S uses the ECT(1) codepoint as an identifier for ‘L4S’ packets to be
distinguished from ‘classic ECN’ packets and has a separate treatment of L4S
packets via an independent queue to reduce queuing delay (Schepper and
Briscoe, 2020).111The ECT(1) codepoint was originally defined along with
ECT(0) to indicate ECN-Capable Transport (ECT) in the ECN specification
(Ramakrishnan et al., 2001). Unfortunately, some network devices clear or
“bleach” the ECN bits, limiting the benefit of ECN and also L4S.

ECN is widely available since most server OSs have ECN enabled by default
(Learmonth et al., 2016; Mandalari et al., 2018). Studies (Bauer et al., 2011;
Trammell and Kühlewind, 2015; Mandalari et al., 2018) using path traversal of
ECN using a traceroute-based method have shown that path traversal of ECN has
become close to universal (as long as two endpoints have ECN enabled), but
there are still a non-trivial fraction of paths along which network nodes wipe
the ECN field of packets. In 2019, Roddav et al. (Roddav et al., 2019) used
passive measurements to show that only 5.23% of traffic is using ECN
codepoints, possibly because of ECN “bleaching”.

It remains largely unknown where such bleaching paths are prevalent in the
Internet in terms of ISPs and geographical regions, and why they exist or if
ECN signaling is being used. Mandalari et al. (Mandalari et al., 2018)
observed that more than half of the mobile carriers that they tested bleach
the ECN field to zeros, and the ECN bleaching cases happen in the first hop
from mobile clients. Two recent studies (Bhooma, 2017; Holland, 2020) indicate
that there are a few networks that have enabled ECN congestion signaling, but
the majority have not.

In light of significant interest in the new L4S ECN architecture, it is now
the time to revisit the usability (i.e. traversal) of ECN in cellular as well
as wired networks. We conducted a study of a 24 hour passive trace of network
traffic at a single vantage point within a University network, looking at the
prevalence of the different values within ECN fields in the IP and TCP packet
headers. We also have conducted an active measurement study on end-to-end
traversal of the ECN field using probes deployed on the Internet across
different locations and providers using two forms of active measurements.
First, we used PATHspider (Learmonth et al., 2016) to determine which
HTTP/HTTPS servers have ECN enabled to better understand ECN adoption. Then,
using a tool we developed, we identified and located instances of ECN
bleaching on various network paths on the Internet.

We learned different things from our passive and active measurements. In our
six months of measurements, conducted in late 2021 and early 2022, aside from
one cloud provider that bleaches the ECN field as a matter of policy, we found
1,112 out of 129,252 routers, and 4.17% of paths showed ECN bleaching and many
networks have no bleaching. However, previous studies (Roddav et al., 2019)
using passive measurements showed that only 5.23% of traffic is using ECN,
which is a perplexing result given that ECN is enabled for most modern OSs. We
found that although ECN is enabled by receivers for _incoming_ packets, ECN is
not requested for _outgoing_ packets by senders by default. In other words,
many networks and servers are ready for ECN but client devices (Høiland-
Jørgensen, 2016) or applications (Microsoft, 2021) need to enable ECN for it
to be used.

Table 1. Dataset types and descriptions.

Type | Data collection | # of paths | Data size
---|---|---|---
Active | Server measurement | 2,656,935 | 3.4 GB
Active | Traceroute localization | 530,795 | 2.4 GB
Passive | 1-day traffic trace data | - | 9.8 GB

The remainder of this paper is structured as follows. First, we describe the
old (classic) and new (L4S) schemes of ECN in Section 2. Then, in Section 3,
we present the probes we use and the data collection methodology. Next, using
the results from our methodology, we characterize the current state of ECN
traversal and compare it to previous studies in Section 4. We discuss
additional results in Section 5. Finally, Section 6 reviews related work
before Section 7 concludes with a summary of our findings.

##  2\. Background

###  2.1. Explicit Congestion Notification

The original ECN specification (i.e. Classic ECN) was standardized in 2001 to
allow routers to provide end-to-end notification of incipient network
congestion instead of using packet drops as an indication of congestion
(Ramakrishnan et al., 2001). The basic idea behind ECN is to provide an
unambiguous signal of congestion without additionally causing a degradation
(i.e. packet loss) in the transfer of data. In a router, ECN is implemented
via an active queue management (AQM) mechanism that evaluates queue depth
and/or queue latency, and when the queue exceeds a threshold it marks the
packet to indicate congestion has been experienced. The benefits of ECN
include reducing packet loss in the Internet, which in turn leads to avoiding
an increased application-layer latency caused by packet retransmissions. As a
result, ECN improves the user experience in latency sensitive applications.

Table 2. ECN codepoints and their meanings.

ECN codepoint | Binary | L4S meaning
---|---|---
Not-ECT | 00 | Not ECN-capable transport
ECT(0) | 10 | Classic ECN-capable transport
ECT(1) | 01 | L4S-capable transport
CE | 11 | Congestion experienced

We provide a brief overview of how ECN works with TCP (on top of IP), assuming
that two endpoints and all the intermediate routers between the endpoints are
ECN-capable. ECN uses an ECN field of two bits in the IP header, which are the
last two bits of the type of service (TOS) field originally defined in the IP
header. The codepoints of the ECN field and their meanings are shown in Table
2. The ECT codepoints ‘10’ and ‘01’ – ECT(0) and ECT(1) – were originally
equivalent in the ECN specification (Ramakrishnan et al., 2001), but ECT(1)
has been repurposed to indicate L4S packets under the L4S service architecture
(Briscoe et al., 2022), leaving ECT(0) to indicate Classic ECN packets. ECN
also requires support from the transport protocol (i.e., TCP) in addition to
the functionality provided by the ECN field of IP packets.

The endpoints, i.e., TCP client and server, first negotiate ECN capability
during the establishment of their connection. After successful negotiation, a
Classic ECN sender sends IP packets with ECT(0) set in the ECN field to
indicate that they are ECN-capable. If a router detects impending congestion
(with the help of an AQM mechanism) when a Classic ECN-capable packet arrives
at the router, it marks the ECN field of the packet with the CE codepoint, and
forwards the packet instead of dropping it. When the receiver receives this
packet with CE set in the ECN field, it informs the sender of the congestion
indication by sending its next TCP ACK with the ECN-Echo (ECE) flag marked in
the TCP header. Upon receiving this TCP ACK, the sender then reacts to the
congestion as if a packet has been dropped and sends the next packet with the
Congestion Window Reduced (CWR) flag marked in the TCP header to acknowledge
the receipt of the congestion indication. Note that the ECE and CWR flags in
the TCP header are also used for the negotiation of ECN capability during
connection establishment. See (Ramakrishnan et al., 2001) for more details.

Table 3. Default ECN settings in major OSs

OS and version | Default ECN setting
---|---
Linux kernel 2.4.20 $\uparrow$ | Enabled for incoming ECN
connections
Mac OSX 10.11, iOS 9 $\uparrow$ | Enabled for incoming ECN
connections
Windows Server 2012 $\uparrow$ | Enabled for both incomming
and outgoing ECN connections

Table 3 shows default ECN settings in the current major OSs. Most modern OSs
use ECN and echo incoming ECN connections, but do not initiate the use of ECN
on outgoing connections. In other words, many networks and servers are ready
for ECN. However, client devices (Høiland-Jørgensen, 2016) or applications
(Microsoft, 2021) need to enable ECN for it to be used.

###  2.2. L4S

L4S is a service architecture that uses ECN as an integral component to
achieve high bandwidth and low latency for Internet applications and is
currently undergoing standardization (Briscoe et al., 2022). The main idea
behind L4S is to take advantage of the fact that the congestion signal in ECN
isn’t a degradation in the way that packet drops are, and thus congestion
signals can be sent much more frequently in order to provide high-fidelity
congestion information. As mentioned above, L4S redefines the ECT(1) codepoint
to indicate L4S-Capable Transport, and in the context of an L4S flow it
redefines the CE codepoint to provide this fine-grained congestion feedback.

L4S supports incremental deployment, via a classic congestion control response
to packet drops, and via in-network isolation of classic traffic from L4S
traffic. L4S routers isolate these two types of traffic from one other so that
the queuing latency caused by classic traffic doesn’t impact L4S traffic, and
so that the two types can each be provided their appropriate congestion
signals. Two queuing mechanisms have been defined for this purpose. One is
referred to as Dual-Queue Coupled AQM, the other is an L4S-aware flow queuing
approach.

Dual-Queue Coupled AQM routers have two separate queues at the network
bottleneck one for L4S traffic and one for classic traffic, where the ECN
field is used as an identifier for L4S packets to be distinguished from
classic packets. The queue for L4S traffic has a shallower (or smaller) buffer
size, which allows the L4S packets to experience very low queueing delay.
Additionally, packets in the L4S queue are marked with CE in the ECN field (to
notify the endpoints of impending congestion) as soon as they start building
up in the queue (e.g. when the queue delay exceeds a low threshold of 500 µs
or 1 ms). However, the queue for classic traffic has a larger buffer to
maintain full utilization since the queue needs to be large enough to cope
with large saw-tooth rate variations by a classic congestion control. In
addition, despite the use of separate queues, the congestion signaling is
coupled between the queues so that the two types of traffic share the
bottleneck bandwidth in a fair manner. See (Briscoe et al., 2022; Schepper et
al., 2022) for more details.

The L4S-aware flow queuing approach provides a separate queue for each
individual flow based on a hash of the header 5-tuple, and then provides CE-
marking of ECT(1) packets via a shallow queue delay threshold (e.g. 1 ms)
while ECT(0) or Not-ECT packets are CE-marked or dropped (respectively) using
a classic AQM algorithm.

L4S is not limited to a certain type of network but can be implemented in
different types of networks. However, the implementation of L4S in different
networks poses different sets of obstacles, especially when L4S is implemented
in 5G (Brunello et al., 2021; Willars et al., 2021) and WiFi (NOKIA, 2020).

