Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

SSL Handshake fails on instances

Hello, I've got a fresh grizzly setup and on my instances, I can't connect to some websites via SSL.

This is my test url:

wget --debug --no-check-certificate https://raw.github.com/pypa/pip/master/contrib/get-pip.py

It works perfectly on the controller/network node, or on the compute node, so it's basically reachable.

On an instance though, wget hangs at "Initiating SSL handshake" indefinitely. We first suspected it to be the fastly SSL certificate, as fetching from PyPI also didn't work, but that would not explain it working from the host. (Both Ubunut 12.04.3).

Fetching stuff via SSL from other hosts works as well, so it's probably not a broken libssl either.

Could it be something with iptables?

So here's some tcpdump output to compare:

The fetch from github:

11:47:33.393309 IP (tos 0x0, ttl 63, id 20950, offset 0, flags [DF], proto TCP (6), length 60)
    MYHOSTNAME.55018 > 185.31.16.133.https: Flags [S], cksum 0xb420 (correct), seq 1075557220, win 14600, options [mss 1460,sackOK,TS val 13689522 ecr 0,nop,wscale 6], length 0
11:47:33.416652 IP (tos 0x0, ttl 54, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    185.31.16.133.https > MYHOSTNAME.55018: Flags [S.], cksum 0x3463 (correct), seq 2699455200, ack 1075557221, win 14480, options [mss 1460,sackOK,TS val 351821666 ecr 13689522,nop,wscale 9], length 0
11:47:33.436880 IP (tos 0x0, ttl 63, id 20951, offset 0, flags [DF], proto TCP (6), length 52)
    MYHOSTNAME.55018 > 185.31.16.133.https: Flags [.], cksum 0x9ad1 (correct), ack 1, win 229, options [nop,nop,TS val 13689533 ecr 351821666], length 0
11:47:33.578661 IP (tos 0x0, ttl 63, id 20952, offset 0, flags [DF], proto TCP (6), length 277)
    MYHOSTNAME.55018 > 185.31.16.133.https: Flags [P.], cksum 0x82fb (correct), seq 1:226, ack 1, win 229, options [nop,nop,TS val 13689568 ecr 351821666], length 225
11:47:33.602019 IP (tos 0x0, ttl 54, id 13680, offset 0, flags [DF], proto TCP (6), length 52)
    185.31.16.133.https > MYHOSTNAME.55018: Flags [.], cksum 0x9a64 (correct), ack 226, win 31, options [nop,nop,TS val 351821713 ecr 13689568], length 0
11:47:33.602466 IP (tos 0x0, ttl 54, id 13681, offset 0, flags [DF], proto TCP (6), length 1500)
    185.31.16.133.https > MYHOSTNAME.55018: Flags [.], cksum 0x4e82 (correct), seq 1:1449, ack 226, win 31, options [nop,nop,TS val 351821713 ecr 13689568], length 1448
11:47:33.602638 IP (tos 0x0, ttl 54, id 13682, offset 0, flags [DF], proto TCP (6), length 2030)
    185.31.16.133.https > MYHOSTNAME.55018: Flags [P.], cksum 0xb310 (incorrect -> 0x0e8b), seq 1449:3427, ack 226, win 31, options [nop,nop,TS val 351821713 ecr 13689568], length 1978
11:47:34.164925 IP (tos 0x0, ttl 55, id 13684, offset 0, flags [DF], proto TCP (6), length 1500)
    185.31.16.133.https > MYHOSTNAME.55018: Flags [.], cksum 0x4df5 (correct), seq 1:1449, ack 226, win 31, options [nop,nop,TS val 351821854 ecr 13689568], length 1448
11:47:35.296901 IP (tos 0x0, ttl 55, id 13685, offset 0, flags [DF], proto TCP (6), length 1500)
    185.31.16.133.https > MYHOSTNAME.55018: Flags [.], cksum 0x4cda (correct), seq 1:1449, ack 226, win 31, options [nop,nop,TS val 351822137 ecr 13689568], length 1448
11:47:37.556814 IP (tos 0x0, ttl 55, id 13686, offset 0, flags [DF], proto TCP (6), length 1500)
    185.31.16.133.https > MYHOSTNAME.55018: Flags [.], cksum 0x4aa5 (correct), seq 1:1449, ack 226, win 31, options [nop,nop,TS val 351822702 ecr 13689568], length 1448
11:47:38.933615 IP (tos 0x0, ttl 63, id 20953, offset 0, flags [DF], proto TCP (6), length 52)
    MYHOSTNAME.55018 > 185.31.16.133.https: Flags [F.], cksum 0x9462 (correct), seq 226, ack 1, win 229, options [nop,nop,TS val 13690907 ecr 351821713], length 0
11:47:38.956997 IP (tos 0x0, ttl 55, id 13687, offset 0, flags [DF], proto TCP (6), length 52)
    185.31.16.133.https > MYHOSTNAME.55018: Flags [.], cksum 0x828b (correct), ack 227, win 31, options [nop,nop,TS val 351823052 ecr 13690907], length 0
11:47:38.957079 IP (tos 0x0, ttl 55, id 13688, offset 0, flags [DF], proto TCP (6), length 52)
    185.31.16.133.https > MYHOSTNAME.55018: Flags [F.], cksum 0x828a (correct), seq 3427, ack 227, win 31, options [nop,nop,TS val 351823052 ecr 13690907], length 0
11:47:38.961039 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto TCP (6), length 40)
    MYHOSTNAME.55018 > 185.31.16.133.https: Flags [R], cksum 0x37a8 (correct), seq 1075557447, win 0, length 0

