Aw: Re: very high traffic without any load

Christopher Klinge Fri, 03 May 2019 11:12:16 -0700

Hi again,

I did some digging, and thus far I could not find any other culprit other than tinc itself. The packages that are being sent are addressed directly to the other tinc hosts on their vpn addresses. During my latest tests, within about 12 seconds 100MB of data were transmitted this way. I captured this test in wireshark. Sadly, I lack the expertise of understanding what is happening.

At the very beginning, normal connections are being set up and a few ICMP neighbor advertisements/solicitations are being exchanged. Next a short TCP session was created between the public IP addresses of two of my hosts, through the VPN. This is something that I would like to support and theoretically it should be possible. However, to me it looks like the connection could not be established. Right afterwards, one of the nodes involved in the TCP connection and the third node I used for testing started exchaning the weird packages that I am complaining about.

They are UDP packets varying in size and as far as I can tell unrelated to any outside application. All of them belong to one connection. If anyone would like to take a look at the dump itself, I'll provide it directly, since I don't want to make all of my servers' addresses public.

Warning, wall of text incoming:

Source                Destination           Protocol Length Info
node01-public         node04-public         TCP      929    tinc(655) → 40690 [PSH, ACK] Seq=1 Ack=1 Win=240 Len=843 TSval=66121145 TSecr=65947641
node01-public         node04-public         TCP      1294   tinc(655) → 40690 [ACK] Seq=844 Ack=1 Win=240 Len=1208 TSval=66121145 TSecr=65947641
node01-public         node04-public         TCP      110    tinc(655) → 40690 [PSH, ACK] Seq=2052 Ack=1 Win=240 Len=24 TSval=66121145 TSecr=65947641
node01-public         node04-public         TCP      1294   tinc(655) → 40690 [ACK] Seq=2076 Ack=1 Win=240 Len=1208 TSval=66121145 TSecr=65947641
node01-public         node04-public         TCP      373    tinc(655) → 40690 [PSH, ACK] Seq=3284 Ack=1 Win=240 Len=287 TSval=66121145 TSecr=65947641
node01-public         node04-public         TCP      1294   tinc(655) → 40690 [ACK] Seq=3571 Ack=1 Win=240 Len=1208 TSval=66121145 TSecr=65947641
node01-public         node04-public         TCP      636    tinc(655) → 40690 [PSH, ACK] Seq=4779 Ack=1 Win=240 Len=550 TSval=66121145 TSecr=65947641
node01-public         node04-public         TCP      1294   tinc(655) → 40690 [ACK] Seq=5329 Ack=1 Win=240 Len=1208 TSval=66121149 TSecr=65947641
node01-public         node04-public         TCP      899    tinc(655) → 40690 [PSH, ACK] Seq=6537 Ack=1 Win=240 Len=813 TSval=66121149 TSecr=65947641
node01-public         node04-public         TCP      1294   tinc(655) → 40690 [ACK] Seq=7350 Ack=1 Win=240 Len=1196 TSval=66121196 TSecr=65947693 SLE=4294967052 SRE=1
node01-public         node04-public         TCP      1294   tinc(655) → 40690 [ACK] Seq=8546 Ack=1 Win=240 Len=1208 TSval=66121200 TSecr=65947693
node01-public         node04-public         TCP      98     [TCP Dup ACK 63#1] tinc(655) → 40690 [ACK] Seq=9754 Ack=1 Win=240 Len=0 TSval=66121248 TSecr=65947745 SLE=4294967052 SRE=1
node01-public         node04-public         TCP      1294   tinc(655) → 40690 [ACK] Seq=9754 Ack=1 Win=240 Len=1208 TSval=66121252 TSecr=65947745
node01-public         node04-public         TCP      929    [TCP Retransmission] tinc(655) → 40690 [PSH, ACK] Seq=1 Ack=1 Win=240 Len=843 TSval=66121304 TSecr=65947745