(a) Request and respond method (§3.1.1) (b) Traceroute method (§3.1.2) (c)
Passive method (§3.2)

Figure 1. (a) Request and respond method: ① A probe starts ECN negotiation
with a TCP SYN segment having the ECE and CRW flags set in the TCP header. ②
The server responds with a SYN/ACK segment with ECE set. ③ The probe sends an
ACK segment to finalize the negotiation. ④ The probe sends an HTTP request
encapsulated in an IP packet with ECT(0) set. ⑤-1 In normal cases, the server
sends back an ECN-marked IP packet. ⑤-2 However, if ECN bleaching happens, the
probe will receive packets that have the _cleared_ ECN field (0b00). (b)
Traceroute method: ① A source probe sends ICMP echo request packets, each with
incrementing TTL values, to a target server/probe. ② When TTL expires, the
router sends back an ICMP time exceeded error message to the source. ③ If a
router bleaches the ECN field, the IP packet carrying the error message has
0b00 in the ECN field. (c) Passive method: We used a mirroring tap installed
with the campus network to capture all traffic traversing the network.

##  3\. Measurement Methodology

In this section, we explain the details of our methodology for active and
passive measurements to examine the _status quo_ of the deployment and
traversal of ECN in a wide range of wired and cellular networks. Specifically,
we use a ‘request and respond’ method and a traceroute-based method for active
measurement to test or probe specific paths to measure ECN capability. To
complement the active measurement results, we also passively collect and
analyze a 24-hour trace of network traffic at a vantage point within a large
University campus network to understand what fraction of traffic is ECN-
enabled or how widely ECN is currently being used in practice.

###  3.1. Active Measurement

####  3.1.1. Request and Respond Method

We use the active measurement tool called PATHspider (Learmonth et al., 2016)
for the request and response method to investigate the server-side deployment
of ECN and the traversal of ECN over the paths to servers. There are two
phases in this method, namely ECN negotiation phase and data transmission
phase.

First, the ECN negotiation phase allows us to confirm the ECN support of a
target web server if the negotiation with the server succeeds. Specifically, a
probe attempts to negotiate ECN capability with a targeted server while
establishing a TCP session with the server. The probe first sends to the
server a TCP SYN segment with ECE and CWR flags set in the TCP header. The
server then sends back to the probe a SYN-ACK segment with ECE flag set, if
the server supports ECN. Otherwise, the server just sends a plain SYN-ACK
segment. After that, the server responds with an ACK to finalize the
negotiation and establish a new session with the probe. It is worth noting
that the ECN negotiation is invisible to routers in the path between the probe
and the server since it is done at the transport layer. In other words, the
routers do not affect the ECN negotiation even if there is a router in the
path that bleaches the ECN field of IP packets.

Second, the data transmission phase allows us to check whether ECN bleaching
happens along the path from the probe to the server, assuming that the server
supports ECN. The probe starts with sending an HTTP request to the server,
where the IP packet carrying the HTTP request has ECT(0) marked in the ECN
field. The server then sends an HTTP response back to the probe. The ECN field
of the IP packet carrying (a part of) the HTTP response has either ECT(0) or
CE marked, where ECT(0) is 0b10 and CE is 0b11. While the former is for normal
cases, the latter happens when a router in the path signals impending
congestion by setting the ECN field of the packet with CE. However, if ECN
bleaching happens at a router in the path (i.e., the router clears the ECN
field to 0b00), the IP packets received by the probe lose the ECN marking.
Therefore, we can identify the presence of ECN bleaching by looking at the ECN
field of incoming IP packets from the server.

####  3.1.2. Traceroute Method

To investigate whether the ECN-marked IP packets traverse the network without
any illegitimate modifications, we use the traceroute-based method that has
been used in the literature (Bauer et al., 2011; Detal et al., 2013; Trammell
et al., 2017; Mandalari et al., 2018). For a source probe and a target
server/probe, this method relies on an ICMP time exceeded error message, which
is generated at each router along the path to the target destination and sent
back to the source. Traceroute sends a sequence of ICMP echo request packets
whose IP packets have incremented time-to-live (TTL) values toward the IP
address of the target destination. Each router discards an incoming IP packet
when its TTL expires. In this case, the router also generates an ICMP time
exceeded error message to the source. Upon receiving the error message at the
probe, we can check whether there has been a change in the ECN field of the IP
packet that carries the error message. Thus, in the traceroute-based method,
we cycle through the ECN bits of the IP packets carrying ICMP echo request
packets from 0b00 to 0b11 (recall the four ECN codepoints in Table 2), while
the TTL values of the packets increment.

####  3.1.3. Measurement Probes

For the above active measurements, we use three types of probes, which are
crowdsourced probes, cellular probes, and cloud probes.

Crowdsourced probes. We deployed the ECN measurement probes within the home
and work ISP networks of 11 volunteers who participate in this study. The
majority of the volunteers are located in the U.S., and the others are in
Canada, Argentina, and Germany. Specifically, the 11 volunteers from four
countries installed measurement probes in ten different home and work ISP
networks, namely, Armstrong, Charter, Comcast, Cox, Rogers, Shaw, Telecom
Argentina, Verizon business, and Vodafone. Many of the probes are deployed
behind NAT/firewall in which case they only function as source probes for the
traceroute-based method. Note that we did not use PATHspider with the
crowdsourced probes since the volume of the traffic generated by PATHspider
can be a burden to the volunteers.

Cellular probes. We set up laptops with USB tethering as cellular probes to
connect to cellular networks in order to examine ECN capability in cellular
networks. We consider the cellular networks of six major US and South Korean
carriers in this study, namely AT&T, Verizon, T-mobile, KT, LGU+, and SKT. The
cellular probes do not have public IP addresses to be connected from the
outside of a network, so they only act as source probes for the request and
respond method.

Cloud probes. We placed 37 cloud probes (or vantage points) in 33 geographic
regions around the world and within the cloud servers operated by five
different cloud service providers, namely, AWS, Azure, GCP, DigitalOcean, and
Cloudlab. Cloudlab (Duplyakin et al., 2019) is the only non-profit cloud
service that provides high-performance computing and networks across several
states in the U.S. We set up a virtual machine (VM) server at each one of
multiple cloud servers for each provider. The VM servers installed in multiple
locations are to reflect the presence of multiple cloud servers across
different geographical regions. In addition, each VM server has a public IP
address, which allows it to be connected from other probes.

It is worth noting that we would not get meaningful results if we only use
cloud probes, as most of the primary cloud service providers, such as Amazon,
Google, and Microsoft, have massive private WANs, which hide tenant traffic
from the public Internet.

###  3.2. Passive Measurement

While the above two active measurement methods allow us to examine the status
quo of the ECN readiness in various types of networks, they cannot be used to
reveal how widely ECN is currently being used in practice. To this end, we
collected and analyzed a 24-hour trace of network traffic, whose data size is
10GB, at a vantage point within a large University campus network, from which
we can see how widely ECN is currently being used among the traffic over the
campus network.

We post-processed the traffic data as follows. We first obtained packet traces
that only contain the IP and TCP/UDP headers of packets by stripping out their
actual payloads. We next identified a packet trace per flow. The flow
information that we collected includes the source and destination IP addresses
and their country codes, port number, the ECN codepoint of the ECN field in
the IP header, and the ECE and CWR flags in the TCP header, if the flow is a
TCP flow. From the per-flow information, we were able to obtain the overall
distribution of the ECN codepoints in the IP header as well as that of the ECE
and CWR flags in the TCP header. We were also able to find the separate
distributions of the ECN codepoints per port number. We finally investigated
possible causes for the case when ECN(0) or ECN(1) is set in the ECN field of
IP header while its upper transport protocol is not TCP.

##  4\. Measurement Results

In this section, we closely examine the ECN field in the wild. We first
present the ECN support results from our vantage points to public websites. We
then use the traceroute-based method to understand how many Internet paths
support ECN and pinpoint where ECN bleaching happens. Lastly, we examine the
overall usage of ECNs from traffic traces collected on a University campus.

###  4.1. ECN-enabled Public Websites

####  4.1.1. Methodology.

To consider CDN deployment of popular websites listed as Alexa 100K website
domains (Alexa, 2021), we chose 16 different vantage points out of 25. We then
obtained 404,382 unique IP addresses for these websites by removing duplicate
ones. We use the request and response method using PATHspider to check if ECN
is supported from each vantage point to each website, where our probe in each
vantage point sends an HTTP request and checks the response. We ensure that a
middlebox or the network where each vantage point is hosted is not mangling
TCP and IP headers.

Figure 2. Geographic locations of tested Alexa 100K web servers. Since popular
domains provide their service from geographically distributed clouds, the
total number of unique IPs 404,382 is much more than the number of listed
domains. U.S. accounts for most of the IPs by 53.6%, followed by Germany
(4.8%), Russia (4.3%), and Canada (3.8%).

Web server locations. We are interested in understanding where these websites
are geographically located. We use whois command to locate each IP address.
Figure 2 shows the locations of Alexa 100K websites by using the location
information (i.e., City, StateProv, and Country) from each whois query. The
majority of Alexa 100K websites are located in the U.S. (56%), followed by
Germany (4.8%), Russia (4.3%), and Canada (3.8%).

Figure 3. Top 10 web-server hosting services of Alexa 100K web servers. The
total of 10,950 unique Web-server hosting providers are identified for Alexa
100K websites. Among 404,382 IPs, Cloudflare (74,510) and Amazon (63,285) show
the highest proportion.

Web server hosting providers. We are also interested in service providers
hosting these websites. We classify each IP address based on the service
providers’ names using the whois response. Figure 3 shows the top 10 providers
for Alexa 100K websites. We obtained around 10,950 providers serving these
websites. We found that many web servers are hosted in major data centers in
the U.S. with Cloudflare and Amazon being the top 2 providers, serving 21.1%
and 17.1%, respectively.

Figure 4. ECN deployment status in chronological order. ECN deployment has
rapidly increased to 80% in 2015’s measurement study. In our measurement
study, ECN deployment has risen to 86.4%, following the trend shown in 2015’s
measurement study showing 80%.

####  4.1.2. ECN deployment status on the servers.

Figure 4 shows the ECN deployment ratio over the last two decades in
chronological order. Measurement studies (Padhye and Floyd, 2001; Medina et
al., 2005; Langley, 2008) before 2010 reported an almost negligible number of
ECN-enabled web servers. The study in 2015 (McQuistin and Perkins, 2015)
reported that ECN deployment had rapidly increased to 80%. Our measurement
study shows that the percentage of ECN-supported web servers is now 86.4%,
following the trend shown in the 2015 study. These servers offer successful
ECN negotiation to the client during TCP session establishment; this
percentage still includes the cases where a TCP session with successful ECN
negotiation is bleached in IP packets by some intermediate routers.

