unusual network traffic to/from fog client

altitudehack · Nov 3, 2021, 2:35 AM

A user remoting in over the VPN is complaining of slow performance and network drops. Looking at the ssl firewall traffic, I noticed an odd pattern of a periodic data transfer between the laptop and the fog server:

Time       Sent Bytes   Received Bytes
11-02 20:49:12	142156	9628152
11-02 20:46:03	141236	9628152
11-02 20:44:13	140556	9628152
11-02 20:42:04	141316	9628152
11-02 20:40:04	142356	9628152
11-02 20:37:28	141636	9628152
11-02 20:34:47	140556	9628152
11-02 20:32:16	141316	9628152
11-02 20:29:04	138676	9628152
11-02 20:27:56	138756	9628152
11-02 20:26:07	138716	9628152
11-02 20:23:46	138636	9628152
11-02 20:21:23	138716	9628152
11-02 20:20:06	138716	9628152
11-02 20:17:58	138756	9628152
11-02 20:16:40	138636	9628152
11-02 20:14:58	139116	9628152
11-02 20:12:45	139156	9628152
11-02 20:10:26	140716	9628152
11-02 20:07:29	139956	9628152

I don’t see any pending tasks for the host, and snapins are all marked as completed. Any idea what would cause a ~10M file to transfer every two minutes?

Sebastian Roth · Nov 3, 2021, 7:18 AM

@altitudehack Could the the fog-client updater failing over and over in every cycle. Grab the fog.log file (usually in C:\fog.log) in that machine and post the last 200 lines here in the forums.

altitudehack · Nov 3, 2021, 1:05 PM

I think you nailed it:

---------------------------------ClientUpdater--------------------------------
------------------------------------------------------------------------------
 11/3/2021 7:04:09 AM Client-Info Client Version: 0.11.19
 11/3/2021 7:04:09 AM Client-Info Client OS:      Windows
 11/3/2021 7:04:09 AM Client-Info Server Version: 1.5.9.98
 11/3/2021 7:04:10 AM Middleware::Response ERROR: Unable to get subsection
 11/3/2021 7:04:10 AM Middleware::Response ERROR: Object reference not set to an instance of an object.

