LinuxQuestions.org
Help answer threads with 0 replies.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 06-08-2020, 05:12 PM   #16
sicklybeans
LQ Newbie
 
Registered: Jun 2020
Distribution: Majaro+i3
Posts: 11

Original Poster
Rep: Reputation: Disabled

I am going to try a lot of these suggestions when I get a chance. I appreciate the help.

For the moment I have realized that if I SSH into an external server (my old university's server) and then SSH from there into my local network server (by forwarding port through my router), then it works perfectly fine.

This is deeply disturbing, but it's usable
 
Old 06-08-2020, 05:16 PM   #17
Ser Olmy
Senior Member
 
Registered: Jan 2012
Distribution: Slackware
Posts: 3,341

Rep: Reputation: Disabled
Quote:
Originally Posted by sicklybeans View Post
This is deeply disturbing, but it's usable
The plot thickens. I hope you'll keep us updated in this thread.
 
1 members found this post helpful.
Old 06-09-2020, 12:16 PM   #18
sicklybeans
LQ Newbie
 
Registered: Jun 2020
Distribution: Majaro+i3
Posts: 11

Original Poster
Rep: Reputation: Disabled
I've done some preliminary testing and found something interesting.

The problem is not that packets are getting lost. The problem is that there appears to be a long delay when my router delivers packets to both my laptop and my local server. This delay is so long that it sometimes triggers re-transmission of packets creating the appearance of dropped packets. However, if you actually follow the trace, you find that every packet is eventually sent (more or less).

To figure this out, I did the following:

1. I opened an SSH session from my laptop to my server
2. I then ran tcpdump in three places: my laptop, my router, and my local server
3. I typed the letter 'h' in the SSH session and waited for it to appear in the terminal
4. I stopped the tcpdump processes.

I then opened the captured activity in wireshark and set the time to display the offset from the first packet sent by my laptop (I made sure the system clocks were all more or less synchronized so that this was possible). The resulting data makes it pretty clear what is happening:

Laptop tcp dump

Code:
Label   Time      Source    Dest      Protocol  Info
A       0.0000    laptop    server    SSH/TCP   Seq: 3506353825
B       1.8561    server    laptop    TCP       Seq: 3823138271 / Ack: 3506353861
        1.8565    server    laptop    SSH/TCP   Seq: 3823138271
C       1.8565    laptop    server    TCP       Seq: 3506353861 / Ack: 3823138307
Router tcp dump

Code:
Label   Time      Source    Dest      Protocol  Info
A       0.0011    laptop    server    SSH/TCP   Seq: 3506353825
B       0.8471    server    laptop    TCP       Seq: 3823138271 / Ack: 3506353861
        0.8478    server    laptop    SSH/TCP   Seq: 3823138271
C       1.8639    laptop    server    TCP       Seq: 3506353861 / Ack: 3823138307
Server tcp dump

Code:
Label   Time      Source    Dest      Protocol  Info
A       0.7958    laptop    server    SSH/TCP   Seq: 3506353825
B       0.7958    server    laptop    TCP       Seq: 3823138271 / Ack: 3506353861
        0.7963    server    laptop    SSH/TCP   Seq: 3823138271
C       2.8109    laptop    server    TCP       Seq: 3506353861 / Ack: 3823138307

- Packet A is passed from laptop to router normally
- There is a 0.8 sec delay before packet A is passed from router to server
- Packet B is passed from server to router normally
- There is a 0.9 sec delay before packet B is passed from router to laptop
- Packet C is passed from laptop to router normally
- There is a 0.9 sec delay before packet C is passed from router to server

So it looks like the router is delaying delivery of packets for some reason. The fact that the delivery delay happens both with laptop to server and server to laptop path is making me think that the problem lies with my router. No idea what could be causing this. Maybe my router de-prioritizes intra-network communication for some reason?

Some other things I still want to try:

1. Check what tcpdump looks like when I SSH into an external server (which has no delay)
2. Check if this delivery delay happens for TCP laptop-server communication on other ports

Last edited by sicklybeans; 06-09-2020 at 12:19 PM. Reason: formatting
 
Old 06-09-2020, 12:25 PM   #19
TB0ne
LQ Guru
 
Registered: Jul 2003
Location: Birmingham, Alabama
Distribution: SuSE, RedHat, Slack,CentOS
Posts: 26,650

Rep: Reputation: 7970Reputation: 7970Reputation: 7970Reputation: 7970Reputation: 7970Reputation: 7970Reputation: 7970Reputation: 7970Reputation: 7970Reputation: 7970Reputation: 7970
Quote:
Originally Posted by sicklybeans View Post
I've done some preliminary testing and found something interesting.
The problem is not that packets are getting lost. The problem is that there appears to be a long delay when my router delivers packets to both my laptop and my local server. This delay is so long that it sometimes triggers re-transmission of packets creating the appearance of dropped packets. However, if you actually follow the trace, you find that every packet is eventually sent (more or less).

To figure this out, I did the following:

1. I opened an SSH session from my laptop to my server
2. I then ran tcpdump in three places: my laptop, my router, and my local server
3. I typed the letter 'h' in the SSH session and waited for it to appear in the terminal
4. I stopped the tcpdump processes.