Table 4 shows the details of this measurement results. Among 349,188 (85.4%)
ECN-enabled Web servers completing successful ECN negotiation in TCP session
establishment, 37,798 (10.8%) hosts show ECN bleaching in IP packets; we
conjecture that these paths have ECN bleaching points between the vantage
points and these Web servers. The 0.2% percentage of CE marking on ECN-enabled
connections matches the results by Apple in 2017 (Bhooma, 2017) that the
percentage of CE marking in the packets between two ECN-enabled devices in the
U.S. shows 0.2% while it varies from country to country.

Table 4. ECN-enabled web servers obtained from one vantage point to the list of public websites (404,382 IPs). Codepoint | Enabled | (pct) | Disabled | (pct)
---|---|---|---|---
Total | 349,188 | (86.4%) | 55,194 | (13.6%)
00: Not-ECT | 37,798 | (10.8%) | 55,141 | (99.9%)
10: ECT(0) | 259,634 | (74.4%) | 48 | (0.09%)
01: ECT(1) | 50,898 | (14.6%) | 3 | (0.01%)
11: CE | 858 | (0.2%) | 2 | (0.004%)

####  4.1.3. ECN-enabled paths within or across continents

By sending a request from the vantage points hosted in cloud providers where
no local ECN bleaching is observed to public websites, we measure the
percentage of ECN-enabled paths showing successful ECN negotiation in TCP
sessions. Figure 5(a) visualizes ECN-enabled paths within or across
continents. $-1$ indicates no available measurement data. Interestingly, no
particular region supports ECN better than the others. We conjecture that ECN-
enabled paths depend largely on the OS version and settings of hosting web
servers which may not correlate with geographical locations. If we average for
each destination continent, the ECN-enabled path ratio becomes close to 86.4%
of the ECN deployment ratio in Figure 4.

(a) ECN-enabled path ratio

(b) ECN-bleaching path ratio

Figure 5. ECN-enabled and ECN-bleaching path ratios within and across
continents. $-1$ represents no results are available. ECN-enabled paths are
less correlated with the geographical locations of clients and web servers
(a). Europe (EU) and South America (SA) show the highest bleaching ratio
within the same continent. The requests sent from vantage points in North
America (NA) show higher ECN bleaching rates (over 40%).

####  4.1.4. ECN-bleached paths within or across continents

From each ECN-enabled path of successful ECN negotiation in TCP sessions
(Figure 5(a)), we show the ECN bleaching ratio where ECN bits are wiped in IP
packets (Figure 5(b)). Europe (EU) and South America (SA) show the highest
bleaching ratio within the same continent. North America (NA) was the highest
ECN bleaching source among the other continents. The Africa (AF) websites show
relatively low bleaching rates except for NA-originated traffic, while Oceania
(OC) websites show the lowest ECN bleaching rates. These results illustrate
that the ECN bleaching points are located primarily in North and South America
and Europe.

####  4.1.5. ECN bleaching from different access networks

We check the impact of different access networks when clients located in each
access network connects to public websites. Table 5 shows the summary of ECN
negotiation and bleaching percentages for different types of access networks
and providers. In wired access networks, Comcast shows a 51.35% ECN bleaching
percentage among the ECN-enabled paths with successful ECN negotiation
(86.8%). In contrast, the other providers show around 10% ECN bleaching
percentage, which matches the overall ECN deployment percentage in Table 4.

In cellular networks, AT&T shows ECN negotiation responses come from the
middleboxes at the TCP connection establishment phase, not by the destination
web servers. We confirmed this behavior by sending an ECN negotiation packet
to ECN-disabled web servers. Surprisingly, the client successfully negotiates
ECN with any web server (99.8%)222We confirm that this is not because of the
USB tethering., indicating the presence of performance-enhancing proxies
(PEPs) in the network. On the other hand, SKT in South Korea bleaches 100% of
ECN-negotiated sessions; it wipes ECN bits in all IP headers.

Table 5. ECN bleaching from different access networks in the U.S. and South Korea. Type | Provider | location | Negotiation | Bleaching
---|---|---|---|---
|  |  | Percentage | Percentage
Wired | Comcast | US | 86.8% |  51.35%
LG U+ | S. Korea | 89.1% | 9.82%
University A | US | 86.4% | 13.6%
University B | S. Korea | 92.3% | 8.93%
Cellular | AT&T | US | 99.8% | 28.3%
Tmobile | US | 86.7% | 5.1%
Verizon | US | 61.5% | 3.1%
SKT | S. Korea | 91.7% | 100%
LG U+ | S. Korea | 89.5% | 9.05%
KT | S. Korea | 92.3% | 7.64%

####  4.1.6. ECN bleaching from different cloud providers

We now check if cloud providers support ECN when clients in their cloud
connect to public websites. Table 6 shows the results. Interestingly, clients
in Azure failed 100% in ECN negotiation. We conjecture that PEPs in its
network change the ECN field without following the standards. We confirmed the
alteration at the middleboxes with additional testing with our own servers
with ECN enabled and disabled, respectively. Another key observation is that
GCP bleaches $100\%$ in IP headers even after successful ECN negotiation in
TCP headers. We conjecture that Google removes ECN in IP packets to use it
internally in their datacenters.

Table 6. ECN bleaching from different cloud providers. Cloud Service | Location | Negotiation | Bleaching
---|---|---|---
Provider |  | Percentage | Percentage
AWS | Frankfurt | 60.2% | 39.41%
Stockholm | 85.24% | 9.31%
SaoPaulo | 75.81% | 19.97%
Paris | 60.66% | 41.11%
Azure | Norway | 0% | -
NorthEU | 0% | -
UK | 0% | -
East Asia | 0% | -
Cloudlab | Wisconsin | 97.8% | 15.3%
Utah | 93.7% | 9.17%
Clemson | 95.9% | 5.61%
Massachusetts | 91.4% | 7.87%
DigitalOcean | New York | 88.46% | 40.86%
San Francisco | 92.59% | 29.81%
Singapore | 93.28% | 16.85%
London | 88.23% | 39.2%
Frankfurt | 87.55% | 35.48%
Toronto | 81.8% | 38.54%
Bangalore | 95.09% | 4.71%
GCP | Virginia | 94.1% | 100%
California | 93.9% | 100%

###  4.2. ECN-supported Internet Paths

####  4.2.1. Methodology

The trends in Subsection 4.1 highlight that the ECN deployment ratio in public
websites is reaching 90% and is already well used on the Internet, while the
network bleaches 10% of those ECN-enabled websites. To understand and pinpoint
where in the network ECN fields are being altered or bleached, we use the
traceroute-based method mentioned in Section 3.1.2 towards each ECN-enabled
public website. We further categorize the types of ECN violations and seek
potential causes of ECN bleaching.

####  4.2.2. ECN deployment status in the network

Table 7 shows the number of ECN bleaching network paths and their IP
addresses. Among 534,077 paths we tested, which exclude five providers that
bleach the ECN field as a matter of policy, 22,305 (4.17%) paths bleach the
ECN field. This corresponds to 1,112 bleaching router IPs among 129,252 IPs.
We further divided ECN violation cases into three cases: (1) bleaching all ECN
bits into zeros, (2) ECT(0) becomes ECT(1), and (3) CE becomes either ECT(1)
or ECT(0). As we expected, more than 99% of ECN violation cases fall into Case
1 of zeroing out all ECN bits.

Table 7. Total number of ECN violating paths and bleaching IP addresses
obtained from the traceroute method.

Input | → Output | # of Path | (pct) | # of IP | (pct)
---|---|---|---|---|---
# of | Total Case | 534,077 |  | 129,252 |
# of | Violation | 22,305 | (4.17%) | 1,112 | (0.8%)
Any | → 00 | 22,111 | (99.1%) | 1,070 | (96%)
10 | → 01 | 171 | (0.76%) | 33 | (2.9%)
11 | → 10 or 01 | 24 | (0.1%) | 9 | (%)

####  4.2.3. ECN bleaching IPs and locations.

To understand where those bleaching IP addresses are located, we use the whois
command to locate each IP address. Table 8 shows the geographical distribution
of those bleaching points. Europe and South/North America have proportionally
higher bleaching points than the others.

As we are interested in understanding which ISPs have those bleaching IP
addresses, we compute the bleaching percentage for each ISP: how many ECN
bleaching routers belong to each ISP. Figure 6 shows the percentage of
bleaching routers belonging to each ISP. Due to its sensitivity, we anonymized
the names of ISPs. Overall, three ISPs in Europe ranked 1, 2, and 4 in the
bleaching percentage, matching the ECN-bleaching ratio obtained for public
websites in Figure 5.

Table 8. Geographic locations of bleaching IPs (BIPs).

Continents | Total IP | # of BIP | Percentage
---|---|---|---
Total | 129,252 | 1,112 | 0.08%
North America | 44,617 | 431 | 0.97%
Europe | 20,525 | 513 | 2.5%
Asia | 29,171 | 124 | 0.43%
South America | 1,900 | 18 | 0.95%
Oceania | 1,057 | 4 | 0.38%
Africa | 506 | 0 | 0.00%
Unknown | 1,476 | 22 | 1.56%

Figure 6. ISPs of bleaching points. The X-axis represents the ISP name of the
bleaching IP addresses. From 1,112 bleaching IP addresses, ISPs in the EU have
the highest ECN bleaching percentage.

####  4.2.4. ECN bleaching network paths per source ISP

By leveraging our probes in each ISP, we obtain the percentage of ECN
bleaching paths among the total number of paths initiated from each ISP. Table
9 shows the results. While it is hard to generalize as we only had a few
probes in each ISP, traffic initiated from probes installed in Rogers and
Vodafone wired networks and Google Cloud show 100% ECN bleaching.

Table 9. The percentage of bleaching network paths per source ISP.  Type | Provider | location | Bleaching
---|---|---|---
|  |  | Percentage
Wired | Armstrong | US | 69.73%
Charter | US | 53.2%
Comcast | US | 3.58%
Cox | US | 38.2%
Rogers | US | 100%
Shaw | US | 19.14%
Telecom Argentina | Argentina | 16.57%
University A | US | 9.41%
Vodafone | Germany | 100%
Cellular | AT&T | US | 48.2%
Tmobile | US | 5.63%
Verizon | US | 11.06%
Cloud | AWS | 16 Locations | 2.69%
Google | 10 Locations | 100%
DigitalOcean | 8 Locations | 5.38%
Cloudlab | Wisconsin | 16.53%
| Cloudlab | Clemson | 5.38%
| Cloudlab | Utah | 2.69%

####  4.2.5. ECN bleaching hops.

The bleaching hop number represents where ECN bleaching occurs in the network
path. Figure 7 shows the percentages of ECN bleaching observed at relative
hops in the paths. We divided a hop number, where we find ECN bleaching, from
the total number of hops until the destination. Based on our results, we found
that a large portion of bleaching happens in the access network. Also, if ECN
bleaching occurs in the access network, the bleaching hop number is no longer
than seven hops. The overall bleaching hops are well distributed, but $50\%$
of ECN bleaching occurs in $30\%$ of the total distance between the source and
destination.

