Softether Linux Client Idle Traffic

[hedwig]

Hi,

I'm using linux x64 client build 9608 on ubuntu 14.04 which acts like a gateway. The server is build 9608 and is hosted on ubuntu server 14.04. After doing some packet sniffing and traffic analysis i just found out that the client is constantly using about ~40Kb/s (~5KB/s). I made sure that no traffic (including broadcast or multicast traffic) is going through the gateway and thus the vpn adapter. There are only few occasional ARP packets but the vpn client still uses ~40Kb/s which doesn't look right.

The vpn has been working flawlessly for a long time but i've never noticed the idle traffic before. I just happened to notice it now. My question is why is it using so much bandwidth while it is idle? and is there a way to reduce it?

Following are runtime information taken from the client:
Port Number: TCP Port 443
Server Product Name: SoftEther VPN Server (64 bit)
Server Version: 4.20
Server Build: Build 9608
Number of Established Sessions: 1 Times
Half Duplex TCP Connection Mode: No (Full Duplex Mode)
VoIP / QoS Function: Disabled
Number of TCP Connections: 24
Maximum Number of TCP Connections: 24
Encryption: Enabled (Algorithm: RC4-SHA)
Use of Compression: Yes (1 %)
Physical Underlay Protocol: Standard TCP/IP (IPv4)
UDP Acceleration is Supported: Yes
UDP Acceleration is Active: Yes
Bridge / Router Mode: No
Monitoring Mode: No

Here are more information that might help:
* There is one level NAT between the client and server
* There is no firewall between client and server
* Softether components used: Client & Server
* Platforms: Ubuntu Server 14.04 on client and server
* SecureNAT is disabled

Any help is much appreciated

[thisjun]

Please check a packet log of the VPN server.

[hedwig]

Thanks for your reply,

On the server side i have only two interfaces. eth0 as the ethernet adapter and vpn_adapter as SoftEther virtual adapter. As i mentioned above Although packet log with no filters on vpn_adapter shows almost nothing the bandwidth usage between server and client remains about 5-6KB/s. However packet log on eth0 shows lots of encrypted packets coming from the client. This is why i think the SoftEther client is being too chatty although no traffic is being sent through it.

[thisjun]

Can you sniff on virtual NIC of the client?