The Packets, Life and everything
In Diagnosing a Slow git clone Over SSH With Packet Timing I binned a packet capture into per-minute byte counts and found a 48-minute SSH session that was really 34 minutes of near-silence followed by ~13 minutes of bulk transfer. That post stopped at the diagnosis: the server was building the pack, the network was …
Continue reading "Git Pack Housekeeping: What 34 Minutes of Silence Actually Cost"
In FortiGate - High CPU and Memory load the root cause traced back to sessions that never get hardware-offloaded to the NPU/SPU — DNS and ICMP being the two protocols of interest, since they never leave the CPU path regardless of volume. This note is the workflow for actually finding which host is generating that non-offloaded load, and where it's …
Continue reading "FortiGate – Identifying Non-Offloaded Sessions per Host"
Recently, we encountered significant CPU and memory utilization spikes on one of our Fortigate Firewalls. Despite consistently handling around 1.5 million sessions for several months without any problems, the situation took a turn for the worse. The firewall became unresponsive through the Command Line Interface (CLI), and at that time, we hadn't configured a dedicated …
Basic Packet Capture tcpdump -i eth0 This captures and displays packets on interface eth0. Capture Packets from a Specific Port tcpdump -i eth0 port 80 This captures packets on port 80 (HTTP traffic) on eth0. Capture Packets with a Specific Host as Source or Destination tcpdump -i eth0 host 192.168.1.100 This captures packets either from …
Force VPN Tunnels to the CPUFirst you need to force the Encrypted traffic over the CPU. Take packet captures from the GUI It is somehow counter intuitive but we need to take care that the IPSec session is not offloaded into Hardware. This basically the Opposite as described in Ensuring IPSec traffic is offloaded for …
Continue reading "Fortigate – IPSec Troubleshooting – VPN Analyse"
A user reports "git clone over SSH takes forever." Unlike a TLS session (see Decrypting TLS Traffic in Wireshark with SSLKEYLOGFILE), there's no equivalent trick for SSH — no key log file, no way to see the git protocol negotiation in plaintext. But you don't need the payload to answer the one question that actually …
Continue reading "Diagnosing a Slow git clone Over SSH With Packet Timing"