Figure 7. CDF analysis of bleaching distance in the normalized network path.
The percentages of ECN bleaching were observed at relative hops in the paths.

####  4.2.6. ECN bleaching router signatures.

We fingerprinted the routers with the list of bleaching IPs. The fingerprint
technique we used is from (Vanaubel et al., 2013), identifying the vendor of a
router based on the response TTL from ICMP echo-request and Time exceeded
message (e.g., 255/64). The IP packet header contains a time-to-live (TTL)
field used to avoid packets looping forever when a routing loop occurs. This
8-bit field is set by the originating host/router to an initial value that is
usually and nearly always a power of 2 in the list 32 (or 30), 64, 128, and
255. The TTL field is decremented by one at each intermediate node along the
packet’s path. Figure 8 shows the distribution of routers bleaching ECN. As we
expected, many bleaching routers are from Cisco and Juniper.

Figure 8. Vendor distribution of routers bleaching ECN. We adapt the technique
described in (Vanaubel et al., 2013), with which we can identify a router as
Cisco, Juniper or Others by comparing the IP TTL of the response to an ICMP
echo-request and to a Time exceeded message.

###  4.3. Usage of ECN from Traffic Traces

Table 10. Overall results from passive measurement. ECN is negotiated during TCP connection establishment. Note that the ECN percentage in TCP counts only within successful ECN negotiation flows. For UDP, we only collect the number of UDP flows with ECN codepoints since UDP does not have ECN negotiation standards.  |  |  |  | ECN Negotiation | Within ECN Negotiation Succeeded
---|---|---|---|---|---
Type | Port | Protocol | Flow Pct | Succeeded | Failed | No Attempt | Non-ECT | ECT(1) | ECT(0) | CE
|  |  |  |  | (0b00) | (0b02) | (0b10) | (0b11)
TCP | ALL (21,888,015) | 100% | 7.52% | 4.85% | 87.63% | 6.14% | 0.94% | 92.92% | 0.005%
443 | HTTPS | 79.87% | 8.09% | 5.56% | 86.35% | 6.05% | 0.9% | 93.04% | 0.003%
80 | HTTP | 6.66% | 4.58% | 1.87% | 93.55% | 5.66% | 0.4% | 93.94% | 0.002%
993 | IMAP-SSL | 0.84% | 4.88% | 19.89% | 75.23% | 8.8% | 0.41% | 90.79% | 0%
25 | SMTP | 2.13% | 5.91% | 0.32% | 93.77% | 3.04% | 2.45% | 94.35% | 0.163%
22 | SSH | 1.33% | 0.28% | 0.72% | 99.00% | 6.61% | 2.71% | 90.68% | 0%
5223 | APNs | 0.09% | 48.17% | 0.47% | 51.36% | 21.44% | 0% | 78.56% | 0%
8443 | HTTPS | 0.47% | 18.48% | 0.2% | 81.32% | 6.76% | 0% | 93.24% | 0%
53 | DNS | 0.56% | 0.01% | 0.12% | 99.87% | 0% | 0% | 100% | 0%
5228 | Android | 0.09% | 0.08% | 12% | 87.92% | 5.6% | 0% | 94.4% | 0%
587 | SMTP | 0.62% | 55.79% | 1.73% | 42.48% | 6.2% | 5.6% | 88.2% | 0%
UDP | ALL (81,076,465) | 100% | - | - | - | 99.92% | 0.005% | 0.07% | 0.005%
53 | DNS | 59.95% | - | - | - | 99.99% | 0.0001% | 0.007% | 0%
443 | QUIC | 15.75% | - | - | - | 99.72% | 0.001% | 0.275% | 0%
123 | DNS | 8.53% | - | - | - | 100% | 0.001% | 0% | 0%
6881 | Game | 0.69% | - | - | - | 99.99% | 0.006% | 0.002% | 0.004%
51413 | P2P | 0.54% | - | - | - | 100% | 0.0004% | 0% | 0%

####  4.3.1. Methodology.

We first classify ECN-negotiation succeeded, failed, and no attempt for each
TCP session where we further check the ECN field in the IP headers. For UDP,
we check the usage of the ECN field in the IP header since UDP does not have
any standard for ECN negotiation. Table 10 shows overall statistics of traffic
traces. We observe 227,538,956 TCP and 81,076,465 UDP flows. We list the top
10 TCP applications and top 5 port UDP applications from these flows. We map
each port number into the corresponding protocol and the usage percentage, as
shown in Table 10. We also show the percentage of ECN negotiation failed and
succeeded rate in TCP and ECN codepoint for TCP and UDP.

####  4.3.2. ECN usage in TCP and UDP

We observed that 7.52% of TCP flows negotiated ECN between source and
destination, 4.85% of flows failed ECN negotiation during the TCP connection
establishment, and the rest (87.6%) did not attempt ECN negotiation. Among the
TCP flows of successful ECN negotiation (7.52%), ECT(0), ECT(1), and CE
account for 92.9%, 0.94%, and 0.005%, respectively. Overall, more than 87% of
TCP flows did not attempt ECN negotiation, which is perplexing considering
that most OS versions now support ECN by default, supported by our active
measurement (86.4% of ECN-enabled Web servers). We found that although most
servers enable ECN for incoming packets, ECN is not requested for outgoing
packets by senders by default. Another interesting observation is that Apple’s
APNs (Port 5223) and the default port for SMTP submission on the modern web
(Port 587) heavily use ECN for their services, while more than 20% of APNs
flows are ECN bleached in IP headers.

From the 81,076,465 UDP flows, we found some portions of flows are using ECN
in ports 53 and 443. QUIC uses UDP port 443, and DNS uses UDP port 53. QUIC
published as RFC 9001 (Iyengar and Thomson, 2021) is a UDP-based, stream-
multiplexing, and encrypted transport protocol. While a recent measurement
study on QUIC (Zirngibl et al., 2021) did not mention the use of ECN for QUIC,
our results confirm that some QUIC flows are now using ECN.

##  5\. Discussion

Although our results discover the current ECN deployment status and violations
on the path, there are still some avenues for future measurement and
improvements.

Possible causes of ECN bleaching. We have revealed that there are paths to
mangling ECN, and the bleaching percentages vary along with the providers.
Aside from two exceptional cases of bleaching 100%, the ratio of the bleaching
ECN field varies from 3.1% to 51.35%. We discuss two possible explanations for
this observation.

There could be a bug in the router software leading to ECN bleaching. We got
this clue from the correlation between ECN and DSCP in their bleaching. When
ECN bleaching happens, a router overwrites two bits of the ECN field and the
preceding six bits of the DSCP field. These two fields used a single field
named ToS, which is deprecated. To figure out the cause, we provided the list
of bleaching IPs to the ISPs who own those IPs. One of the ISPs shared
information about a bug in an NPU (Neural Processing Unit) that bleaches ECN
bits when it rewrites DSCP.

We also conjecture that the complete bleaching is caused by
proxies/middleboxes in the provider network. As mentioned in Section 4.1.1, we
found two providers which completely bleach ECN. One is a cellular provider,
and the other is a Cloud provider. According to recent papers, the cellular
network uses a performance-enhancing proxy to improve its network performance.
Furthermore, the cloud provider operates its proxy or middlebox, balancing the
load from/to the data center.

Potential impact of ECN bleaching to L4S performances. Our measurements have
identified multiple ECN bleaching cases. As mentioned in Section 2.2, L4S is
using ECN as a classifier between a classic queue and an L4S queue. In typical
cases, if a packet has ECT(1) or CE, a scheduler puts packets into the low
latency queue. However, if an intermediate router has bleached packets marked
with ECT(1), those packets will be put into the normal queue instead of the
low latency queue. Furthermore, if CE marking is zeroed from one router, the
congestion signal cannot reach the destination, potentially causing additional
latency for the sender to get the loss signal.

ECN in cellular networks. Recently, ECN-based congestion control algorithms
such as ABC (Goyal et al., 2020) and ECLAT (Kim et al., 2021) are introduced
to fix a large queue problem in cellular networks. ABC modifies a typical ECN
mechanism to use two-bit feedback as a congestion signal for increasing or
decreasing the congestion window (CWND). This approach allows the router to
explicitly inform how many CWNDs it needs to lower or raise, rather than
implicitly notifying the network congestion in the typical ECN mechanism. As a
result, performance degradation such as throughput loss and large queuing
caused by wide CWND fluctuations is alleviated. ECLAT strictly limits queuing
delays within an acceptable time by proactively forwarding ECN feedback to
ensure that the CWND does not exceed a certain level for delay guarantees. To
do this, ECLAT analyzes ECN policies that determine when to transmit ECN
feedback based on CWND growth pattern analysis and network calculus. As long
as ECN is well supported without bleaching, these ECN-based techniques have
the potential to improve the network performances in cellular networks
significantly.

##  6\. Related Work

Table 11. Comparison with prior ECN measurement studies ( : partially meet the
criterion;  : has good results with details; Blank: not mentioned in the
literature).

