High Latency Issue via tun0 device

padpad

Hi,

I am running a openvpn server with about 235 linux clients which are permantly connected via internet or reconnect if disconnected. My users claim, that their performance even on shell is really slow. I noticed high ping responses for pings going through the tun0 device. If I ping the public ip of this hosts via eth0, it is quite normal. I am pretty unsure what is causing the problem. I checked the debug logs but can´t find anything suspicious there. The performance of the CPU / RAM / Interface is pretty good, Load is at 0.03 average. How much Clients is openvpn able to handle without running in a kind of session limit or somethin? can this be a problem in my setup?

Server is a virtual machine 1 CPU 1GB Ram with RHEL 5.7, openvpn version 2.2.2.

this is my server.conf

local 10.51.7.12
dev tun
proto udp
port 1194
server 10.121.0.0 255.255.0.0
tls-server
dh /etc/openvpn/cert/dh2048.pem
ca /etc/openvpn/cert/ca.crt
cert /etc/openvpn/cert/server.crt
key /etc/openvpn/cert/server.key
plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-pam.so login
client-config-dir /etc/openvpn/ccd
ccd-exclusive
cipher AES-256-CBC
status /var/log/openvpn/status.log
comp-lzo
log-append /var/log/openvpn/openvpn.log
mute 20
verb 5
username-as-common-name
keepalive 10 120

client.conf

client
dev tun
proto udp
remote x.x.x.x 1194
tls-client
ca /etc/openvpn/cert/ca.crt
cert /etc/openvpn/cert/client.crt
key /etc/openvpn/cert/client.key
auth-user-pass /etc/openvpn/auth/login
pull
cipher AES-256-CBC
comp-lzo
verb 3
resolv-retry infinite

example ping

 ping 10.121.1.75
PING 10.121.1.75 (10.121.1.75) 56(84) bytes of data.
64 bytes from 10.121.1.75: icmp_seq=1 ttl=64 time=68.8 ms
64 bytes from 10.121.1.75: icmp_seq=2 ttl=64 time=818 ms
64 bytes from 10.121.1.75: icmp_seq=3 ttl=64 time=73.1 ms
64 bytes from 10.121.1.75: icmp_seq=4 ttl=64 time=5601 ms
64 bytes from 10.121.1.75: icmp_seq=5 ttl=64 time=4624 ms
64 bytes from 10.121.1.75: icmp_seq=6 ttl=64 time=3627 ms
64 bytes from 10.121.1.75: icmp_seq=7 ttl=64 time=2641 ms
64 bytes from 10.121.1.75: icmp_seq=8 ttl=64 time=1654 ms
64 bytes from 10.121.1.75: icmp_seq=9 ttl=64 time=671 ms

--- 10.121.1.75 ping statistics ---
12 packets transmitted, 9 received, 25% packet loss, time 11000ms
rtt min/avg/max/mdev = 68.875/2197.890/5601.435/1923.189 ms, pipe 6

padpad

hm nobody? Do you need further information? Is the sizing of the VM ok for the amount incoming connections or is what is the limit of connections openvpn can handle?

I monitor the server with check_mk and there are no cpu or ram issues, not event peaks. There is not much traffic to or from the clients, too. It is used only for support. The logs dont show any error even with debug 9 active.

janjust

a rtt ping time of

rtt min/avg/max/mdev = 68.875/2197.890/5601.435/1923.189 ms

is amazingly bad, I will admit. I have not seen this problem myself, but then again , I normally don't run a server with 200+ clients.