Fetching a different file from a different host that works:

11:48:50.687181 IP (tos 0x0, ttl 59, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    WORKINGREMOTE.https > MYHOSTNAME.37470: Flags [S.], cksum 0x69ee (correct), seq 3391191947, ack 24887111, win 14480, options [mss 1460,sackOK,TS val 2459973110 ecr 13708840,nop,wscale 7], length 0
11:48:50.695125 IP (tos 0x0, ttl 63, id 37231, offset 0, flags [DF], proto TCP (6), length 52)
    MYHOSTNAME.37470 > WORKINGREMOTE.https: Flags [.], cksum 0xd05e (correct), ack 1, win 229, options [nop,nop,TS val 13708847 ecr 2459973110], length 0
11:48:50.708427 IP (tos 0x0, ttl 63, id 37232, offset 0, flags [DF], proto TCP (6), length 277)
    MYHOSTNAME.37470 > WORKINGREMOTE.https: Flags [P.], cksum 0xba26 (correct), seq 1:226, ack 1, win 229, options [nop,nop,TS val 13708851 ecr 2459973110], length 225
11:48:50.729792 IP (tos 0x0, ttl 59, id 19884, offset 0, flags [DF], proto TCP (6), length 52)
    WORKINGREMOTE.https > MYHOSTNAME.37470: Flags [.], cksum 0xcfba (correct), ack 226, win 122, options [nop,nop,TS val 2459973152 ecr 13708851], length 0
11:48:50.743377 IP (tos 0x0, ttl 59, id 19885, offset 0, flags [DF], proto TCP (6), length 1639)
    WORKINGREMOTE.https > MYHOSTNAME.37470: Flags [P.], cksum 0x19b2 (incorrect -> 0x8843), seq 1:1588, ack 226, win 122, options [nop,nop,TS val 2459973166 ecr 13708851], length 1587
11:48:50.744588 IP (tos 0x0, ttl 63, id 37233, offset 0, flags [DF], proto TCP (6), length 52)
    MYHOSTNAME.37470 > WORKINGREMOTE.https: Flags [.], cksum 0xc993 (correct), ack 1403, win 272, options [nop,nop,TS val 13708860 ecr 2459973166], length 0
11:48:50.751295 IP (tos 0x0, ttl 63, id 37234, offset 0, flags [DF], proto TCP (6), length 52)
    MYHOSTNAME.37470 > WORKINGREMOTE.https: Flags [.], cksum 0xc8ae (correct), ack 1588, win 316, options [nop,nop,TS val 13708860 ecr 2459973166], length 0
11:48:51.207586 IP (tos 0x0, ttl 63, id 37235, offset 0, flags [DF], proto TCP (6), length 250)
    MYHOSTNAME.37470 > WORKINGREMOTE.https: Flags [P.], cksum 0x22ae (correct), seq 226:424, ack 1588, win 316, options [nop,nop,TS val 13708975 ecr 2459973166], length 198
11:48:51.240005 IP (tos 0x0, ttl 59, id 19887, offset 0, flags [DF], proto TCP (6), length 318)
    WORKINGREMOTE.https > MYHOSTNAME.37470: Flags [P.], cksum 0x6cee (correct), seq 1588:1854, ack 424, win 130, options [nop,nop,TS val 2459973663 ecr 13708975], length 266
11:48:51.241192 IP (tos 0x0, ttl 63, id 37236, offset 0, flags [DF], proto TCP (6), length 52)
    MYHOSTNAME.37470 > WORKINGREMOTE.https: Flags [.], cksum 0xc445 (correct), ack 1854, win 360, options [nop,nop,TS val 13708984 ecr 2459973663], length 0
11:48:51.623602 IP (tos 0x0, ttl 63, id 37237, offset 0, flags [DF], proto TCP (6), length 254)
    MYHOSTNAME.37470 > WORKINGREMOTE.https: Flags [P.], cksum 0x5edd (correct), seq 424:626, ack 1854, win 360, options [nop,nop,TS val 13709079 ecr 2459973663], length 202
11:48:51.645749 IP (tos 0x0, ttl 59, id 19888, offset 0, flags [DF], proto TCP (6), length 2856)
    WORKINGREMOTE.https > MYHOSTNAME.37470: Flags [.], cksum 0x1e73 (incorrect -> 0xe752), seq 1854:4658, ack 626, win 139, options [nop,nop,TS val 2459974068 ecr 13709079], length 2804
11:48:51.645773 IP (tos 0x0, ttl 59, id 19890, offset 0, flags [DF], proto TCP (6), length 4258)
    WORKINGREMOTE.https > MYHOSTNAME.37470: Flags [.], cksum 0x23ed (incorrect -> 0xc768), seq 4658:8864, ack 626, win 139, options [nop,nop,TS val 2459974069 ecr 13709079], length 4206