Methodology | 2000 | 2004 | 2011 | 2013 | 2015 | 2017 | 2018 | 2019 | Our
---|---|---|---|---|---|---|---|---|---
| (Padhye and Floyd, 2001) | (Craven et al., 2014) | (Bauer et al., 2011) | (Kühlewind et al., 2013) | (McQuistin and Perkins, 2015) | (Learmonth et al., 2017) | (Kühlewind et al., 2018) | (Roddav et al., 2019) | work
Percentage of ECN-capable web servers (TCP) | 1.3% | 2.2% | 17.2% | 29.5% | 56.4% |  | 78.5% |  | 86.4%
Percentage of ECN marking changes |  |  | 6.3% | 10.9% | 2.1% |  | 4.7% |  | 10.8%
Bleaching localization |  |  |  |  |  |  |  |  |
End-to-end testing |  |  |  |  |  |  |  |  |
Aggregated flow data |  |  |  |  |  |  |  |  |
Cellular networks |  |  |  |  |  |  |  |  |

###  6.1. ECN Measurement Study

Prior measurement studies, as compared in Table 11, have investigated the
server-side ECN capability among the major web servers as ranked by Alexa and
its usability (or traversal) along the paths to the servers (Bauer et al.,
2011; Kühlewind et al., 2013; Trammell and Kühlewind, 2015; Learmonth et al.,
2016; Mandalari et al., 2018). Padhye et al. (Padhye and Floyd, 2001) first
revealed very little (server-side) deployment ratio of ECN, which is only 1.3%
of the probed web servers. Bauer et al. (Bauer et al., 2011) later presented a
comprehensive measurement study of the ECN readiness in the Internet. They
found that ECN was enabled in 14%–17% of web servers and 0.1%–4% of clients,
and 6%–28.4% of paths cleared the ECN field of packets. Kühlewind et al.
(Kühlewind et al., 2013) also tested 22,487 hosts and reported that ECN was
not usable for 9% of the hosts, due to the middleboxes along the paths to the
hosts.

In a similar vein, Trammell et al. (Trammell and Kühlewind, 2015) found that
when testing 326,743 hosts that can negotiate the ECN capability during
connection establishment, 0.03% of the hosts (i.e., 107 hosts) experienced the
failure of ECN negotiation due to the paths to the hosts, which mangle the ECE
and CWR flags in the TCP header. In addition, Learmonth et al. (Learmonth et
al., 2016) developed a measurement tool named PATHspider to measure the
Internet path transparency for various protocol features of TCP (see Section
3.1.1 for more details). McQuistin et al. (McQuistin and Perkins, 2015)
conducted an Internet path transparency measurement study for UDP traffic.
Learmonth et al. (Learmonth et al., 2017) also presented a measurement study
of the ECN capability on mobile access networks, but this work is limited to
checking the ECN negotiation with public websites. It is worth noting that the
ECN negotiation is possible, even if the paths to the websites bleach the ECN
field of IP packets, as the ECN negotiation is done based on the ECE and CWR
flags of the TCP header during the TCP connection establishment.

###  6.2. Inferring Proxies in Cellular Networks

There are a few measurement studies on inferring middeboxes in the Internet,
especially cellular networks. Wang et al. (Wang et al., 2011) conducted a
measurement study for commercial cellular networks and observed that various
types of packet modifications happen due to middleboxes. Detal et al. (Detal
et al., 2013) revealed the presence of middleboxes along the Internet paths
from an experimental study using Tracebox. Xu et al. (Xu et al., 2015) used an
experimental testbed to investigate transparent web proxies in the four major
US mobile providers and see how they behave in the presence of real web
workloads. Chung et al. (Chung et al., 2016) presented Luminati, an HTTP proxy
network, for measuring the network infrastructure to demystify the end-to-end
violations. Zullo et al. (Zullo et al., 2017) proposed Mobile Tracebox, which
sends crafted packets to validate intermediate boxes to see if they modify the
packets or alter the path between source and destination. However, none of the
prior studies have evaluated the ECN violations in wired and cellular
networks.

##  7\. Conclusion

In this work, we conducted a large-scale measurement study on the traversal of
ECN in the Internet, involving a wide range of cellular and wired networks. In
particular, we were able to provide detailed analysis results on the instances
of ECN bleaching, including how often and where in the network the bleaching
instances happen. We observed that 1,112 out of 129,252 routers and $4.17\%$
of paths showed ECN bleaching, and only few networks bleach as a matter of
policy. We have already shared our measurement results with ISPs and received
a response from some of them, showing their willingness to fix the issue with
ECN bleaching.

## References

  * (1)
  * Alexa (2021) Alexa. 2021.  Alexa Top Sites.  (2021).  https://ats.alexa.com/
  * Alizadeh et al. (2010) Mohammad Alizadeh, Albert Greenberg, David A. Maltz, Jitendra Padhye, Parveen Patel, Balaji Prabhakar, Sudipta Sengupta, and Murari Sridharan. 2010.  Data Center TCP (DCTCP). In Proceedings of the ACM SIGCOMM 2010 Conference (SIGCOMM ’10). Association for Computing Machinery, New York, NY, USA, 63–74.  https://doi.org/10.1145/1851182.1851192
  * Bauer et al. (2011) Steven Bauer, Robert Beverly, and Arthur Berger. 2011\.  Measuring the state of ECN readiness in servers, clients, and routers. In Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference. 171–180.
  * Bensley et al. (2017) Stephen E. Bensley, David Thaler, Praveen Balasubramanian, Lars Eggert, and Glenn Judd. 2017\.  Data Center TCP (DCTCP): TCP Congestion Control for Data Centers.  RFC 8257 (2017), 1–17.  https://doi.org/10.17487/RFC8257
  * Bhooma (2017) Padma Bhooma. 2017\.  Experience with enabling ECN on the Internet, (https://www.ietf.org/proceedings/98/slides/slides-98-maprg-tcp-ecn-experience-with-enabling-ecn-on-the-internet-padma-bhooma-00).  (2017).  https://tiny.one/4ea6rfvv
  * Briscoe et al. (2022) Bob Briscoe, Koen De Schepper, Marcelo Bagnulo, and Greg White. 2022.  Low Latency, Low Loss, Scalable Throughput (L4S) Internet Service: Architecture.  Internet-Draft draft-ietf-tsvwg-l4s-arch-17. Internet Engineering Task Force.  https://datatracker.ietf.org/doc/html/draft-ietf-tsvwg-l4s-arch-17 Work in Progress.
  * Brunello et al. (2021) Davide Brunello, Ingemar Johansson, Mustafa Ozger, and Cicek Cavdar. 2021.  Low Latency Low Loss Scalable Throughput in 5G Networks. In 2021 IEEE 93rd Vehicular Technology Conference (VTC2021-Spring). IEEE, 1–7.
  * Chung et al. (2016) Taejoong Chung, David Choffnes, and Alan Mislove. 2016\.  Tunneling for transparency: A large-scale analysis of end-to-end violations in the Internet. In Proceedings of the 2016 Internet Measurement Conference. 199–213.
  * Craven et al. (2014) Ryan Craven, Robert Beverly, and Mark Allman. 2014\.  A middlebox-cooperative TCP for a non end-to-end Internet.  ACM SIGCOMM Computer Communication Review 44, 4 (2014), 151–162.
  * Detal et al. (2013) Gregory Detal, Benjamin Hesmans, Olivier Bonaventure, Yves Vanaubel, and Benoit Donnet. 2013\.  Revealing middlebox interference with tracebox. In Proceedings of the 2013 conference on Internet measurement conference. 1–8.
  * Duplyakin et al. (2019) Dmitry Duplyakin, Robert Ricci, Aleksander Maricq, Gary Wong, Jonathon Duerig, Eric Eide, Leigh Stoller, Mike Hibler, David Johnson, Kirk Webb, Aditya Akella, Kuangching Wang, Glenn Ricart, Larry Landweber, Chip Elliott, Michael Zink, Emmanuel Cecchet, Snigdhaswin Kar, and Prabodh Mishra. 2019.  The Design and Operation of CloudLab. In Proceedings of USENIX ATC.
  * Fairhurst and Welzl (2017) G. Fairhurst and M. Welzl. 2017.  RFC8087: The Benefits of Using Explicit Congestion Notification (ECN).  (2017).
  * Goyal et al. (2020) Prateesh Goyal, Anup Agarwal, Ravi Netravali, Mohammad Alizadeh, and Hari Balakrishnan. 2020\.  $\\{$ABC$\\}$: A Simple Explicit Congestion Controller for Wireless Networks. In 17th USENIX Symposium on Networked Systems Design and Implementation (NSDI 20). 353–372.
  * Holland (2020) Jake Holland. 2020\.  Latency & AQM Observations on the Internet, (https://datatracker.ietf.org/meeting/interim-2020-maprg-01/materials/slides-interim-2020-maprg-01-sessa-latency-aqm-observations-on-the-internet-01).  (2020).  https://tiny.one/2p8pabpt
  * Høiland-Jørgensen (2016) Toke Høiland-Jørgensen. 2016\.  Bufferbloat.net – Enable ECN.  (2016).  https://www.bufferbloat.net/projects/cerowrt/wiki/Enable_ECN/.
  * Iyengar and Thomson (2021) Jana Iyengar and Martin Thomson. 2021.  QUIC: A UDP-Based Multiplexed and Secure Transport.  RFC 9000. (May 2021).  https://doi.org/10.17487/RFC9000
  * Kim et al. (2021) Junseon Kim, Youngbin Im, and Kyunghan Lee. 2021.  ECLAT: An ECN Marking System for Latency Guarantee in Cellular Networks. In IEEE INFOCOM 2021-IEEE Conference on Computer Communications. IEEE, 1–10.
  * Kühlewind et al. (2013) Mirja Kühlewind, Sebastian Neuner, and Brian Trammell. 2013\.  On the State of ECN and TCP Options on the Internet. In International Conference on Passive and Active Network Measurement. Springer, 135–144.
  * Kühlewind et al. (2018) Mirja Kühlewind, Michael Walter, Iain R Learmonth, and Brian Trammell. 2018.  Tracing internet path transparency. In 2018 Network Traffic Measurement and Analysis Conference (TMA). IEEE, 1–7.
  * Langley (2008) Adam Langley. 2008\.  Probing the viability of TCP extensions.  Google, Inc., Tech. Rep (2008).
  * Learmonth et al. (2017) Iain R Learmonth, Andra Lutu, Gorry Fairhurst, David Ros, and Özgü Alay. 2017.  Path transparency measurements from the mobile edge with PATHspider. In 2017 Network Traffic Measurement and Analysis Conference (TMA). IEEE, 1–6.
  * Learmonth et al. (2016) Iain R Learmonth, Brian Trammell, Mirja Kuhlewind, and Gorry Fairhurst. 2016.  PATHspider: A tool for active measurement of path transparency. In Proceedings of the 2016 Applied Networking Research Workshop. 62–64.
  * Mandalari et al. (2018) Anna Maria Mandalari, Andra Lutu, Bob Briscoe, Marcelo Bagnulo, and Ozgu Alay. 2018\.  Measuring ECN++: good news for++, bad news for ECN over mobile.  IEEE Communications Magazine 56, 3 (2018), 180–186.
  * McQuistin and Perkins (2015) Stephen McQuistin and Colin S Perkins. 2015.  Is Explicit Congestion Notification usable with UDP?. In Proceedings of the 2015 Internet Measurement Conference. 63–69.
  * Medina et al. (2005) Alberto Medina, Mark Allman, and Sally Floyd. 2005\.  Measuring the evolution of transport protocols in the Internet.  ACM SIGCOMM Computer Communication Review 35, 2 (2005), 37–52.
  * Microsoft (2021) Microsoft. 2021\.  Winsock explicit congestion notification (ECN).  (2021).  https://docs.microsoft.com/en-us/windows/win32/winsock/winsock-ecn.
  * NOKIA (2020) NOKIA. 2020.  Enjoying a real-time Internet, enabled by L4S.  (2020).  https://onestore.nokia.com/asset/207072
  * Padhye and Floyd (2001) Jitendra Padhye and Sally Floyd. 2001.  Identifying the TCP behavior of web servers.  (2001).
  * Ramakrishnan et al. (2001) K Ramakrishnan, Sally Floyd, and D Black. 2001.  RFC3168: The addition of explicit congestion notification (ECN) to IP.  (2001).
  * Roddav et al. (2019) Nils Roddav, Klement Streit, Gabi Dreo Rodosek, and Aiko Pras. 2019.  On the Usage of DSCP and ECN codepoints in internet backbone traffic traces for IPv4 and IPv6. In 2019 International Symposium on Networks, Computers and Communications (ISNCC). IEEE, 1–6.
  * Schepper and Briscoe (2020) K. Schepper and B. Briscoe. 2020.  Identifying Modified Explicit Congestion Notification (ECN) Semantics for Ultra-Low Queuing Delay (L4S), Work in Progress, draft-ietf-tsvwg-ecn-l4s-id-12.  (2020).  http://www.ietf.org/internet-drafts/draft-ietf-tsvwg-ecn-l4s-id-12.txt
  * Schepper et al. (2022) Koen De Schepper, Bob Briscoe, and Greg White. 2022\.  DualQ Coupled AQMs for Low Latency, Low Loss and Scalable Throughput (L4S).  Internet-Draft draft-ietf-tsvwg-aqm-dualq-coupled-23. Internet Engineering Task Force.  https://datatracker.ietf.org/doc/html/draft-ietf-tsvwg-aqm-dualq-coupled-23 Work in Progress.
  * Trammell and Kühlewind (2015) Brian Trammell and Mirja Kühlewind. 2015.  Observing Internet path transparency to support protocol engineering. In Proceedings of IRTFISOC RAIM Workshop. Proceedings of IRTFISOC RAIM Workshop.
  * Trammell et al. (2017) Brian Trammell, Mirja Kühlewind, Piet De Vaere, Iain R Learmonth, and Gorry Fairhurst. 2017\.  Tracking transport-layer evolution with pathspider. In Proceedings of the Applied Networking Research Workshop. 20–26.
  * Vanaubel et al. (2013) Yves Vanaubel, Jean-Jacques Pansiot, Pascal Mérindol, and Benoit Donnet. 2013\.  Network fingerprinting: TTL-based router signatures. In Proceedings of the 2013 conference on Internet measurement conference. 369–376.
  * Wang et al. (2011) Zhaoguang Wang, Zhiyun Qian, Qiang Xu, Zhuoqing Mao, and Ming Zhang. 2011.  An untold story of middleboxes in cellular networks.  ACM SIGCOMM Computer Communication Review 41, 4 (2011), 374–385.
  * Willars et al. (2021) Per Willars, Emma Wittenmark, Henrik Ronkainen, Christer Östberg, Ingemar Johansson, Johan Strand, Petr Lédl, and Dominik Schnieders. 2021.  Enabling time-critical applications over 5G with rate adaptation.  (2021).  https://www.ericsson.com/en/reports-and-papers/white-papers/enabling-time-critical-applications-over-5g-with-rate-adaptation
  * Xu et al. (2015) Xing Xu, Yurong Jiang, Tobias Flach, Ethan Katz-Bassett, David Choffnes, and Ramesh Govindan. 2015\.  Investigating transparent web proxies in cellular networks. In International conference on passive and active network measurement. Springer, 262–276.
  * Zirngibl et al. (2021) Johannes Zirngibl, Philippe Buschmann, Patrick Sattler, Benedikt Jaeger, Juliane Aulbach, and Georg Carle. 2021.  It’s over 9000: analyzing early QUIC deployments with the standardization on the horizon. In Proceedings of the 21st ACM Internet Measurement Conference. 261–275.
  * Zullo et al. (2017) Raffaele Zullo, Antonio Pescapé, Korian Edeline, and Benoit Donnet. 2017.  Hic sunt NATs: Uncovering address translation with a smart traceroute. In 2017 Network Traffic Measurement and Analysis Conference (TMA). IEEE, 1–6.