I then opened the captured activity in wireshark and set the time to display the offset from the first packet sent by my laptop (I made sure the system clocks were all more or less synchronized so that this was possible). The resulting data makes it pretty clear what is happening:

Laptop tcp dump
Code:
Label   Time      Source    Dest      Protocol  Info
A       0.0000    laptop    server    SSH/TCP   Seq: 3506353825
B       1.8561    server    laptop    TCP       Seq: 3823138271 / Ack: 3506353861
        1.8565    server    laptop    SSH/TCP   Seq: 3823138271
C       1.8565    laptop    server    TCP       Seq: 3506353861 / Ack: 3823138307
Router tcp dump
Code:
Label   Time      Source    Dest      Protocol  Info
A       0.0011    laptop    server    SSH/TCP   Seq: 3506353825
B       0.8471    server    laptop    TCP       Seq: 3823138271 / Ack: 3506353861
        0.8478    server    laptop    SSH/TCP   Seq: 3823138271
C       1.8639    laptop    server    TCP       Seq: 3506353861 / Ack: 3823138307
Server tcp dump
Code:
Label   Time      Source    Dest      Protocol  Info
A       0.7958    laptop    server    SSH/TCP   Seq: 3506353825
B       0.7958    server    laptop    TCP       Seq: 3823138271 / Ack: 3506353861
        0.7963    server    laptop    SSH/TCP   Seq: 3823138271
C       2.8109    laptop    server    TCP       Seq: 3506353861 / Ack: 3823138307
- Packet A is passed from laptop to router normally
- There is a 0.8 sec delay before packet A is passed from router to server
- Packet B is passed from server to router normally
- There is a 0.9 sec delay before packet B is passed from router to laptop
- Packet C is passed from laptop to router normally
- There is a 0.9 sec delay before packet C is passed from router to server

So it looks like the router is delaying delivery of packets for some reason. The fact that the delivery delay happens both with laptop to server and server to laptop path is making me think that the problem lies with my router. No idea what could be causing this. Maybe my router de-prioritizes intra-network communication for some reason?

Some other things I still want to try:

1. Check what tcpdump looks like when I SSH into an external server (which has no delay)
2. Check if this delivery delay happens for TCP laptop-server communication on other ports
I mentioned QOS before...do you happen to have that enabled? What kind of router? And (to start with simple things first), have you just tried to reset your router, or flush the ARP tables on it?
 
1 members found this post helpful.
Old 06-09-2020, 12:43 PM   #20
sicklybeans
LQ Newbie
 
Registered: Jun 2020
Distribution: Majaro+i3
Posts: 11

Original Poster
Rep: Reputation: Disabled
Quote:
I mentioned QOS before...do you happen to have that enabled? What kind of router? And (to start with simple things first), have you just tried to reset your router, or flush the ARP tables on it?
Sorry, I forgot to respond. It's a Synology RT1900ac. None of the QoS features are enabled as far as I can tell. I have restarted it and my problem still happens. I am not sure how to flush the ARP tables.
 
Old 06-09-2020, 01:07 PM   #21
TB0ne
LQ Guru
 
Registered: Jul 2003
Location: Birmingham, Alabama
Distribution: SuSE, RedHat, Slack,CentOS
Posts: 26,650

Rep: Reputation: 7970Reputation: 7970Reputation: 7970Reputation: 7970Reputation: 7970Reputation: 7970Reputation: 7970Reputation: 7970Reputation: 7970Reputation: 7970Reputation: 7970
Quote:
Originally Posted by sicklybeans View Post
Sorry, I forgot to respond. It's a Synology RT1900ac. None of the QoS features are enabled as far as I can tell. I have restarted it and my problem still happens. I am not sure how to flush the ARP tables.
Typically those routers have web interfaces where you can reset things..not sure where it is on your router, though. From what I saw there is an "Intrusion Detection" system available/installed on those devices, and have seen several reports of that pegging the CPU during some operations. Again, grasping at straws...since you can SSH in from OUTSIDE your home network with no problems, that leaves things that are LAN only to look at, as a diagnostic start.
 
1 members found this post helpful.
Old 06-09-2020, 01:35 PM   #22
sicklybeans
LQ Newbie
 
Registered: Jun 2020
Distribution: Majaro+i3
Posts: 11

Original Poster
Rep: Reputation: Disabled
Probably my last followup:

After some other tests:

- SSH is still slow when run over another port
- TCP packets are sent instantaneously in other contexts
- SSH is instantaneous when coming from an external server.

These three facts together seem impossible unless my router is intentionally slowing down SSH packets but only when they come from within the network. That seems very unlikely. I suspect something weird is happening with my router, but it's beyond my ability to fix. Thanks for the help
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Long Delay After Entering Username via SSH after PC lost network connection meng2000 Linux - Server 3 10-17-2017 02:23 AM
Help with Ubuntu server remote ssh and local network ssh issues using putty. scottpops Linux - Server 8 05-17-2012 05:07 PM
setting up an ssh soxy or local ssh tunnel from within an ssh soxy Mangenius Linux - Networking 0 03-05-2007 03:15 PM
bizarre network problem BillyAnachronis Linux - Networking 9 10-09-2003 07:52 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 11:43 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration