Not sure what I'm seeing here, but when I scp a file through a bastion host into an AWS EC2 server, all other traffic through my home router (Asus RT-AC66R) stops. The mac laptop doing the scp-ing continues the transfer, but no other traffic is allowed. Any external connections fail with a broken pipe. Every other computer on the network is knocked off the internet until the scp transfer is finished. All computers are connected via ethernet, no wifi.
Once the transfer is finished the missed packets suddenly show up with high latencies as this ping before, during and after the scp shows:
64 bytes from ip: icmp_seq=1089 ttl=54 time=95.211 ms 64 bytes from ip: icmp_seq=1090 ttl=54 time=98.233 ms 64 bytes from ip: icmp_seq=1091 ttl=54 time=98.875 ms 64 bytes from ip: icmp_seq=1092 ttl=54 time=96.498 ms Request timeout for icmp_seq 1093 64 bytes from ip: icmp_seq=1093 ttl=54 time=1933.088 ms 64 bytes from ip: icmp_seq=1094 ttl=54 time=931.061 ms Request timeout for icmp_seq 1096 Request timeout for icmp_seq 1097 [...snip...] Request timeout for icmp_seq 1116 Request timeout for icmp_seq 1117 64 bytes from ip: icmp_seq=1095 ttl=54 time=23834.554 ms 64 bytes from ip: icmp_seq=1096 ttl=54 time=22845.598 ms 64 bytes from ip: icmp_seq=1097 ttl=54 time=21854.220 ms 64 bytes from ip: icmp_seq=1098 ttl=54 time=20857.492 ms 64 bytes from ip: icmp_seq=1099 ttl=54 time=19860.796 ms 64 bytes from ip: icmp_seq=1119 ttl=54 time=96.076 ms
The ping is ~100ms, scp starts and packets begin timing out, scp stops and packets show up very delayed then goes back to ~100ms delay.
The ssh/scp config i'm using is:
Host * ServerAliveInterval 120 Host bastion HostName bastion.example.com Host appdev ProxyCommand ssh bastion -W %h:%p HostName 10.20.10.242
Using scp to transfer files to any other server doesn't cause any issues on my network. It's just scp through the bastion that kills all traffic but its own.
- scp from: laptop -> server, no issues
- scp from: laptop -> bastion -> server, all traffic killed
UPDATE: after some debug suggestions from DerfK I discovered using an SSH port redirect through the bastion to the appserver, then scp -P 9999 bigfile.dat localhost:/tmp had no issues! So, what is that telling me? Maybe the -W option of ssh is failing me?