lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Wed, 16 Dec 2015 10:59:54 +0100
From:	Steffen Klassert <steffen.klassert@...unet.com>
To:	Gabriele Beltrame <belgab@...source.net>
CC:	<netdev@...r.kernel.org>
Subject: Re: Random packet loss using IPsec with AES128-SHA1

On Wed, Dec 16, 2015 at 10:17:54AM +0100, Gabriele Beltrame wrote:
> Hi,
> 
> I'm running a few Strongswan 5.3.* CentOS (Kernel 3.16.7, 4.2.6, 4.1.*)
> instances on AWS to terminate VPNs between each other and/or to other
> devices across the Internet.
> While investigating some application issues, I've noticed that on every VPNs
> I have random packet losses (from 1% to 4% over 100 to 300 requests sent).
> This only happens when the two following conditions are met: (a) AES
> encryption used, (b) IP packet size shorter than about (150+8+20)Bytes.

I've never seen this.

If xfrm statistics are compiled in, a counter is bumped for each packet
dropped by IPsec. You can check these counters in /proc/net/xfrm_stat.

This will tell you at least whether IPsec is the reason for your packet
loss.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Powered by blists - more mailing lists