Hi,
I have attached part of the ettercap log .
I have posted a test file of 40MB.
The delay is 29 second:
from the last file's chunk at 23:56:06
to the response of index2.php at 23:56:35
The nginx's log show:
192.168.18.18 - - [28/Jun/2017:23:56:35 +0200] "POST /index2.php HTTP/1.1" 200 37 "-" "Generic Client"
Nothing retransmits, SElinux isn't installed and apparmor is stopped.
Nothing in dmesg...
Thanks a lot,
ANDREA SORACCHI
+39 329 0512704
System Engineer
+39 0521 24 77 91
soracchi@netbuilder.it
Da: "Payam Chychi" <pchychi@gmail.com>
A: "nginx" <nginx@nginx.org>
Inviato: Mercoledì, 28 giugno 2017 19:56:04
Oggetto: Re: Strange issue after nginx update
On Wed, Jun 28, 2017 at 8:41 AM Andrea Soracchi < soracchi@multidialogo.it > wrote:
Hi,
could you please help me solve this issue? I'm getting crazy!
Before the nginx update my client worked perfectly: it posted files to my website without any delay.
How, after nginx update (ubuntu 16.04 LTS) I've got this issue:
- the client posts files successfully but the answer of the post is delayed.. The more the file is bigger, the more the answer is delayed.
I put a sniffer into the website' server and I noticed that the nginx receives the post but it waits to transfer the file to php-fpm process, so also the answer to the client is delayed
The nginx server is:
nginx/1.10.0 (Ubuntu) and its conf is:
-----
user www-data;
worker_processes auto;
pid /run/nginx.pid;
events {
worker_connections 768;
# multi_accept on;
}
http {
sendfile on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
client_max_body_size 0;
log_not_found off;
server_name_in_redirect off;
client_body_timeout 120s;
autoindex off;
include /etc/nginx/mime.types;
default_type application/octet-stream;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
ssl_prefer_server_ciphers on;
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log info;
gzip on;
gzip_disable "msie6";
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
---
and website's php-fpm conf is:
server {
listen 80;
server_name test.it ;
server_name_in_redirect off;
autoindex off;
client_max_body_size 500m;
index index.html;
root /home/test/test;
location ~ \.(php|html|htm|php3)$ {
try_files $uri 404;
fastcgi_pass unix:/run/php/mdtest-fpm.sock;
include fastcgi_params;
}
}
fastcgi_params config:
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
fastcgi_param REQUEST_URI $request_uri;
fastcgi_param DOCUMENT_URI $document_uri;
fastcgi_param DOCUMENT_ROOT $document_root;
fastcgi_param SERVER_PROTOCOL $server_protocol;
fastcgi_param REQUEST_SCHEME $scheme;
fastcgi_param HTTPS $https if_not_empty;
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
fastcgi_param REMOTE_ADDR $remote_addr;
fastcgi_param REMOTE_PORT $remote_port;
fastcgi_param SERVER_ADDR $server_addr;
fastcgi_param SERVER_PORT $server_port;
#fastcgi_param SERVER_NAME $server_name;
fastcgi_param SERVER_NAME $http_host;
# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param REDIRECT_STATUS 200;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
Thanks a lot,
Andrea
ANDREA SORACCHI
+39 329 0512704
System Engineer
+39 0521 24 77 91
soracchi@netbuilder.it
_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/ nginx
BQ_BEGIN
BQ_END
hi,
can you show the related wireshark data, how long is the response delayed by? and anything else like retransmits or anything else?
any SElinux security throtelling taking place? anything in dmesg?
BQ_BEGIN
BQ_END
--
Payam Tarverdyan Chychi
Network Security Specialist / Network Engineer
_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx
Wed Jun 28 23:56:05 2017 [961174]
TCP 192.168.18.18:39203 --> 192.168.13.33:80 | S (0)
Wed Jun 28 23:56:05 2017 [961198]
TCP 192.168.13.33:80 --> 192.168.18.18:39203 | SA (0)
Wed Jun 28 23:56:05 2017 [961414]
TCP 192.168.18.18:39203 --> 192.168.13.33:80 | A (0)
Wed Jun 28 23:56:05 2017 [961461]
TCP 192.168.18.18:39203 --> 192.168.13.33:80 | AP (205)
POST /index2.php HTTP/1.1.
