20%CPU usage, AEAD Decrypt error: bad packet ID (may be a replay): [ #1507564 ]

This forum is for admins who are looking to build or expand their OpenVPN setup.

Moderators: TinCanTech, TinCanTech, TinCanTech, TinCanTech, TinCanTech, TinCanTech

Forum rules
Please use the [oconf] BB tag for openvpn Configurations. See viewtopic.php?f=30&t=21589 for an example.
Post Reply
postcd
OpenVPN User
Posts: 26
Joined: Sun Jan 24, 2016 9:22 pm

20%CPU usage, AEAD Decrypt error: bad packet ID (may be a replay): [ #1507564 ]

Post by postcd » Fri May 04, 2018 9:28 am

Hello,

on Windows 10 i saw openvpn.exe is using around 20% of the CPU long time and when i opened connection status via OpenVPN gui

i see this as a last line:
Fri May 04 11:18:01 2018 AEAD Decrypt error: bad packet ID (may be a replay): [ #1507564 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

My installation details (the OpenVPN client PC reports this in VPN connection log):
OpenVPN 2.4.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Sep 26 2017
Windows version 6.2 (Windows 8 or greater) 64bit
library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.10

How can i prevent this in future or debug it if it happen again please?

TinCanTech
OpenVPN Protagonist
Posts: 11139
Joined: Fri Jun 03, 2016 1:17 pm

Re: 20%CPU usage, AEAD Decrypt error: bad packet ID (may be a replay): [ #1507564 ]

Post by TinCanTech » Fri May 04, 2018 11:41 am

postcd wrote:
Fri May 04, 2018 9:28 am
AEAD Decrypt error: bad packet ID (may be a replay): [ #1507564 ]
A "replay attack" is when the same packet arrives more than once, also packets which arrive "out of order" .. and a few other scenarios ..

This is common when using proto UDP, which is the nature of UDP and why UDP is faster than TCP in the context of the VPN protocol.

Generally, this happens most when your VPN connection is maxing out your line speed and can be ignored.

If you suspect somebody is trying to tamper with your VPN packets then what can you really do about it ?

Post Reply