Aw: Re: very high traffic without any load

[Ann Brown]

On Friday, May 3, 2019 6:06 PM, Christopher Klinge <Christ.Klinge at web.de> wrote:

> Hi again,
>
> I did some digging, and thus far I could not find any other culprit other than tinc itself. The packages that are being sent are addressed directly to the other tinc hosts on their vpn addresses. During my latest tests, within about 12 seconds 100MB of data were transmitted this way. I captured this test in wireshark. Sadly, I lack the expertise of understanding what is happening.
>
> At the very beginning, normal connections are being set up and a few ICMP neighbor advertisements/solicitations are being exchanged. Next a short TCP session was created between the public IP addresses of two of my hosts, through the VPN. This is something that I would like to support and theoretically it should be possible. However, to me it looks like the connection could not be established. Right afterwards, one of the nodes involved in the TCP connection and the third node I used for testing started exchaning the weird packages that I am complaining about.
>
> They are UDP packets varying in size and as far as I can tell unrelated to any outside application. All of them belong to one connection. If anyone would like to take a look at the dump itself, I'll provide it directly, since I don't want to make all of my servers' addresses public.

<snip>

Could this be tinc connecting via tinc?

Perhaps try ip6tables rules.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.tinc-vpn.org/pipermail/tinc/attachments/20190504/46ff9758/attachment-0001.html>