Not sure what I'm seeing here, but when I scp a file through a bastion host into an AWS EC2 server, all other traffic through my home router (Asus RT-AC66R) stops. The mac laptop doing the scp-ing continues the transfer, but no other traffic is allowed. Any external connections fail with a broken pipe. Every other computer on the network is knocked off the internet until the scp transfer is finished. All computers are connected via ethernet, no wifi.
Once the transfer is finished the missed packets suddenly show up with high latencies as this ping before, during and after the scp shows:
64 bytes from ip: icmp_seq=1089 ttl=54 time=95.211 ms
64 bytes from ip: icmp_seq=1090 ttl=54 time=98.233 ms
64 bytes from ip: icmp_seq=1091 ttl=54 time=98.875 ms
64 bytes from ip: icmp_seq=1092 ttl=54 time=96.498 ms
Request timeout for icmp_seq 1093
64 bytes from ip: icmp_seq=1093 ttl=54 time=1933.088 ms
64 bytes from ip: icmp_seq=1094 ttl=54 time=931.061 ms
Request timeout for icmp_seq 1096
Request timeout for icmp_seq 1097
[...snip...]
Request timeout for icmp_seq 1116
Request timeout for icmp_seq 1117
64 bytes from ip: icmp_seq=1095 ttl=54 time=23834.554 ms
64 bytes from ip: icmp_seq=1096 ttl=54 time=22845.598 ms
64 bytes from ip: icmp_seq=1097 ttl=54 time=21854.220 ms
64 bytes from ip: icmp_seq=1098 ttl=54 time=20857.492 ms
64 bytes from ip: icmp_seq=1099 ttl=54 time=19860.796 ms
64 bytes from ip: icmp_seq=1119 ttl=54 time=96.076 ms
The ping is ~100ms, scp starts and packets begin timing out, scp stops and packets show up very delayed then goes back to ~100ms delay.
The ssh/scp config i'm using is:
Host *
ServerAliveInterval 120
Host bastion
HostName bastion.example.com
Host appdev
ProxyCommand ssh bastion -W %h:%p
HostName 10.20.10.242
Using scp to transfer files to any other server doesn't cause any issues on my network. It's just scp through the bastion that kills all traffic but its own.
- scp from: laptop -> server, no issues
- scp from: laptop -> bastion -> server, all traffic killed
UPDATE: after some debug suggestions from DerfK I discovered using an SSH port redirect through the bastion to the appserver, then scp -P 9999 bigfile.dat localhost:/tmp had no issues! So, what is that telling me? Maybe the -W option of ssh is failing me?
scp
just to the bastion host (without tunneling through it?) What about justssh
? (to the server, to the bastion host, to the server via the bastion host tunnel?) If scp to the bastion host does not trigger this, and ssh through the bastion host does trigger it, then there's something weird going on with the proxycommand. If so, try using just a port redirect (egssh bastion -L 9999:10.20.10.242:22
then while that's connected,ssh localhost -p 9999