node01-public         node04-public         TCP      98     [TCP Dup ACK 63#2] tinc(655) → 40690 [ACK] Seq=10962 Ack=1 Win=240 Len=0 TSval=66121351 TSecr=65947848 SLE=4294967052 SRE=1
node01-public         node04-public         TCP      929    [TCP Retransmission] tinc(655) → 40690 [PSH, ACK] Seq=1 Ack=1 Win=240 Len=843 TSval=66121408 TSecr=65947848
node01-public         node04-public         TCP      98     [TCP Dup ACK 63#3] tinc(655) → 40690 [ACK] Seq=10962 Ack=1 Win=240 Len=0 TSval=66121559 TSecr=65948056 SLE=4294967052 SRE=1
node01-public         node04-public         TCP      929    [TCP Retransmission] tinc(655) → 40690 [PSH, ACK] Seq=1 Ack=1 Win=240 Len=843 TSval=66121616 TSecr=65948056
node02-vpn            ff02::1:ff00:4        ICMPv6   86     Neighbor Solicitation for 1111:1::4 from 96:6a:04:92:56:4e
fe80::946a:4ff:fe92:564e ff02::1:ff00:4        ICMPv6   86     Neighbor Solicitation for 1111:1::4 from 96:6a:04:92:56:4e
node01-public         node04-public         TCP      98     [TCP Dup ACK 63#4] tinc(655) → 40690 [ACK] Seq=10962 Ack=1 Win=240 Len=0 TSval=66121975 TSecr=65948472 SLE=4294967052 SRE=1
node01-public         node04-public         TCP      929    [TCP Retransmission] tinc(655) → 40690 [PSH, ACK] Seq=1 Ack=1 Win=240 Len=843 TSval=66122032 TSecr=65948472
node02-vpn            ff02::1:ff00:4        ICMPv6   86     Neighbor Solicitation for 1111:1::4 from 96:6a:04:92:56:4e
node02-vpn            ff02::1:ff00:4        ICMPv6   86     Neighbor Solicitation for 1111:1::4 from 96:6a:04:92:56:4e
fe80::1471:c8ff:fe7b:1003 1111:1::4             ICMPv6   86     Neighbor Solicitation for 1111:1::4 from 16:71:c8:7b:10:03
fe80::1471:c8ff:fe7b:1003 1111:1::4             ICMPv6   86     Neighbor Solicitation for 1111:1::4 from 16:71:c8:7b:10:03
node01-public         node04-public         TCP      98     [TCP Dup ACK 63#5] tinc(655) → 40690 [ACK] Seq=10962 Ack=1 Win=240 Len=0 TSval=66122815 TSecr=65949312 SLE=4294967052 SRE=1
node01-public         node04-public         TCP      929    [TCP Retransmission] tinc(655) → 40690 [PSH, ACK] Seq=1 Ack=1 Win=240 Len=843 TSval=66122880 TSecr=65949312
fe80::1471:c8ff:fe7b:1003 1111:1::4             ICMPv6   86     Neighbor Solicitation for 1111:1::4 from 16:71:c8:7b:10:03
fe80::1471:c8ff:fe7b:1003 ff02::1:ff00:1        ICMPv6   86     Neighbor Solicitation for 1111:1::1 from 16:71:c8:7b:10:03
node02-vpn            fe80::1471:c8ff:fe7b:1003 ICMPv6   86     Neighbor Advertisement 1111:1::1 (sol, ovr) is at 96:6a:04:92:56:4e
node01-vpn            node01-public         UDP      113    tinc(655) → tinc(655) Len=51
node01-vpn            node01-public         UDP      1294   tinc(655) → tinc(655) Len=1232
node01-vpn            node01-public         UDP      113    tinc(655) → tinc(655) Len=51
node02-vpn            ff02::1:ff00:3        ICMPv6   86     Neighbor Solicitation for 1111:1::3 from 96:6a:04:92:56:4e
node01-vpn            node02-vpn            ICMPv6   86     Neighbor Advertisement 1111:1::3 (sol, ovr) is at 16:71:c8:7b:10:03
node01-vpn            node01-public         UDP      113    tinc(655) → tinc(655) Len=51
node02-vpn            node01-vpn            UDP      113    tinc(655) → tinc(655) Len=51
node02-vpn            node01-vpn            UDP      113    tinc(655) → tinc(655) Len=51
node01-vpn            node02-vpn            UDP      113    tinc(655) → tinc(655) Len=51
node01-vpn            node02-vpn            UDP      113    tinc(655) → tinc(655) Len=51
node01-vpn            node01-public         UDP      113    tinc(655) → tinc(655) Len=51
