Hi Steffen, I don't think it's IPsec (I can see the outbound packet in tcpdump), not alone at least but the XEN /AWS Ethernet driver (or multiple things concurring to the issue) actually... the odd thing is that it does seem to affect AES-CBS only (3DES-CBS, AES-GCM are fine) This is the short discussion on the Strongswan support wiki: https://wiki.strongswan.org/issues/1220
Thanks, Gabriele -----Original Message----- From: Steffen Klassert [mailto:steffen.klass...@secunet.com] Sent: mercoledì 16 dicembre 2015 11:00 To: Gabriele Beltrame <bel...@drvsource.net> Cc: netdev@vger.kernel.org Subject: Re: Random packet loss using IPsec with AES128-SHA1 On Wed, Dec 16, 2015 at 10:17:54AM +0100, Gabriele Beltrame wrote: > Hi, > > I'm running a few Strongswan 5.3.* CentOS (Kernel 3.16.7, 4.2.6, > 4.1.*) instances on AWS to terminate VPNs between each other and/or to > other devices across the Internet. > While investigating some application issues, I've noticed that on > every VPNs I have random packet losses (from 1% to 4% over 100 to 300 requests sent). > This only happens when the two following conditions are met: (a) AES > encryption used, (b) IP packet size shorter than about (150+8+20)Bytes. I've never seen this. If xfrm statistics are compiled in, a counter is bumped for each packet dropped by IPsec. You can check these counters in /proc/net/xfrm_stat. This will tell you at least whether IPsec is the reason for your packet loss. --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
