[7.480][BUG][FIXED] Large downloads via Proxy are cut off prematurely

I think this may be a rehash of an earlier bug report (from version 7.460, I think):

When I attempt to download large files via HTTP, say, a 900MB ISO file... I get maybe 80MB or so of the file (it varies somewhat) before IE or Firefox saves the file, claiming it's done... but it's not, the whole file did not download. This is with the HTTP proxy enabled, running in transparent mode; THe AV settings are set to skip scanning a file over 100MB in size, so the AV should not be the problem -- the typical Astaro Download page is not displayed, the download just starts, as it should with it set this way. Downloads from the same sites on 7.404 worked fine. I checked all the logs (I mean everything). The only event I can see that coincides from a time standpoint with the downloads dying is the up2date daemon checking for a pattern (or system, can't remember now) update... and there wasn't one available, so it wasn't like a lot of bandwidth was consumed, etc. This sounds kind of like what I recall reading about earlier.

I'll post some log entries up here when I get time to pull them from the test system I was using.

Parents

0 Astaro Beta Bot over 15 years ago

Astaro Beta Report
--------------------------------
Version: 7.480
Type: BUG
State: FIXED
Reporter: BrucekConvergent
Contributor: 
MantisID: 
--------------------------------

0 Billybob over 15 years ago in reply to Astaro Beta Bot

Very interesting. I download astaro ISO via http proxy (transparent) without any problem and its fairly large 500+M. I will try to download some other large files and see.[;)]
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Billybob over 15 years ago in reply to RFCat_vk_01

Ian, what site are you using for downloading http astro.de or astaro.com? From astaro.com I can download at full 10M (my line speed) with IPS on and proxy active.
I do have to agree though that the proxy doesn't seem as snappy as it was in 7.470. Maybe just my imagination but the last version of http proxy seemed the stablest with least problems at least for me.

This could be related to more aggressive IPS also since it was toned down quite a bit in 7.470. But then you don't see any difference with IPS on or off in your testing so I don't know[:S]

Maybe bruce can narrow it down some more.
Regards
Bill.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 15 years ago in reply to Billybob

Hi billybob,
I was using both ftp sites .de and .com

While trying out various boxes as ASGs the low power version, I found I can't get a stable box from startup until I disable IPS and wait for a couple of hours before re-enabling IPS.

My quad core 9950 doesn't have any problems when started from cold.

I haven't tried the download without using the proxy. Something for later today.

Ian M
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 utm_kid over 15 years ago in reply to RFCat_vk_01

Hi ,

smiler issues i am facing @ https://community.sophos.com/products/unified-threat-management/astaroorg/f/98/t/68420
but on server i was able to download 500+ mb with wget but there was isp problem and when i tryed wget -c it give a similer problem

Thanks
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 15 years ago in reply to utm_kid

Hi folks,
performed series tests tonight without the http proxy and with IPS enabled.
The ASG I performed these tests on is the AMD x2 be2300 version with 2 Intel NICs. Yesterday's tests were on the Atom 330 with hyperthreading enabled.

Used the W 7 64 bit PC for the downloads.

Downloaded the full ISO from one Astaro site and the up2date package from the other at the same time. Audio streaming running on Vista 64 with webadmin open and displaying live packet filter page.

ISO package speeds varied from 50kB/s to 410kB/s.
up2date package speeds varied from 45kB/s to 150kB/s.
No dropouts.
VoIP was not very good during this trial. I have QOS enabled on the external interface for both VoIP phones (ATAs). I was wondering do I enable QOS on the netgear switch because the internal interface uses VLANs?

Regards
Ian M
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 15 years ago in reply to RFCat_vk_01

My failures have only happened when the proxy is enabled... IPS doesn't show anything in the logs.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 15 years ago in reply to BrucekConvergent

Did further testing over the weekend; failures only occur when the HTTP Proxy is enabled. I downloaded 3GB of data overnight with the proxy disabled, no problems. Using the same download site (Not Astaro, another vendor for a DLP system we're evaluating) with proxy enabled, invariably failed at 90MB or so.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 15 years ago in reply to BrucekConvergent

Try the same thing with IPS disabled.

Ian M
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 15 years ago in reply to RFCat_vk_01

I guess you're saying it's an IPS / Proxy interaction issue?

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 15 years ago in reply to BrucekConvergent

I posted this in another thread, think it's relevant to this one...

This line: 2009:08:18-19:30:01 fw1-on-house /usr/sbin/cron[30544]: (root) CMD (/sbin/audld.plx --trigger)

is what I see when my proxy downloads fail. The time on mine coincides perfectly with the failure.

As a follow up... I did note if I set the pattern update to 30 minutes rather than 15, my downloads waited longer to fail (at the 30 minute mark)... not sure why Astaro is not acknowledging this issue.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Billybob over 15 years ago in reply to BrucekConvergent

I know that astaro wants to update all the IPS and new av definitions as soon as possible but I think they will have to change the backend behavior a little somehow so that the reloading of services doesn't cause that minor delay which is not noticeable in regular browsing but if you are downloading something or are streaming something, it is really a pain.

Broken stream I can understand but I am still confused as to why the http/ftp downloads just stop. Most servers support broken downloads so is the client not sending the right request after the session is interrupted?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 Billybob over 15 years ago in reply to BrucekConvergent

I know that astaro wants to update all the IPS and new av definitions as soon as possible but I think they will have to change the backend behavior a little somehow so that the reloading of services doesn't cause that minor delay which is not noticeable in regular browsing but if you are downloading something or are streaming something, it is really a pain.

Broken stream I can understand but I am still confused as to why the http/ftp downloads just stop. Most servers support broken downloads so is the client not sending the right request after the session is interrupted?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

No Data