Thursday, July 08, 2021

Re: TCP FIN hangups in encrypted ESP tunnel

> On Jul 8, 2021, at 8:05 AM, Peter J. Philipp <pjp@delphinusdns.org> wrote:
>
> On Wed, Jul 07, 2021 at 11:57:50PM +0300, Ville Valkonen wrote:
>> Hi,
>>
>> not sure if related but my Linux box (also in Hetzner) also started to have
>> flaky connection lately.
>>
>> --
>> Regards,
>> Ville
>
> I opened a ticket with Hetzner last week thinking it was an in-band DoS. They
> assured me, they are not seeing this.
>
> My VPS is in Falkenstein for what it's worth. Because the problems started
> occuring as I was upgrading my Telekom.de link I thought it was related to that
> until I did tcpdumps. I mentioned it to the telekom.de chat help line despite.
>
> On your Linux box have you done any debugging as to why it became flaky?
>
> Some Linux equivalents that I know: ktrace/strace, tcpdump is the same. Are
> you seeing these through an IPSEC tunnel or in plain Internetworking?
>
> Also are you using the Intel VPS's or the AMD Epyc VPS's? I think it may be
> important to know if anything like spectre is able to write variables back to
> the cloud instance. In that case we're f*cked and only Hetzner can help with
> new hardware.
>
> Best Regards,
> -peter
>

Are you changing the default TCPKeepAlive setting? It defaults to yes. It exists as options in sshd_ and ssh_config. Additionally, ClientAliveInterval and ServerAliveInterval might be handy. A sysctl also exists to turn TCP keep alive on for all connections by default.

Not sure it'll help. Does your download crawl to a halt, then after a period of time, you get the FIN?

(Note: I don't have any Hetzner hosts and I'm just guessing based on my experience with Azure)

-Brian

No comments:

Post a Comment