User-Agent: Generic Client.
Host: servertest.it.
Accept: */*.
Content-Length: 54614205.
Content-Type: application/x-www-form-urlencoded.
Expect: 100-continue.
.
Wed Jun 28 23:56:05 2017 [961468]
TCP 192.168.13.33:80 --> 192.168.18.18:39203 | A (0)
Wed Jun 28 23:56:05 2017 [961584]
TCP 192.168.13.33:80 --> 192.168.18.18:39203 | AP (25)
HTTP/1.1 100 Continue.
.
Wed Jun 28 23:56:05 2017 [961719]
TCP 192.168.18.18:39203 --> 192.168.13.33:80 | A (0)
Wed Jun 28 23:56:05 2017 [961830]
TCP 192.168.18.18:39203 --> 192.168.13.33:80 | A (1368)
_args=%7B%22action%22%3A%22sendposta%22%2C%22iomode%22%3A%22json%22%2C%22auth%22%3A%7B%22user%22%3A%22soracchi%40netbuilder.it%22%2C%22pass%22%3A%2205a671c66aefea124cc08b76ea6d30bb%22%7D%2C%22memo%22%3A%22TEST+PIGC%21%21%21%22%2C%22notify_email%22%3A%22soracchi%40netbuilder.it%22%2C%22posta_options%22%3A%7B%22mode%22%3A%22ARCHIVE%22%2C%22file_descriptor%22%3A%22Param.xml%22%2C%22delivery_type%22%3A%22PRIORITARIA%22%2C%22print_color%22%3A%22B%5C%2FN%22%2C%22page_mode%22%3A%22BOTH%22%2C%22staple%22%3A%22false%22%2C%22sender%22%3A%7B%22indirizzo%22%3A%22Via+Zarotto+63%22%2C%22cap%22%3A%2243123%22%2C%22citta%22%3A%22Parma%22%2C%22provincia%22%3A%22PR%22%2C%22nazione%22%3A%22Italia%22%7D%7D%2C%22files%22%3A%5B%7B%22name%22%3A%22archivio.zip%22%2C%22size%22%3A40960000%2C%22data%22%3A%22AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Wed Jun 28 23:56:05 2017 [961857]
TCP 192.168.18.18:39203 --> 192.168.13.33:80 | A (1368)
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Wed Jun 28 23:56:05 2017 [961861]
TCP 192.168.13.33:80 --> 192.168.18.18:39203 | A (0)
Wed Jun 28 23:56:05 2017 [961880]
TCP 192.168.18.18:39203 --> 192.168.13.33:80 | A (1368)
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
...
...
...
Wed Jun 28 23:56:06 2017 [751727]
TCP 192.168.18.18:39203 --> 192.168.13.33:80 | A (1368)
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Wed Jun 28 23:56:35 2017 [73242]
TCP 192.168.13.33:80 --> 192.168.18.18:39203 | AP (176)
HTTP/1.1 200 OK.
Server: nginx/1.10.0 (Ubuntu).
Date: Wed, 28 Jun 2017 21:56:35 GMT.
Content-Type: text/html.
Transfer-Encoding: chunked.
Connection: keep-alive.
.
2.
ok.
0.
.
Wed Jun 28 23:56:35 2017 [73674]
TCP 192.168.18.18:39203 --> 192.168.13.33:80 | FA (0)
Wed Jun 28 23:56:35 2017 [73723]
TCP 192.168.13.33:80 --> 192.168.18.18:39203 | FA (0)
Wed Jun 28 23:56:35 2017 [73886]
TCP 192.168.18.18:39203 --> 192.168.13.33:80 | A (0)
_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx
