{"action":"created","issue":{"url":"https://api.github.com/repos/xelerance/Openswan/issues/156","labels_url":"https://api.github.com/repos/xelerance/Openswan/issues/156/labels{/name}","comments_url":"https://api.github.com/repos/xelerance/Openswan/issues/156/comments","events_url":"https://api.github.com/repos/xelerance/Openswan/issues/156/events","html_url":"https://github.com/xelerance/Openswan/issues/156","id":118896311,"number":156,"title":"IPsec Tunnel Deterministic Delay","user":{"login":"japita-se","id":6206959,"avatar_url":"https://avatars.githubusercontent.com/u/6206959?v=3","gravatar_id":"","url":"https://api.github.com/users/japita-se","html_url":"https://github.com/japita-se","followers_url":"https://api.github.com/users/japita-se/followers","following_url":"https://api.github.com/users/japita-se/following{/other_user}","gists_url":"https://api.github.com/users/japita-se/gists{/gist_id}","starred_url":"https://api.github.com/users/japita-se/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/japita-se/subscriptions","organizations_url":"https://api.github.com/users/japita-se/orgs","repos_url":"https://api.github.com/users/japita-se/repos","events_url":"https://api.github.com/users/japita-se/events{/privacy}","received_events_url":"https://api.github.com/users/japita-se/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-11-25T18:27:31Z","updated_at":"2015-11-25T18:33:27Z","closed_at":null,"body":"\r\n0\r\ndown vote\r\nfavorite\r\nI setup a site-to-site IPSec tunnel using OpensWan.\r\nI noticed that there is always a delay of 15 sec betwenn the phase 1 and phase 2 as shown in this tcpdump. Does anybody know why?\r\n\r\n`17:50:41.638828 IP remotepeer.40237 > miyazaki.47087: Flags [S.], seq 539598201, ack 3547092391, win 5792, options [mss 1380,sackOK,TS val 1866473592 ecr 1322888897,nop,wscale 3], length 0\r\n17:50:41.695067 IP remotepeer.40237 > miyazaki.47087: Flags [.], ack 593, win 872, options [nop,nop,TS val 1866473647 ecr 1322888954], length 0\r\n17:50:41.897514 IP remotepeer.40237 > miyazaki.47087: Flags [P.], seq 1:161, ack 593, win 872, options [nop,nop,TS val 1866473850 ecr 1322888954], length 160\r\n17:50:41.952144 IP remotepeer.40237 > miyazaki.47087: Flags [P.], seq 161:426, ack 593, win 872, options [nop,nop,TS val 1866473905 ecr 1322889212], length 265\r\n17:50:56.897125 IP remotepeer.40237 > miyazaki.47087: Flags [F.], seq 426, ack 593, win 872, options [nop,nop,TS val 1866488851 ecr 1322889267], length 0\r\n17:50:56.952014 IP remotepeer.40237 > miyazaki.47087: Flags [.], ack 594, win 872, options [nop,nop,TS val 1866488906 ecr 1322904212], length 0`"},"comment":{"url":"https://api.github.com/repos/xelerance/Openswan/issues/comments/159695802","html_url":"https://github.com/xelerance/Openswan/issues/156#issuecomment-159695802","issue_url":"https://api.github.com/repos/xelerance/Openswan/issues/156","id":159695802,"user":{"login":"letoams","id":3003897,"avatar_url":"https://avatars.githubusercontent.com/u/3003897?v=3","gravatar_id":"","url":"https://api.github.com/users/letoams","html_url":"https://github.com/letoams","followers_url":"https://api.github.com/users/letoams/followers","following_url":"https://api.github.com/users/letoams/following{/other_user}","gists_url":"https://api.github.com/users/letoams/gists{/gist_id}","starred_url":"https://api.github.com/users/letoams/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/letoams/subscriptions","organizations_url":"https://api.github.com/users/letoams/orgs","repos_url":"https://api.github.com/users/letoams/repos","events_url":"https://api.github.com/users/letoams/events{/privacy}","received_events_url":"https://api.github.com/users/letoams/received_events","type":"User","site_admin":false},"created_at":"2015-11-25T18:33:26Z","updated_at":"2015-11-25T18:33:26Z","body":"On Wed, 25 Nov 2015, japita-se wrote:\n\n> Subject: [Openswan] IPsec Tunnel Deterministic Delay (#156)\n>\n\n> I setup a site-to-site IPSec tunnel using OpensWan.\n> I noticed that there is always a delay of 15 sec betwenn the phase 1 and phase 2 as shown in this tcpdump. Does\n> anybody know why?\n> \n> 17:50:41.638828 IP remotepeer.40237 > miyazaki.47087: Flags [S.], seq 539598201, ack 3547092391, win 5792,\n> options [mss 1380,sackOK,TS val 1866473592 ecr 1322888897,nop,wscale 3], length 0\n> 17:50:41.695067 IP remotepeer.40237 > miyazaki.47087: Flags [.], ack 593, win 872, options [nop,nop,TS val\n> 1866473647 ecr 1322888954], length 0\n> 17:50:41.897514 IP remotepeer.40237 > miyazaki.47087: Flags [P.], seq 1:161, ack 593, win 872, options\n> [nop,nop,TS val 1866473850 ecr 1322888954], length 160\n> 17:50:41.952144 IP remotepeer.40237 > miyazaki.47087: Flags [P.], seq 161:426, ack 593, win 872, options\n> [nop,nop,TS val 1866473905 ecr 1322889212], length 265\n\nLooks like there was fragmentation at the UDP layer there? Perhaps the\nfragment got lost?\n\n> 17:50:56.897125 IP remotepeer.40237 > miyazaki.47087: Flags [F.], seq 426, ack 593, win 872, options [nop,nop,TS\n> val 1866488851 ecr 1322889267], length 0\n> 17:50:56.952014 IP remotepeer.40237 > miyazaki.47087: Flags [.], ack 594, win 872, options [nop,nop,TS val\n> 1866488906 ecr 1322904212], length 0\n\nlibreswan supports IKEv1 and IKEv2 fragmentation so UDP packets won't\nneed to fragment. Perhaps that might help you?\n\nPaul\n"}}