node02-vpn            node01-vpn            UDP      1294   tinc(655) → tinc(655) Len=1232
node02-vpn            node01-vpn            UDP      113    tinc(655) → tinc(655) Len=51
node01-vpn            node02-vpn            UDP      113    tinc(655) → tinc(655) Len=51
node01-vpn            node02-vpn            UDP      113    tinc(655) → tinc(655) Len=51
node01-vpn            node02-vpn            UDP      1294   tinc(655) → tinc(655) Len=1232
node02-vpn            node01-vpn            UDP      113    tinc(655) → tinc(655) Len=51
node02-vpn            node01-vpn            UDP      113    tinc(655) → tinc(655) Len=51
node01-vpn            node02-vpn            UDP      113    tinc(655) → tinc(655) Len=51
node01-vpn            node02-vpn            UDP      113    tinc(655) → tinc(655) Len=51
node02-vpn            node01-vpn            UDP      1253   tinc(655) → tinc(655) Len=1191
node02-vpn            node01-vpn            UDP      1158   tinc(655) → tinc(655) Len=1096
node02-vpn            node01-vpn            UDP      1063   tinc(655) → tinc(655) Len=1001
node02-vpn            node01-vpn            UDP      968    tinc(655) → tinc(655) Len=906
node02-vpn            node01-vpn            UDP      873    tinc(655) → tinc(655) Len=811
node02-vpn            node01-vpn            UDP      778    tinc(655) → tinc(655) Len=716
node02-vpn            node01-vpn            UDP      683    tinc(655) → tinc(655) Len=621
node02-vpn            node01-vpn            UDP      1253   tinc(655) → tinc(655) Len=1191
node02-vpn            node01-vpn            UDP      588    tinc(655) → tinc(655) Len=526
node02-vpn            node01-vpn            UDP      1158   tinc(655) → tinc(655) Len=1096
node02-vpn            node01-vpn            UDP      493    tinc(655) → tinc(655) Len=431
node02-vpn            node01-vpn            UDP      1063   tinc(655) → tinc(655) Len=1001
node02-vpn            node01-vpn            UDP      398    tinc(655) → tinc(655) Len=336
node02-vpn            node01-vpn            UDP      968    tinc(655) → tinc(655) Len=906
node02-vpn            node01-vpn            UDP      303    tinc(655) → tinc(655) Len=241
node02-vpn            node01-vpn            UDP      873    tinc(655) → tinc(655) Len=811
node02-vpn            node01-vpn            UDP      208    tinc(655) → tinc(655) Len=146
node02-vpn            node01-vpn            UDP      778    tinc(655) → tinc(655) Len=716
node02-vpn            node01-vpn            UDP      113    tinc(655) → tinc(655) Len=51
node02-vpn            node01-vpn            UDP      683    tinc(655) → tinc(655) Len=621

...

Kind regards

Christopher

Gesendet: Donnerstag, 02. Mai 2019 um 23:00 Uhr
Von: "Lars Kruse" <li...@sumpfralle.de>
An: tinc@tinc-vpn.org
Betreff: Re: very high traffic without any load

Hello Christoph,

Am Thu, 2 May 2019 19:42:25 +0200
schrieb "Christopher Klinge" <christ.kli...@web.de>:

> all of my servers where set up fresh with no other applications running
> besides tinc and my ssh sessions.

Did you try something as simple as "tcpdump -npi TINC_INTERFACE"?
This should give you a good impression of the traffic flowing through the VPN.

Cheers,
Lars
_______________________________________________
tinc mailing list
tinc@tinc-vpn.org
https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc

_______________________________________________
tinc mailing list
tinc@tinc-vpn.org
https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc

Aw: Re: very high traffic without any load

Reply via email to