Check the firewalls (disable iptables for debugging?) , check for fragmentation - can you lower the mtu size of the tun device

tun-mtu 1400

to see if that has an impact?

padpad

ok firewall disabled, tun-mtu 1400 in server setting.

ping 10.121.1.75
PING 10.121.1.75 (10.121.1.75) 56(84) bytes of data.
64 bytes from 10.121.1.75: icmp_seq=1 ttl=64 time=67.6 ms
64 bytes from 10.121.1.75: icmp_seq=2 ttl=64 time=1900 ms
64 bytes from 10.121.1.75: icmp_seq=3 ttl=64 time=913 ms
64 bytes from 10.121.1.75: icmp_seq=4 ttl=64 time=1987 ms
64 bytes from 10.121.1.75: icmp_seq=5 ttl=64 time=999 ms
64 bytes from 10.121.1.75: icmp_seq=6 ttl=64 time=69.0 ms
64 bytes from 10.121.1.75: icmp_seq=7 ttl=64 time=1075 ms
64 bytes from 10.121.1.75: icmp_seq=8 ttl=64 time=89.2 ms
64 bytes from 10.121.1.75: icmp_seq=9 ttl=64 time=3968 ms
64 bytes from 10.121.1.75: icmp_seq=10 ttl=64 time=2967 ms
64 bytes from 10.121.1.75: icmp_seq=11 ttl=64 time=1966 ms
64 bytes from 10.121.1.75: icmp_seq=12 ttl=64 time=1034 ms
64 bytes from 10.121.1.75: icmp_seq=13 ttl=64 time=80.9 ms

--- 10.121.1.75 ping statistics ---
13 packets transmitted, 13 received, 0% packet loss, time 12008ms
rtt min/avg/max/mdev = 67.633/1316.874/3968.226/1160.910 ms, pipe 4

ping on public ip via eth0

ping x.x.x.x
PING x.x.x.x (x.x.x.x) 56(84) bytes of data.
64 bytes from x.x.x.x: icmp_seq=1 ttl=57 time=29.7 ms
64 bytes from x.x.x.x: icmp_seq=2 ttl=57 time=27.1 ms
64 bytes from x.x.x.x: icmp_seq=3 ttl=57 time=29.4 ms
64 bytes from x.x.x.x: icmp_seq=4 ttl=57 time=26.9 ms
64 bytes from x.x.x.x: icmp_seq=5 ttl=57 time=27.1 ms
64 bytes from x.x.x.x: icmp_seq=6 ttl=57 time=26.7 ms
64 bytes from x.x.x.x: icmp_seq=7 ttl=57 time=27.3 ms
64 bytes from x.x.x.x: icmp_seq=8 ttl=57 time=26.8 ms

--- x.x.x.x ping statistics ---
8 packets transmitted, 8 received, 0% packet loss, time 7248ms
rtt min/avg/max/mdev = 26.784/27.677/29.730/1.126 ms

janjust

ok, that didn't help - remember to restore the firewall and undo the 'tun-mtu' change; it would be interesting to see a wireshark/tcpdump when doing the ping , with timestamps added , to see where the delay is coming from.

What OS is the client running ?

padpad

Red Hat Enterprise Linux Server release 5.7 (Tikanga)