##  Appendix A Ethics

This work does not raise any ethical issues.


# Velocity structure function in a geostrophic coherent vortex under strong
rotation

Leon L. Ogorodnikov<EMAIL_ADDRESS>Sergey S. Vergeles
<EMAIL_ADDRESS>Landau Institute for Theoretical Physics, Russian Academy of
Sciences,
1-A Akademika Semenova av., 142432 Chernogolovka, Russia  National Research
University Higher School of Economics, Faculty of Physics,
Myasnitskaya 20, 101000 Moscow, Russia

###### Abstract

We consider analytically pair structure function of turbulent pulsations on
the background of a coherent geostrophic vortex in a fast rotating fluid. The
statistics of the turbulent pulsation is determined by their dynamics which is
the dynamics of inertia waves affected by the differential rotation in the
vortex and weak viscous damping. Our consideration is restricted by the
smallest scales, where the velocity field remains smooth. We establish the
anisotropy of the structure function. The velocity gradient of the turbulent
pulsations achieves its largest value for the radial direction and its
smallest value in the streamwise direction, resembling its behaviour in
turbulent flow with mean shear component without imposed rotation.

##  I Introduction

Correlation functions of the velocity pulsations are the basic tool for the
characterization of the spatial structure of the flows which have turbulent or
chaotic component. The most known limiting cases of the turbulent flow is
statistically isotropic turbulence of incompressible fluid in three [1] and
two [2] dimensions. It is usually that the turbulence is superimposed on a
mean steady flow. A particular but important case of the mean flow is a shear
flow. It is realized near walls, especially in pipe flow[3]. In a shear flow,
the amplitude of the velocity in turbulent pulsations is of the order of the
mean flow. Geometrically, the turbulent pulsations are highly elongated in
streamwise direction [4], and the velocity is preferably directed along the
elongation direction. The turbulent pulsations of the largest sizes take
kinetic energy from the mean flow and then give is to smaller scales, that is
the onset for the direct energy cascade. Despite the assumption that the
turbulent pulsations should become statistically isotropic at small scales,
only second and third order correlation functions correspond to isotropic case
whereas high-order structure functions at the small scales inherit the
anisotropy of the large-scale shear flow.

In two-dimensional turbulent flows[5] and in three-dimensional rotating
turbulent flows large-scale mean flow can become coherent. This means in
particular, that its influence on small-scale turbulent pulsations become
strongly dominative, so the statistics of the small-scale flow is dramatically
different from the isotropic case. The main case of the coherent flow is an
axially symmetric vortex. In the vortex, the mean flow is a differential
rotation which locally is a shear flow. Structure function in two-dimensional
coherent vortex was analytically calculated in Ref. 6

In three-dimensions, the fast global rotation splits the full flow onto slow
two-dimensional geostrophic flow and fast three-dimensional inertia waves.
Under definite conditions, the geostrophic flow can be developed into a
coherent vortex[7]. The differential rotation inside the vortex is locally
three-dimensional shear flow which rotates around spanwise direction. This
treatment brings together the consideration of the statistics of the small-
scale turbulent pulsations inside the vortex with the same problem for flow in
a pipe which rotates fast around spanwise direction[8].

In this paper, we analytically find the structure function of small-scale
turbulent pulsations inside a coherent geostrophic vortex. We restrict
ourselves by the consideration of small distances, where the velocity field is
smooth. We assume that the Rossby number for the large-scale flow is small,
and the shear rate dominates both the nonlinear self-interaction and the
viscous dissipation rate for the inertia waves. Besides the statistics of the
velocity pulsations is interesting itself, it determines passive scalar
advection and mixing at smallest scales, if the Schmidt (or Prandtl) number,
which is the ratio of the kinematic viscosity of the fluid and the diffusion
coefficient of the scalar is large[9].

##  II General properties of pair correlation function

We consider a flow ${\bm{v}}(t,{\bm{r}})$ which contains a mean component
${\bm{U}}$ and a turbulent part ${\bm{u}}$, ${\bm{v}}={\bm{U}}+{\bm{u}}$. It
is assumed that the mean component ${\bm{U}}$ changes at times and distances
much larger than the characteristic time and space scales of ${\bm{u}}$. The
temporal mean of the turbulent part of the flow is zero,
$\langle{\bm{u}}\rangle=0$. The object of our investigation is the
simultaneous structure function $S^{ij}({\bm{r}})$ of the velocity turbulent
pulsations. In the limit of strong scale separation, the statistics of the
turbulent pulsations can be adopted to be locally homogeneous in space. Then
the structure function depends on only the separation distance ${\bm{r}}$,

$S^{ij}({\bm{r}})=\langle\big{(}u^{j}({\bm{r}}^{\prime}+{\bm{r}})-u^{j}({\bm{r}}^{\prime})\big{)}\big{(}u^{i}({\bm{r}}^{\prime}+{\bm{r}})-u^{i}({\bm{r}}^{\prime})\big{)}\rangle,$
(1)

where the averaging is assumed to be either over time or the position
${\bm{r}}^{\prime}$. The region of the space averaging should be less than the
characteristic scale of the mean flow ${\bm{U}}$. The structure function is
symmetric by definition,
$S^{ij}({\bm{r}})=S^{ji}({\bm{r}})=S^{ij}(-{\bm{r}})$.

