High latency with MASQ, not without

Hi All,

I have a problem with RedHat 7.0 with kernels 2.2.19 or 2.4.22 on a
multihomed box acting as a router, with IP Masq. I've searched Google
high and low and cannot find anything related.

I experience very high latency (0.5 to 1.4 sec) and occassional packet
loss when I enable IP Masq, but the latency disappears (to 70ms) when
I disable the IP Masq rule. This occurs both on 2.2.19, using
ipchains, and 2.4.22, using iptables. Basically, latency starts out
normal, jumps when I add the rule, then comes back down when I delete
the rule. This router has been in service for ~2 years with no
problems; the problem started about two weeks ago. Does this look
like a bug/misconfiguration, or could I have gotten rooted? Here's
what happens, starting with empty iptables:

# ping yahoo.com
PING yahoo.com (66.218.71.198) from 68.168.204.54 : 56(84) bytes of
data.
64 bytes from w1.rc.vip.scd.yahoo.com (66.218.71.198): icmp_seq=0
ttl=242 time=76.788 msec
64 bytes from w1.rc.vip.scd.yahoo.com (66.218.71.198): icmp_seq=1
ttl=242 time=77.749 msec

#iptables -A POSTROUTING -t nat -s 10.10.0.0/16 -d ! 10.10.0.0/16 -j
MASQUERADE

# ping yahoo.com
PING yahoo.com (66.218.71.198) from 68.168.204.54 : 56(84) bytes of
data.
64 bytes from w1.rc.vip.scd.yahoo.com (66.218.71.198): icmp_seq=0
ttl=242 time=658.446 msec
64 bytes from w1.rc.vip.scd.yahoo.com (66.218.71.198): icmp_seq=1
ttl=242 time=548.362 msec

#iptables -F -t nat

# ping yahoo.com
PING yahoo.com (66.218.71.198) from 68.168.204.54 : 56(84) bytes of
data.
64 bytes from w1.rc.vip.scd.yahoo.com (66.218.71.198): icmp_seq=0
ttl=242 time=77.325 msec

Thanks to anyone who can provide assistance.

Ted Behling
ted-(E-Mail Removed)

On Wednesday 03 September 2003 06:28, Ted Behling wrote:

> I experience very high latency (0.5 to 1.4 sec) and occassional packet
> loss when I enable IP Masq, but the latency disappears (to 70ms) when
> I disable the IP Masq rule.
[...]
> Basically, latency starts out
> normal, jumps when I add the rule, then comes back down when I delete
> the rule.

Did you make sure that the latency is not a cause of bulk
traffic passing from your internal net to the Internet?
This would explain the latency and why it disappears when
you disable masquerading.

Use ethereal or tcpdump to watch the traffic leaving your
box.


HTH

Ciao, Horst
--
»When pings go wrong (It hurts me too)« E.Clapton/E.James/P.Tscharn