Kernel: 2.6.18-348.4.1.0.1.el5

tcpdump -vvv -nnel -i tun0 icmp
tcpdump: WARNING: arptype 65534 not supported by libpcap - falling back to cooked socket
tcpdump: listening on tun0, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
13:12:05.896759 Out ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 10.121.0.1 > 10.121.1.75: ICMP echo request, id 57634, seq 1, length 64
13:12:05.965677  In ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl  64, id 54533, offset 0, flags [none], proto: ICMP (1), length: 84) 10.121.1.75 > 10.121.0.1: ICMP echo reply, id 57634, seq 1, length 64
13:12:06.897743 Out ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 10.121.0.1 > 10.121.1.75: ICMP echo request, id 57634, seq 2, length 64
13:12:07.898741 Out ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 10.121.0.1 > 10.121.1.75: ICMP echo request, id 57634, seq 3, length 64
13:12:08.859830  In ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl  64, id 54534, offset 0, flags [none], proto: ICMP (1), length: 84) 10.121.1.75 > 10.121.0.1: ICMP echo reply, id 57634, seq 2, length 64
13:12:08.873008  In ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl  64, id 54535, offset 0, flags [none], proto: ICMP (1), length: 84) 10.121.1.75 > 10.121.0.1: ICMP echo reply, id 57634, seq 3, length 64
13:12:08.898757 Out ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 10.121.0.1 > 10.121.1.75: ICMP echo request, id 57634, seq 4, length 64
13:12:08.968305  In ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl  64, id 54536, offset 0, flags [none], proto: ICMP (1), length: 84) 10.121.1.75 > 10.121.0.1: ICMP echo reply, id 57634, seq 4, length 64
13:12:09.899725 Out ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 10.121.0.1 > 10.121.1.75: ICMP echo request, id 57634, seq 5, length 64
13:12:10.388660  In ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl  64, id 54537, offset 0, flags [none], proto: ICMP (1), length: 84) 10.121.1.75 > 10.121.0.1: ICMP echo reply, id 57634, seq 5, length 64
13:12:10.899719 Out ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 10.121.0.1 > 10.121.1.75: ICMP echo request, id 57634, seq 6, length 64
13:12:11.900721 Out ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 10.121.0.1 > 10.121.1.75: ICMP echo request, id 57634, seq 7, length 64
13:12:12.551523  In ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl  64, id 54538, offset 0, flags [none], proto: ICMP (1), length: 84) 10.121.1.75 > 10.121.0.1: ICMP echo reply, id 57634, seq 6, length 64
13:12:12.564141  In ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl  64, id 54539, offset 0, flags [none], proto: ICMP (1), length: 84) 10.121.1.75 > 10.121.0.1: ICMP echo reply, id 57634, seq 7, length 64
13:12:12.900705 Out ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 10.121.0.1 > 10.121.1.75: ICMP echo request, id 57634, seq 8, length 64
13:12:12.969742  In ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl  64, id 54540, offset 0, flags [none], proto: ICMP (1), length: 84) 10.121.1.75 > 10.121.0.1: ICMP echo reply, id 57634, seq 8, length 64
13:12:13.901714 Out ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 10.121.0.1 > 10.121.1.75: ICMP echo request, id 57634, seq 9, length 64
13:12:14.901724 Out ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 10.121.0.1 > 10.121.1.75: ICMP echo request, id 57634, seq 10, length 64
13:12:15.902702 Out ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 10.121.0.1 > 10.121.1.75: ICMP echo request, id 57634, seq 11, length 64
13:12:16.903696 Out ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 10.121.0.1 > 10.121.1.75: ICMP echo request, id 57634, seq 12, length 64

20 packets captured
20 packets received by filter
0 packets dropped by kernel

ping 10.121.1.75
PING 10.121.1.75 (10.121.1.75) 56(84) bytes of data.
64 bytes from 10.121.1.75: icmp_seq=1 ttl=64 time=68.9 ms
64 bytes from 10.121.1.75: icmp_seq=2 ttl=64 time=1962 ms
64 bytes from 10.121.1.75: icmp_seq=3 ttl=64 time=974 ms
64 bytes from 10.121.1.75: icmp_seq=4 ttl=64 time=69.5 ms
64 bytes from 10.121.1.75: icmp_seq=5 ttl=64 time=488 ms
64 bytes from 10.121.1.75: icmp_seq=6 ttl=64 time=1651 ms
64 bytes from 10.121.1.75: icmp_seq=7 ttl=64 time=663 ms
64 bytes from 10.121.1.75: icmp_seq=8 ttl=64 time=69.0 ms
64 bytes from 10.121.1.75: icmp_seq=9 ttl=64 time=3820 ms
64 bytes from 10.121.1.75: icmp_seq=10 ttl=64 time=2820 ms
64 bytes from 10.121.1.75: icmp_seq=11 ttl=64 time=1890 ms
64 bytes from 10.121.1.75: icmp_seq=12 ttl=64 time=902 ms
64 bytes from 10.121.1.75: icmp_seq=13 ttl=64 time=69.4 ms

--- 10.121.1.75 ping statistics ---
13 packets transmitted, 13 received, 0% packet loss, time 12006ms
rtt min/avg/max/mdev = 68.979/1188.554/3820.261/1136.755 ms, pipe 4

janjust

hehe I should have been more precise: I was interested in a tcpdump/wireshark log of the underlying network interface (eth0? wlan0?) when doing the ping - this will show the timings for the encrypted data stream and any fragmentation that might occur in there.