We are considering turbulence in a rotation fluid with angular velocity
${\bm{\Omega}}$ and denote the direction of the rotation ${\bf
e}_{z}={\bm{\Omega}}/|{\bm{\Omega}}|$. Here a cartesian reference system
$Oxyz$ is assumed to be determined. In what follows we assume that the
pulsating part ${\bm{u}}$ is relatively weak, so its self-nonlinear influence
can be neglected as compared with the its nonlinear interaction with the mean
velocity ${\bm{U}}$. Then the dynamics of the turbulent part ${\bm{u}}$ is
described by the Navier-Stokes equation linearized with respect to ${\bm{u}}$.
The global rotation is strong, so large-scale Rossby number is small,
${\mathrm{R}o}_{\scriptscriptstyle R}\sim\nabla{\bm{U}}/2\Omega\ll 1$. Then it
is natural to expand the velocity field over plane waves with circular
polarizations,

${\bm{v}}(t,{\bm{r}})\ =\ \sum_{s=\pm 1}\int(\mathrm{d}^{3}k)\,a_{{\bf
k}s}(t)\,{\bf h}_{\bf k}^{s}\,\exp\big{(}i({\bf
k}\\!\cdot\\!{\bm{r}})\big{)},$ (2)

where the basis vectors ${\bf h}_{\bf k}^{s}=\big{(}[{\bf k}\times[{\bf
k}\times{\bf e}_{z}]]+isk[{\bf k}\times{\bf
e}_{z}]\big{)}/{\sqrt{2}k^{2}\sin\theta_{\bf k}}$ are normalized to unity. The
dynamics of expansion coefficients $a_{{\bf k}s}$ is determined by the
dispersion law of inertia waves[10]. As Rossby number for the large-scale flow
is assumed to be small, the inertial waves with the opposite circular
polarizations are uncorrelated [7]. The homogeneity of the statistics in space
means that the square mean of the expansion coefficients is

$\langle a_{{\bf q}\sigma}\,a_{{\bf k}s}\rangle=(2\pi)^{3}\,\delta({\bf
q}+{\bf k})K_{{\bf k}}\delta_{\sigma s},$ (3)

where the mean kinetic energy stored in the turbulent pulsations with
wavevector ${\bf k}$ satisfies the symmetry $K_{{\bf k}}=K_{-{\bf k}}$. Here
we consider the case when the helicity is absent, that is the wave statistics
is symmetric under transformation $s\to-s$. As a result, the velocity
structure function (1) is parametrized by one scalar function:

$S^{ij}({\bm{r}})=2\hat{\delta}_{\scriptscriptstyle\perp}^{ij}\left(K({\bm{0}})-K({\bm{r}})\right),\quad
K({\bm{r}})=\int\frac{\mathrm{d}^{3}k}{(2\pi)^{3}}K_{\bf k}e^{i{\bf
k}{\bm{r}}},$ (4)

where $\hat{\delta}_{\scriptscriptstyle\perp}^{ij}$ is a linear integral
operator in ${\bm{r}}$-space which Fourier transform is the transverse
projector $\delta_{\scriptscriptstyle\perp}^{ij}=\delta^{ij}-k^{i}k^{j}/{\bf
k}^{2}$.

##  III Rapid distortion theory in columnar vortex

Now consider a coherent geostrophic vortex. We choose a cylindrical
coordinates $\\{\rho,\varphi,z\\}$, which axis coincides with the axis if the
vortex. The large-scale velocity ${\bm{U}}$ has the only nonzero azimuth
component $U(\rho)$ in the case. To develop rapid distortion theory[11, 7, 12]
for the description of the turbulent pulsation dynamics, we choose a local
Cartesian reference system $\\{\xi,\eta,z\\}$, which origin moves with azimuth
velocity $U(\rho_{0})$ at distance $\rho=\rho_{0}$ from the vortex axis. In
addition, the reference system rotates with the angular velocity
$U(\rho_{0})/\rho_{0}$. In the reference system, the large-scale velocity
field is constant in time and locally is a shear flow with rate
$\Sigma(\rho_{0})$, where $\Sigma=\rho\partial_{\rho}(U/\rho)$. Axis $\xi$ is
directed streamwise. Axis $\eta$ is directed toward the vortex axis, so it is
the shear velocity gradient-direction axis. We call the direction ‘radial’
instead the common ‘normal’ when considering a shear flow near a wall.
Direction of $z$-axis can be called ‘spanwise’. The equation describing the
linearized dynamics of small-scale turbulent pulsations can be derived[7] in
wavevector space. According to the equation, the pulsation $a_{{\bf k}s}$
having wavevector ${\bf k}$ is an inertia wave which oscillates with frequency
$\omega_{\bf k}=2\Omega(k^{z}/k)$. The inertia wave is influenced by the
large-scale flow due to its weak inhomogeneity in space. Small large-scale
Rossby number ${\mathop{\mathrm{Ro}}}_{\scriptscriptstyle R}=\Sigma/2\Omega\ll
1$ leads to the dynamics of inertia waves with the same wavevector ${\bf k}$
and opposite polarizations $s$ are uncoupled. Advection by the inhomogeneous
large-scale flow leads to the wave evolution occurs along characteristics

${\bf k}^{\prime}(t)=\\{k^{\xi},k^{\eta}+\mathop{\mathrm{sign}}\Sigma\cdot
tk^{\xi},k^{z}\\},$ (5)

where $t$ is dimensionless time that is time measured in $1/|\Sigma|$.

Further, we assume that there is some external random source which excites the
turbulent part of the flow. Physically, the origin of the force can be
buoyancy force which arises due to advection of heat. The assumed absence of
mean spirality of the flow means, in particular, that the force produces zero
spirality. The statistics of the force is assumed to be homogeneous in space,
its mean power per unit mass is $\epsilon$. Its correlation function in the
Fourier space is characterized by the function $\chi({\bf k})$, which is
normalized to unity, $\int\chi({\bf k})\,\mathrm{d}^{3}k/(2\pi)^{3}=1$. We
will assume that it is isotropic and decays at $k\sim k_{f}$ and trends to
zero at $k\to 0$. In the case, the source of the anisotropy of the velocity
correlation function is only the anisotropy of the large scale velocity field.
The viscosity influence for the turbulent pulsations is assumed to be weak, so
dimensionless parameter $\gamma=\nu k_{f}^{2}/\Sigma\ll 1$.

##  IV Structure function

Let the wavevector of a turbulent pulsation is equal to ${\bf k}$ in the
moment of excitation $-\tau$ by the external force [13, 7]. At the time of
measurement, the wavevector of the wave is ${\bf k}^{\prime}(\tau)$ (5). Then
the aggregated contribution from all the preceding times and all the
wavevectors into the structure function is

$\displaystyle S^{ij}({\bm{r}})$ $\displaystyle=$
$\displaystyle\frac{\epsilon}{|\Sigma|}\int\limits_{0}^{+\infty}{\mathrm{d}}\tau\int\limits\frac{{\mathrm{d}}^{3}k}{(2\pi)^{3}}\frac{k\chi({\bf
k})}{k^{\prime}}\,\delta_{{\scriptscriptstyle\perp}}^{\prime
ij}\left(1-e^{i{\bf k}^{\prime}{\bm{r}}}\right)e^{-\Gamma},$ (6)
$\displaystyle\Gamma=\frac{2\gamma}{|\Sigma|}\int\limits_{0}^{\tau}{\mathrm{d}}\varsigma\,k^{\prime
2}(\varsigma),$

where $\delta_{\scriptscriptstyle\perp}^{\prime
ij}=\delta_{\scriptscriptstyle\perp}^{ij}\big{(}{\bf k}^{\prime}\big{)}$ and
${\bf k}^{\prime}$ without argument is ${\bf k}^{\prime}(\tau)$. In the paper,
we consider small distances, for which the velocity field can be approximated
by linear function in space. Then it is sufficient to expand the structure
function up to the second order in ${\bm{r}}$:

$S^{ij}({\bm{r}})=\frac{\epsilon
r^{m}r^{n}}{|\Sigma|}\int\limits_{0}^{+\infty}{\mathrm{d}}\tau\int\limits\frac{{\mathrm{d}}^{3}k}{(2\pi)^{3}}k\chi({\bf
k})\,\frac{\delta_{{\scriptscriptstyle\perp}}^{\prime ij}k^{\prime m}k^{\prime
n}}{k^{\prime}}e^{-\Gamma}.$ (7)

In (7), one can first perform integration over wavevectors and after that over
inverse time $\tau$. At large times, $\tau\gg 1$, and for typical values
$k^{\xi}\lesssim 1$, the movement along characteristics sweeps wavevectors out
of region $k\lesssim 1$ as $k^{\prime}(\tau)\sim\tau\gg 1$. Law (5) means,
that the corresponding contribution into (7) is suppressed by factor $1/\tau$.
Additionally, the viscosity leads to the exponential suppression, that becomes
relevant if $\tau>\tau_{\ast}=\gamma^{-1/3}$. The viscous exponent in (7) can
be evaluated as $\Gamma\sim(\tau/\tau_{\ast})^{3}/3$ when $k^{\xi}\sim 1$, but
it is reduced to less than unity if

$|k^{\xi}|\lesssim(\tau_{\ast}/\tau)^{3/2}$ (8)

and while $\tau<1/\gamma$. Below we call times $\tau<\tau_{\ast}$ ‘ballistic
times’, and times $\tau_{\ast}<\tau<1/\gamma$ ‘viscous times’.

Consider first the trace of the structure function $S=S^{ii}({\bm{r}})$. As
$\delta_{{\scriptscriptstyle\perp}}^{\prime ii}=2$, the convergence of
integral (7) is determined by the ratio $k^{\prime m}k^{\prime n}/k^{\prime}$
and the viscous exponent $\Gamma$ (6). We start from $\eta^{2}$-contribution
into (7), when $n=m=\eta$. At large ballistic times, $|k^{\xi}|\sim 1$ so the
ratio $(k^{\prime\eta})^{2}/k^{\prime}\sim\tau|k^{\xi}|$ and the time
integrand in (7) is proportional to $\tau$. At viscous times, the viscous
exponent imposes the confinement (8), so
$(k^{\prime\eta})^{2}/k^{\prime}\sim\sqrt{\tau_{\ast}^{3}/\tau}$. As the
result, the time integrand is proportional to $\tau_{\ast}^{3}/\tau^{2}$.
Thus, the time integral (7) is determined by times $\tau\sim\tau_{\ast}$ and
the coefficient before $\eta^{2}$ is $\sim\tau_{\ast}^{2}$.

Next, consider $\xi^{2}$-contribution. At large times, the ratio
$(k^{\xi})^{2}/k^{\prime}\sim k^{\xi}/\tau$. Thus, the integrand in (7) is
proportional to $1/\tau$ that leads to logarithmic divergency at times
$\tau\sim\tau^{*}$. At viscous times, the integrand decreases faster due to
confinement (8). Thus, the coefficient before $\xi^{2}$ is
$\sim\ln\tau_{\ast}$.

