performance issue within VNET jail

[Eugene Grosbein]

22.12.2017 4:59, Michael Grimm wrote:

>> Make sure and double check that your ESP packets do not get fragmented.
> 
> 
> Hmm, I do not know how to achieve that. May the following tcpdump excerpts answer your question, or do you want me to look somewhere else?
> 
> At hostA while downloading from hostB/jailX and "tcpdump -i extIF esp -vv"
> 
> 22:52:42.341023 IP (tos 0x0, ttl 64, id 40481, offset 0, flags [none], proto ESP (50), length 140)
>     hostA > hostB: ESP(spi=0x01d9ec34,seq=0x5fe699), length 120
> 22:52:42.341079 IP (tos 0x0, ttl 53, id 64310, offset 1480, flags [none], proto ESP (50), length 100)
>     hostB > hostA: ip-proto-50

It shows non-zero offsets, so your ESP packets *are* fragmented.
I guess, this is the reason of your problems as fragmented ESP packets are known to cause problems
due to different reasons. Simpliest way to avoid such issues is to decrease MTU of IPSEC tunnel
and/or TCP MSS so that incapsulated ESP packets do not get fragmented.