Am I under attack? bad packet ID

[Smurff 0]

Am I under attack, I have been seeing way too much of this for the past week now.

[Gaechka 7]

I have the same messages very very often in my logs for some months already. I also have this message almost everyday: "Authenticate/Decrypt packet error: packet HMAC authentication failed". I have started to get these messages at the time I have started using Eddie 2.2 or 2.3 as far as I remember. However I'm not sure if it has any bad influence on the connection... Still I wonder what these messages are all about and should I do something about them.

[Lee47 23]

I have been getting these error messages within my pfsense set up for past few months also, it only occurs during p2p torrents though. Have both you guys noticed this or do you get it during normal surfing ?

 

My bad packets also occur on netherland servers or even any for that matter, I have checked into this error but not much info or a fixes available only that it has something to do with mssfix settings my setting is currently 1440 but have tried 1300-1400 and nothing has fixed it.

 

The bad packet causes a loss of signal and can cause p2p torrents performance to drop tempory.

[Gaechka 7]

I have been getting these error messages within my pfsense set up for past few months also, it only occurs during p2p torrents though. Have both you guys noticed this or do you get it during normal surfing ?

 

My bad packets also occur on netherland servers or even any for that matter, I have checked into this error but not much info or a fixes available only that it has something to do with mssfix settings my setting is currently 1440 but have tried 1300-1400 and nothing has fixed it.

 

The bad packet causes a loss of signal and can cause p2p torrents performance to drop tempory.

 

I have also noticed that these error messages occur during torrenting and also during online gaming. So I guess that maybe it is somehow related to the traffic intensity: more traffic - more errors?

 

Additional info:

 

-  I have these error messages both under Windows7 64bit and Linux Mint Debian Edition 64bit.

-  I usually connect to netherland or german AirVPN servers under UDP-443.

-  I do NOT use wi-fi

-  Despite these errors I never had any disconnects.

 

P.S. - There was a time when I never had these errors ))) My hardware/software system configuration haven't changed since...

[Staff 10014]

Please see for example here: https://airvpn.org/topic/3773-pls-help-strange-logs/?do=findComment&comment=3784

 

It would be a good habit to search the forums (good search functions are available) before posting questions that have been already answered multiple times.

 

Kind regards

[Lee47 23]

To Air staff:

 

Regarding the info do you feel these bad packets could be an ISP monitoring or using deep packet inspection ?

 

I get the issue on pretty much all Air servers and only during p2p usage.

[Lee47 23]

Gaechka:

 

thanks good info in some ways am glad am not the only one! I get them during p2p use only also. Have tried many software changes but nothing really works, if you can it would be great if you could try Airs suggestions ie connect via TCP or try a different server other then germany/netherland?

 

See if it improves, I am under a pfsense router set up so bit tricky to adjust the system but will try.

 

I get the impression its not to do with windows or linux or software more so a router or config setting, but it would be great to find a fix to these bad packets and replay errors.

[Staff 10014]

To Air staff:

 

Regarding the info do you feel these bad packets could be an ISP monitoring or using deep packet inspection ?

 

I get the issue on pretty much all Air servers and only during p2p usage.

 

Hello!

 

Monitoring or DPI in themselves would not cause that. Injections attempts, replay attacks or just very normal packet errors in UDP will cause that. Please see the aforementioned post for more information.

 

Kind regards

[go558a83nk 364]

in my experience this happens when my MTU settings are incorrect.  When I just leave it alone, no problem.

 

I run VPN from router, BTW.

[Lee47 23]

I think you are correct these bad packets/replay errors may possibly be caused by the router or modem (or both) MTU or MSS settings.

 

I did a bit of googling and found this thread about possible MTU issues:

http://community.virginmedia.com/t5/Up-to-30Mb-Speed/Modem-Only-Mode-MTU-SIZE/td-p/1670644

 

Now I am on a different isp and my Router is my Pfsense system to the above but check legacy1 reply he gave some good info on checking if your MTU/MSS setting is too low or incorrect.

 

If you goto this link here:

 

http://www.speedguide.net/

 

And hit TCP analyzer button (in mid top area where 6 buttons are) and let it run the test it will report your MTU/MSS and advice you further.

 

My MTU is 1340 and MSS is 1360 and according to that site very low and should be higher to improve throughput and performance, changing these settings within my router(pfsense box) has not helped however but this could be due to my pfsense set up.

 

Perhaps it is worth the topic starter and Gaechka checking the speedguide website to confirm they too have low MTU/MSS numbers?

 

Then at least we can confirm were on the right track.....

[Gaechka 7]

For the last 3 days I was only connecting to UK, Sweden and Spain AirVPN servers instead of Netherland and German (as I usually do) and I did NOT have any error messages even during torrenting and gaming. That is interesting.

 

 

f you goto this link here:

 

http://www.speedguide.net/

 

And hit TCP analyzer button (in mid top area where 6 buttons are) and let it run the test it will report your MTU/MSS and advice you further.

 

My MTU is 1340 and MSS is 1360 and according to that site very low and should be higher to improve throughput and performance, changing these settings within my router(pfsense box) has not helped however but this could be due to my pfsense set up.

 

Perhaps it is worth the topic starter and Gaechka checking the speedguide website to confirm they too have low MTU/MSS numbers?

 

Then at least we can confirm were on the right track.....

 

I have tried TCP analyzer from http://www.speedguide.net/

 

While I am connected to AirVPN - TCP Analizer writes: 

MTU = 1392
MTU is not fully optimized for broadband. Consider increasing your MTU to 1500 for better throughput. If you are using a router, it could be limiting your MTU regardless of Registry settings.
MSS = 1352
MSS is not optimized for broadband. Consider increasing your MTU value.

 

When I am NOT connected to AirVPN - TCP Analizer writes:

MTU = 1400
MTU is not fully optimized for broadband. Consider increasing your MTU to 1500 for better throughput. If you are using a router, it could be limiting your MTU regardless of Registry settings.
MSS = 1360
MSS is not optimized for broadband. Consider increasing your MTU value.

 

BUT:

 

-  in my router settings I have MTU manually set to 1500. I have also noticed that in my router setting I also have "Adjust TCP-MSS automatically" set to YES.

 

-  when I run in command-prompt under Windows "netsh interface ipv4 show subinterfaces" it shows that all my network interfaces have MTU 1500

 

-  when I am not connected to AirVPN and I try to "ping -f -l [packetsize] [MyISP-Gateway-IP] (under Windows) - the Largest non-fragmented packetsize which I can send is 1472 which is snow that my MTU is 1500 between me and my ISP. But when I try to ping some other sites on the internet (e.g. google.com) - the Largest non-fragmented packetsize which I can send is 1372 (MTU=1400).

 

-  when I am connected to AirVPN and I try to "ping -f -l [packetsize]" - the Largest non-fragmented packetsize which I can send to any site (e.g. 10.4.0.1 (AirDNS), Airvpn.org or google.com & etc.) is 1472 which is snow that my MTU is 1500.

[Lee47 23]

Thanks for the info yeah when connected to Air I get the same results now.

 

So it seems connecting to uk/spain/sweden servers fixed your issue fully? I did not have much joy but as it stands I will just ignore these errors it does not seem to really cause too much issue for now.