NAT taking 100% (single thread) CPU

[mightyiam]

Following up from ​this thread.

let's see how much of the questions there, I can answer.

Attached are the port forward rules as a screenshot.

ip r on the host should give the routing, right?

default via 192.168.0.1 dev eth0  proto static  metric 100 
10.10.10.0/24 dev vboxnet1  proto kernel  scope link  metric 100 
192.168.0.0/24 dev eth0  proto kernel  scope link  metric 100

and ip r on the guest should give the routing on the guest:

default via 10.0.2.2 dev eth0  metric 100 
10.0.2.0/24 dev eth0  proto kernel  scope link  src 10.0.2.15 
10.10.10.0/24 dev eth1  proto kernel  scope link  src 10.10.10.10

Does this answer your questions?

[mightyiam]

NAT port forwarding

[Valery Ushakov]

Please, can you provide guest-side packet captures for both NAT and host-only interfaces, taken when the VM exhibits the problem.

[mightyiam]

@vushakov, I have captured packets as you requested. But they hold sensitive information. I don't think I can provide them.

Is there any chance you'll be able to tell me what to look for, using Wireshark, or anything?

I know this isn't ideal, but this seems to be the best I can do about it.

Can you add me to cc, please?

[Valery Ushakov]

You can limit the capture so that only headers are captured, but not data. 64 bytes for 14 bytes of ethernet, 20 bytes of IP header, and 20 bytes of TCP header should be enough. Since UDP header is only 8 bytes, the capture will contain some UDP data, though.

Also, instead of attaching captures here you can also provide them to me directly: valery dot ushakov at oracle dot com.

[mightyiam]

@vushakov, I couldn't find documentation on how to limit the size of captured packets.

Can you please refer me to something?

[mightyiam]

Confirming this on 4.3.30-101610~Ubuntu~raring, as well.

[Valery Ushakov]

In wireshark Capture Options dialogue there's a "Limit each packet to ... bytes" checkbox and when you enable it, you can select the number in the spinbox.

[mightyiam]

I've worked around this by setting up my own SSH port forwards.

It seems that the issue is triggered by actually using the built in port forwards.

[Valery Ushakov]

What do you mean by "built-in" port-forwarding?

Is the problem triggered when you try to use ssh port-forwarding over NAT?

Why do you need it in the first place btw (restricted to localhost), when the guest is immediately accessible via host-only?