------------------------------------------------------------------------------
----------------------------------TaskReboot----------------------------------
--
---------------------------------ClientUpdater--------------------------------
------------------------------------------------------------------------------
 11/3/2021 7:27:59 AM Client-Info Client Version: 0.11.19
 11/3/2021 7:27:59 AM Client-Info Client OS:      Windows
 11/3/2021 7:27:59 AM Client-Info Server Version: 1.5.9.98
 11/3/2021 7:27:59 AM Middleware::Response Success
 11/3/2021 7:27:59 AM Middleware::Communication Download: http://fogserver/fog/client/SmartInstaller.exe
 11/3/2021 7:28:00 AM Data::RSA FOG Project cert found
 11/3/2021 7:28:00 AM ClientUpdater ERROR: Update file is not authentic
------------------------------------------------------------------------------
--
---------------------------------ClientUpdater--------------------------------
------------------------------------------------------------------------------
 11/3/2021 7:29:27 AM Client-Info Client Version: 0.11.19
 11/3/2021 7:29:27 AM Client-Info Client OS:      Windows
 11/3/2021 7:29:27 AM Client-Info Server Version: 1.5.9.98
 11/3/2021 7:29:27 AM Middleware::Response Success
 11/3/2021 7:29:27 AM Middleware::Communication Download: http://fogserver/fog/client/SmartInstaller.exe
 11/3/2021 7:29:27 AM Data::RSA FOG Project cert found
 11/3/2021 7:29:27 AM ClientUpdater ERROR: Update file is not authentic
------------------------------------------------------------------------------
--
---------------------------------ClientUpdater--------------------------------
------------------------------------------------------------------------------
 11/3/2021 7:30:48 AM Client-Info Client Version: 0.11.19
 11/3/2021 7:30:48 AM Client-Info Client OS:      Windows
 11/3/2021 7:30:48 AM Client-Info Server Version: 1.5.9.98
 11/3/2021 7:30:48 AM Middleware::Response Success
 11/3/2021 7:30:48 AM Middleware::Communication Download: http://fogserver/fog/client/SmartInstaller.exe
 11/3/2021 7:30:48 AM Data::RSA FOG Project cert found
 11/3/2021 7:30:48 AM ClientUpdater ERROR: Update file is not authentic
------------------------------------------------------------------------------
--
---------------------------------ClientUpdater--------------------------------
------------------------------------------------------------------------------
 11/3/2021 7:33:02 AM Client-Info Client Version: 0.11.19
 11/3/2021 7:33:02 AM Client-Info Client OS:      Windows
 11/3/2021 7:33:02 AM Client-Info Server Version: 1.5.9.98
 11/3/2021 7:33:02 AM Middleware::Response Success
 11/3/2021 7:33:02 AM Middleware::Communication Download: http://fogserver/fog/client/SmartInstaller.exe
 11/3/2021 7:33:02 AM Data::RSA FOG Project cert found
 11/3/2021 7:33:02 AM ClientUpdater ERROR: Update file is not authentic
------------------------------------------------------------------------------
--
---------------------------------ClientUpdater--------------------------------
------------------------------------------------------------------------------
 11/3/2021 7:34:16 AM Client-Info Client Version: 0.11.19
 11/3/2021 7:34:16 AM Client-Info Client OS:      Windows
 11/3/2021 7:34:16 AM Client-Info Server Version: 1.5.9.98
 11/3/2021 7:34:16 AM Middleware::Response Success
 11/3/2021 7:34:16 AM Middleware::Communication Download: http://fogserver/fog/client/SmartInstaller.exe
 11/3/2021 7:34:16 AM Data::RSA FOG Project cert found
 11/3/2021 7:34:16 AM ClientUpdater ERROR: Update file is not authentic
------------------------------------------------------------------------------
--
---------------------------------ClientUpdater--------------------------------
------------------------------------------------------------------------------
 11/3/2021 7:36:24 AM Client-Info Client Version: 0.11.19
 11/3/2021 7:36:24 AM Client-Info Client OS:      Windows
 11/3/2021 7:36:24 AM Client-Info Server Version: 1.5.9.98
 11/3/2021 7:36:24 AM Middleware::Response Success
 11/3/2021 7:36:24 AM Middleware::Communication Download: http://fogserver/fog/client/SmartInstaller.exe
 11/3/2021 7:36:24 AM Data::RSA FOG Project cert found
 11/3/2021 7:36:24 AM ClientUpdater ERROR: Update file is not authentic
------------------------------------------------------------------------------
--
---------------------------------ClientUpdater--------------------------------
------------------------------------------------------------------------------
 11/3/2021 7:38:26 AM Client-Info Client Version: 0.11.19
 11/3/2021 7:38:26 AM Client-Info Client OS:      Windows
 11/3/2021 7:38:26 AM Client-Info Server Version: 1.5.9.98
 11/3/2021 7:38:26 AM Middleware::Response Success
 11/3/2021 7:38:26 AM Middleware::Communication Download: http://fogserver/fog/client/SmartInstaller.exe
 11/3/2021 7:38:26 AM Data::RSA FOG Project cert found
 11/3/2021 7:38:26 AM ClientUpdater ERROR: Update file is not authentic
------------------------------------------------------------------------------
--
---------------------------------ClientUpdater--------------------------------
------------------------------------------------------------------------------
 11/3/2021 7:40:10 AM Client-Info Client Version: 0.11.19
 11/3/2021 7:40:10 AM Client-Info Client OS:      Windows
 11/3/2021 7:40:10 AM Client-Info Server Version: 1.5.9.98
 11/3/2021 7:40:10 AM Middleware::Response Success
 11/3/2021 7:40:10 AM Middleware::Communication Download: http://fogserver/fog/client/SmartInstaller.exe
 11/3/2021 7:40:10 AM Data::RSA FOG Project cert found
 11/3/2021 7:40:10 AM ClientUpdater ERROR: Update file is not authentic
------------------------------------------------------------------------------
--
---------------------------------ClientUpdater--------------------------------
------------------------------------------------------------------------------
 11/3/2021 7:42:38 AM Client-Info Client Version: 0.11.19
 11/3/2021 7:42:38 AM Client-Info Client OS:      Windows
 11/3/2021 7:42:38 AM Client-Info Server Version: 1.5.9.98
 11/3/2021 7:42:38 AM Middleware::Response Success
 11/3/2021 7:42:38 AM Middleware::Communication Download: http://fogserver/fog/client/SmartInstaller.exe
 11/3/2021 7:42:38 AM Data::RSA FOG Project cert found
 11/3/2021 7:42:38 AM ClientUpdater ERROR: Update file is not authentic
------------------------------------------------------------------------------

Any suggestions on how to address the root cause in case other clients are affected?
Thanks

Sebastian Roth · Nov 3, 2021, 4:16 PM

@altitudehack said in unusual network traffic to/from fog client:

 11/3/2021 7:27:59 AM Client-Info Client Version: 0.11.19
 11/3/2021 7:27:59 AM Client-Info Client OS:      Windows
 11/3/2021 7:27:59 AM Client-Info Server Version: 1.5.9.98
...
 11/3/2021 7:28:00 AM ClientUpdater ERROR: Update file is not authentic
...

Any suggestions on how to address the root cause in case other clients are affected?

Your FOG server is on a pretty recent version but the fog-client is not. Unfortunately our certificate for digitally signing the SmartInstaller binary ran out about a year ago and since then the auto-update from 0.11.19 (and older versions) to 0.12.0 is not possible.

So you might just download the fog-client installer (either within the FOG web UI or from github) and manually install that on machines having that issue.

altitudehack · Nov 3, 2021, 5:52 PM

@sebastian-roth Perfect. The original install was through a Group Policy .msi push, so I added the newer agent to replace the old one. Appreciate the quick info!

unusual network traffic to/from fog client

210

12.0k

17.3k

155.2k