For $z^{2}$-contribution, the ratio
$(k^{z})^{2}/k^{\prime}\sim(k^{z})^{2}/\sqrt{\tau^{2}(k^{\xi})^{2}+(k^{z})^{2}}$.
There is a logarithmic divergency at $|k^{\xi}|>1/\tau$ in integral (7), which
has a cutoffs $k^{\xi}\sim 1$ at ballistic times and (8) at viscous times.
Thus, the time integrand in (7) is $\sim\tau^{-1}\ln\tau$ at ballistic times
and $\sim\tau^{-1}\ln\sqrt{\tau_{\ast}^{3}/\tau}$ at viscous times. As a
result, the coefficient before $z^{2}$ is $\sim\ln^{2}\tau_{\ast}$. The last
nonzero contribution is for $m=\xi$, $n=\eta$. The corresponding ratio
$k^{\xi}k^{\prime\eta}/k^{\prime}\sim|k^{\xi}|$. Accounting the same cutoff
for $|k^{\xi}|$, one finds the coefficient $\sim\tau_{\ast}/\Sigma$ including
sign in $\xi\eta$-term.

The overall result is

$S^{ii}({\bm{r}})\sim\frac{\epsilon
k_{f}^{2}}{|\Sigma|}\left(\ln\tau_{\ast}\cdot\xi^{2}+(\tau_{\ast}\eta+\mathop{\mathrm{sign}}\Sigma\cdot\xi)^{2}+\ln^{2}\tau_{\ast}\cdot
z^{2}\right).$ (9)

Here numerical coefficients are not identified, as they depend also on the
specific parameters of the external force correlation function $\chi({\bf
k})$. The result should be compared with one-point mean
$\langle{\bm{u}}^{2}\rangle\sim(\epsilon/|\Sigma|)\ln^{2}\gamma$ [7]. The
direction of the fastest increase of the structure function is the radial
direction. More precisely, the direction deviates from the radial direction at
angle $\sim 1/\tau_{\ast}$ toward the streamwise direction. Accordingly, the
direction of the slowest increase of the structure function deviates from the
streamwise direction at the same angle. The angle scales with the shear rate
and viscosity as $(\nu k_{f}^{2}/\Sigma)^{1/3}$, that is characteristic
scaling law for the advection-diffusion process in a stationary shear flow
[14]. Note that since
$\delta_{{\scriptscriptstyle\perp}}^{\prime\xi\xi}\approx\delta_{{\scriptscriptstyle\perp}}^{\prime
zz}$ at times $\tau\gg 1$,

$S^{\xi\xi}=S^{zz}=S^{ii}/2.$ (10)

Now consider $S^{\eta\eta}$, which turns out to be smaller than $S^{\xi\xi}$.
For $\eta^{2}$-contribution, $(k^{\prime\eta})^{2}$ multiplier cancels the
denominator in $\delta^{\prime\eta\eta}_{\scriptscriptstyle\perp}=(k^{\xi
2}+k^{z2})/k^{\prime 2}$ and further calculations repeat those for
$z^{2}$-contribution into $S^{ii}$. For $z^{2}$-contribution, integration of
$\delta^{\prime\eta\eta}_{\scriptscriptstyle\perp}$ with multiplier
$1/k^{\prime}$ over $k^{\xi}$ gives $1/\tau$ at ballistic times $\tau\gg 1$.
The time integrand decreases faster at viscous times. Thus the coefficient
before $z^{2}$ is $\sim\ln\tau_{\ast}$. For $\xi^{2}$-contribution,
$\delta^{\prime\eta\eta}_{\scriptscriptstyle\perp}$ being integrated over
$k^{\xi}$ with multiplier $(k^{\xi})^{2}/k^{\prime}$ leads to integrand
$\tau^{-3}\ln\tau$ at large times $\tau\gg 1$. Thus, the coefficient $\sim 1$
before $\xi^{2}$ is determined by times $\tau\sim 1$. Finally, the time-
dependent part of the integration in (7) for $\xi\eta$-contribution is
determined by $\tau\sim 1$. Finally, the time-dependent part of the
integration in (7) for $\xi\eta$-contribution is determined by $\tau\sim 1$.
It can be calculated with integration by parts,

$\displaystyle\mathop{\mathrm{sign}}\Sigma\cdot\int\limits_{0}^{\infty}\mathrm{d}\tau\frac{k^{\prime\eta}k^{\xi}}{k^{\prime
3}}e^{-\Gamma}=\frac{1}{k}-\gamma\int\limits_{0}^{\infty}\mathrm{d}\tau
k^{\prime}e^{-\Gamma}.$ (11)

The overall answer is

$\displaystyle S^{\eta\eta}\sim\frac{\epsilon
k_{f}^{2}}{|\Sigma|}\left(\xi^{2}+\eta\xi+\ln^{2}\tau_{\ast}\cdot\eta^{2}+\ln\tau_{\ast}\cdot
z^{2}\right),$ (12)

where again the numerical coefficients are not identified.

The calculations of the coefficients before $\xi^{2}$ and $z^{2}$ in
$S^{\xi\eta}$ involves the same way (11). Calculation of the coefficients
before $\eta^{2}$ and $\xi\eta$ repeats those for the $\xi\eta$\- and
$\xi^{2}$-term in $S^{ii}$. Collecting all the terms, we arrive to

$S^{\xi\eta}\sim-\frac{\epsilon
k_{f}^{2}}{|\Sigma|}\left(\xi^{2}+\ln\tau_{\ast}\cdot\xi\eta+\tau_{\ast}\eta^{2}+z^{2}\right)$
(13)

In the similar manner, one can find the remaining nonzero matrix elements of
the structure function:

$S^{\xi z}\sim-\frac{\epsilon k_{f}^{2}}{|\Sigma|}\eta z,\qquad S^{\eta
z}\sim-\frac{\epsilon k_{f}^{2}}{|\Sigma|}\left(\xi
z+\ln^{2}\tau_{\ast}\cdot\eta z\right).$ (14)

##  V Conclusion

To summarize, we have established the properties of the structure function of
the turbulent pulsations inside a geostrophic coherent vortex at the smallest
scales, where the velocity field of the pulsations can be approximated by the
linear profile in space. The main property of the velocity statistics at the
scales is that the streamwise and the spanwise $\xi,z$-components of the
velocity changes in radial (shear-increment) $\eta$-direction faster in
$\tau_{\ast}=(\Sigma/\nu k_{f}^{2})^{1/3}$ times than in streamwise and
spanwise directions, see (9,10). The structure function of $\eta$-component is
logarithmically smaller and does not contain the spatial anisotropy.

Large dimensionless parameter $\tau_{\ast}$ corresponds to passive scalar
mixing in a stationary shear flow [14]. Although the dynamics of the turbulent
pulsations in a rotating fluid is primarily fast oscillations of inertia
waves, the velocity structure function does not depend on the angular velocity
$\Omega$, if the coherent vortex is large enough, so its radius
$R\gg\tau_{\ast}/(\Omega k_{f})$. Otherwise, one should reduce $\tau_{\ast}$
by the redefinition $\tau_{\ast}\sim 1/(\Omega k_{f}R)$.

##  VI Acknowledgments

This work was supported by the Russian Science Foundation, Grant No.
20-12-00383. S.S.V. acknowledges the support from Grant No. 19-1-2-46-1 of the
Foundation for the Advancement of Theoretical Physics and Mathematics “BASIS.”

## References

  * Frisch and Kolmogorov [1995] U. Frisch and A. N. Kolmogorov,  _Turbulence: the legacy of A.N. Kolmogorov_ (Cambridge university press, 1995).
  * Tabeling [2002] P. Tabeling, “Two-dimensional turbulence: a physicist approach,” Physics reports 362, 1–62 (2002).
  * Mullin [2011] T. Mullin, “Experimental studies of transition to turbulence in a pipe,” Annual Review of Fluid Mechanics 43, 1–24 (2011).
  * Biferale and Procaccia [2005] L. Biferale and I. Procaccia, “Anisotropy in turbulent flows and in turbulent transport,” Physics Reports 414, 43–164 (2005).
  * Laurie  _et al._ [2014] J. Laurie, G. Boffetta, G. Falkovich, I. Kolokolov, and V. Lebedev, “Universal profile of the vortex condensate in two-dimensional turbulence,” Physical review letters 113, 254503 (2014).
  * Kolokolov and Lebedev [2016a] I. Kolokolov and V. Lebedev, “Velocity statistics inside coherent vortices generated by the inverse cascade of 2-d turbulence,” Journal of Fluid Mechanics 809 (2016a).
  * Kolokolov, Ogorodnikov, and Vergeles [2020] I. V. Kolokolov, L. L. Ogorodnikov, and S. S. Vergeles, “Structure of coherent columnar vortices in three-dimensional rotating turbulent flow,” Physical Review Fluids 5, 034604 (2020).
  * Yang  _et al._ [2020] X. Yang, Z.-H. Xia, J. Lee, Y. Lv, and J. Yuan, “Mean flow scaling in a spanwise rotating channel,” Physical Review Fluids 5, 074603 (2020).
  * Antonia and Orlandi [2003] R. Antonia and P. Orlandi, “Effect of schmidt number on small-scale passive scalar turbulence,” Appl. Mech. Rev. 56, 615–632 (2003).
  * Greenspan [1968] H. P. Greenspan,  _The theory of rotating fluids_ (Cambridge University Press, 1968).
  * Batchelor and Proudman [1954] G. Batchelor and I. Proudman, “The effect of rapid distortion of a fluid in turbulent motion,” The Quarterly Journal of Mechanics and Applied Mathematics 7, 83–103 (1954).
  * Parfenyev  _et al._ [2021] V. M. Parfenyev, I. A. Vointsev, A. O. Skoba, and S. S. Vergeles, “Velocity profiles of cyclones and anticyclones in a rotating turbulent flow,” Physics of Fluids 33, 065117 (2021).
  * Kolokolov and Lebedev [2016b] I. Kolokolov and V. Lebedev, “Structure of coherent vortices generated by the inverse cascade of two-dimensional turbulence in a finite box,” Physical Review E 93, 033104 (2016b).
  * Ranz [1979] W. E. Ranz, “Applications of a stretch model to mixing, diffusion, and reaction in laminar and turbulent flows,” AIChE Journal 25, 41–47 (1979).