padpad

what tcpdump options do you suggest? its is quite a lot of data on that interface.

janjust

something like UDP + dport = 1194 thus

udp port 1194

and if you know the (real) IP address of the client you can add

udp port 1194 and host XX.XX.XX.XX

padpad

sry took a while quite busy friday.

tcpdump -vvv -nnel -i eth0 dst 62.158.19.39 and port 1194
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
15:06:41.151698 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 111: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 97) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 69
15:06:41.151794 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 56: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 42) 10.51.7.12.1194 > 62.158.09.39.1194: [bad udp cksum 74ba!] UDP, length 14
15:06:41.151804 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 7913!] UDP, length 22
15:06:41.238149 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 168: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 154) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 126
15:06:41.238173 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.238192 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.238209 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.312779 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.312876 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.316315 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.316375 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.372642 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.377398 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.382583 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.388189 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.456075 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.456474 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.457093 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.457306 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.515177 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.9.39.1194: UDP, length 114
15:06:41.532206 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.553022 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.553164 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.576335 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.582711 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 175: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 161) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 133
15:06:41.592004 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.616855 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.618433 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:41.638176 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:44.200727 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:44.200754 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:44.200833 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:44.200917 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 119: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 105) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 77
15:06:44.205481 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 175: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 161) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 133
15:06:44.205543 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 175: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 161) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 133
15:06:44.369827 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 7713!] UDP, length 22
15:06:44.379950 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 7613!] UDP, length 22
15:06:44.390476 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 7513!] UDP, length 22
15:06:44.401163 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 7413!] UDP, length 22
15:06:44.438257 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 7313!] UDP, length 22
15:06:44.448842 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 7213!] UDP, length 22
15:06:44.459286 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 7113!] UDP, length 22
15:06:44.470155 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 7013!] UDP, length 22
15:06:44.502359 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 6f13!] UDP, length 22
15:06:44.512321 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 6e13!] UDP, length 22
15:06:44.523056 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 6d13!] UDP, length 22
15:06:44.533703 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 6c13!] UDP, length 22
15:06:44.568048 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 6b13!] UDP, length 22
15:06:44.578432 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 6a13!] UDP, length 22
15:06:44.581756 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 175: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 161) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 133
15:06:44.589398 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 6913!] UDP, length 22
15:06:44.599589 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 6813!] UDP, length 22
15:06:44.631365 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 6713!] UDP, length 22
15:06:44.642322 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 6613!] UDP, length 22
15:06:44.666541 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 6513!] UDP, length 22
15:06:44.676807 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 6413!] UDP, length 22
15:06:44.713061 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 6313!] UDP, length 22
15:06:44.713105 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 6213!] UDP, length 22
15:06:44.730276 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 127: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 113) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 85
15:06:44.798881 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 6013!] UDP, length 22
15:06:44.809424 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 5f13!] UDP, length 22
15:06:44.819686 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 64: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.109.39.1194: [bad udp cksum 5e13!] UDP, length 22
15:06:44.831992 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 168: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 154) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 126
15:06:44.832027 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 156: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 142) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 114
15:06:44.832044 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 122: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 108) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 80
15:06:47.021273 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 175: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 161) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 133
15:06:47.021338 00:50:56:b3:60:08 > 00:15:17:e8:6f:00, ethertype IPv4 (0x0800), length 175: (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: UDP (17), length: 161) 10.51.7.12.1194 > 62.158.19.39.1194: UDP, length 133

67 packets captured
67 packets received by filter
0 packets dropped by kernel

so there are [bad udp cksum 6313!] packet. what does this mean? Thanks for help btw.

janjust

sorry, this post got lost between the cracks ... the

[DF], proto: UDP (17), length: 50) 10.51.7.12.1194 > 62.158.19.39.1194: [bad udp cksum 7713!] UDP, length 22

is indeed not good ... but the packets are very small, and the rest of the output does not look bad. What OS is running on the client?