Proxmox cluster node DOS' my entire network when running

Kortecoder

New Member
May 2, 2018
3
0
1
29
I have installed Proxmox on top of Debian and in the process there was a fair bit of firmware conflicts and issues but I think I eventually got everything into place and proper working order in the end. That would be its own post should it need be to dived into deeper but for now the TLDR of this section is that I am a Proxmox through apt-get on Debian install.

I know that there is supposed to be some broadcasted or multicasted traffic taking place between proxmox nodes but I only have the one node because it is all that I need in my little home lab setup for the sake of hosting VM game servers and testing out new OS's in the future etc.

However once my server gets online, it sends out so much traffic that I cannot do anything on my network from device to device or externally as well. The most offending wireshark trace I have captured so far had 1.5 million broadcast and IPv4/6_Multicasting packets detected within 91 seconds.

Neither my router nor my switch are poor hardware for what I am trying to do but neither are able to keep up all the same and I can see the issue is coming from the server itself because of my Wireshark traces and the fact that my switch lights up like a Christmas tree right after I turn the networking service on on my server and it goes back to normal ACK flashes after the networking service is stopped.

I have a TP-Link Archer CS 5400 router and a TP-Link TL-SG1016D unmanaged switch (this here might be my whole issue I am afraid which would suck considering I bought this switch no more than a month ago).

The hardware itself that I am running this on is a Dell Poweredge T410 server with 2 Xeon 5350's and 32 GB of ECC Ram, a pair of 300 GB raptor drives in raid 1 for a slightly redundant boot drive, and a pair of 1 TB HDD"s also in Raid 1 for mass storage. The 2 integrated NICS are Broadcom NetXstreme II BCM5716 Gigabit ethernet ports (and this would be where the firmware issues came into play because the firmware for said Nics that I put into place using a thumbdrive and their .deb files conflicted with the files trying to be put into place with/by Proxmox VE firmware) ((There was also some other conflicts with packages beyond the nic firmware but I got those taken care of as well and I highly doubt that they are part of the issue here because the conflicts were with the non-free debian firmware packages for things like AMD graphics drivers etc))

So whenever I boot the server it doesn't start as online despite my startup scripting attempts to do otherwise. I have found commands to get the system back online the hard way after booting up and I put them in a bash script in the init.d file but they dont always seem to work (again another thread topic if need be but I wanted to mention the need for the scripts/commands anyways because of the following) so I have to run "service networking restart" manually after boot time to get the system back online fully and its at that point that the ethernet ports go from being labelled "unmanaged" in the networking symbol in the upper right corner of the desktop to disappearing entirely but I at least have access to the networking settings for vmbr0 outside of the terminal and all of the route and ifconfig commands etc.

So at this point I have tried enabling IGMP snooping in my router and I know there is supposed to be some shared traffic for the sake of inter proxmox node communications but I cannot imagine that so much chatter coming off the nodes that they DOS the rest of my LAN is expected behavior.

I have read through a handful of articles around the forum and tried some various troubleshooting steps with varying degrees of success but nothing that completely handles the issue or was set up to be permanent changes so at this point I figured it was time to reach out to the community for help. So far I have tried the following troubleshooting/workaround steps:
  • Disabling Multicasting from being possible with the en0 and en1 and vmbr0 interfaces and network bridges respectfully. Could never successfully disable Broadcast though to make it an all encompassing solution
  • Like I said, I enabled IGMP snooping like what as suggested in the Proxmox Multicasting wiki page, with no discernable change or benefits.
  • I tried to edit my IPTable and IP6Table rules to drop all incoming and outgoing multicasting/broadcast traffic, again with mixed results because even after the rules were in place, I was still seeing the traffic coming from my Dell server in the wireshark trace being made on my laptop and I was still seeing a packet drop rate of 90+% in my attempts to ping 8.8.8.8.
I do have 3 different Wireshark network traces I could attach if need be but I don't know for sure how safe/smart that is to do in this situation so I am holding off on those for now.

What I am attaching is my ifconfig and my route table since I think my localnet's gateway being 0.0.0.0 might be a part of the issue here but my past attempts to change the address of the gateway to remediate the issue have so far been unsuccessful. I don't have the commands I tried to use to do that with but if they would be handy to know them Im sure I could dig them out of my bash history if I fired up the box.

I would like to tackle the issue at the root and try to better understand what all Proxmox does networking wise and why so I know what might be causing this behavior and address it there instead of trying to patchworkly block the adverse behavior in the ways that I have listed above.

At this point am I just out of luck without a managed switch that is capable of putting my Proxmox node into its own separate VLAN or capable of blocking all of that kind of traffic on its end through the ports themselves?

Also my apologies if this is a lot of only questionably helpful info but I work tech support for a living and while I am at work, I would much rather have some extra, potentially irrelevant, information that possibly not enough information to get started on an issue at all. That being said let me know if the networking traces would be helpful/safe or what other information might be needed/helpful.
 

Attachments

  • HelpMe.txt
    2.5 KB · Views: 2
Proxmox does not start any network traffic after installation, so this must be something else ...
 
I mean it only started after the proxmox install, the vanilla Debian install had no such behavior....

Thank you for the clarification/confirmation that this is not expected behavior.

I will see if I can find a utility to list what services are sending out what traffic from the host.

If you have any ideas as to what utility that would be and if it would already be present on the system since apt-get to install something new is out of the question, it would be appreciated.
 
Okay so I did a bit more digging and even with everything proxmox related stopped and not a single service listed in lsof -i the behavior continues and I still stand by the fact that the behavior began after install so I my only working hypothesis at this point is that the install made some changes to the OS or my networking configuration itself some how to start the flood of broadcast and multicasting traffic.

Dietmar are you sure that the multicasting behavior/notes mentioned here https://pve.proxmox.com/wiki/Multicast_notes dont have a part to play in this?

I know there is nothing running prox or pve wise according to ps ax | grep "prox|pve" but nothing short of stopping the networking service or shutting down the server stops the behavior completely right now.
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!