Fetching the first file from the controller (this works as well):

11:58:20.184527 IP (tos 0x0, ttl 64, id 50944, offset 0, flags [DF], proto TCP (6), length 60)
    MYHOSTNAME.54876 > 185.31.16.133.https: Flags [S], cksum 0xab5a (incorrect -> 0x2613), seq 1812700879, win 14600, options [mss 1460,sackOK,TS val 16210383 ecr 0,nop,wscale 7], length 0
11:58:20.207871 IP (tos 0x0, ttl 55, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    185.31.16.133.https > MYHOSTNAME.54876: Flags [S.], cksum 0x386c (correct), seq 2060851661, ack 1812700880, win 14480, options [mss 1460,sackOK,TS val 930619888 ecr 16210383,nop,wscale 9], length 0
11:58:20.207937 IP (tos 0x0, ttl 64, id 50945, offset 0, flags [DF], proto TCP (6), length 52)
    MYHOSTNAME.54876 > 185.31.16.133.https: Flags [.], cksum 0xab52 (incorrect -> 0x9f52), ack 1, win 115, options [nop,nop,TS val 16210388 ecr 930619888], length 0
11:58:20.208112 IP (tos 0x0, ttl 64, id 50946, offset 0, flags [DF], proto TCP (6), length 277)
    MYHOSTNAME.54876 > 185.31.16.133.https: Flags [P.], cksum 0xac33 (incorrect -> 0x6ab3), seq 1:226, ack 1, win 115, options [nop,nop,TS val 16210388 ecr 930619888], length 225
11:58:20.231489 IP (tos 0x0, ttl 54, id 14392, offset 0, flags [DF], proto TCP (6), length 52)
    185.31.16.133.https > MYHOSTNAME.54876: Flags [.], cksum 0x9ebf (correct), ack 226, win 31, options [nop,nop,TS val 930619894 ecr 16210388], length 0
11:58:20.231944 IP (tos 0x0, ttl 54, id 14393, offset 0, flags [DF], proto TCP (6), length 3478)
    185.31.16.133.https > MYHOSTNAME.54876: Flags [P.], cksum 0xb8b4 (incorrect -> 0x46d2), seq 1:3427, ack 226, win 31, options [nop,nop,TS val 930619894 ecr 16210388], length 3426
11:58:20.232037 IP (tos 0x0, ttl 64, id 50947, offset 0, flags [DF], proto TCP (6), length 52)
    MYHOSTNAME.54876 > 185.31.16.133.https: Flags [.], cksum 0xab52 (incorrect -> 0x90ce), ack 3427, win 168, options [nop,nop,TS val 16210394 ecr 930619894], length 0
11:58:20.233976 IP (tos 0x0, ttl 64, id 50948, offset 0, flags [DF], proto TCP (6), length 366)
    MYHOSTNAME.54876 > 185.31.16.133.https: Flags [P.], cksum 0xac8c (incorrect -> 0x3d3d), seq 226:540, ack 3427, win 168, options [nop,nop,TS val 16210395 ecr 930619894], length 314
11:58:20.257386 IP (tos 0x0, ttl 54, id 14396, offset 0, flags [DF], proto TCP (6), length 52)
    185.31.16.133.https > MYHOSTNAME.54876: Flags [.], cksum 0x9014 (correct), ack 540, win 33, options [nop,nop,TS val 930619900 ecr 16210395], length 0
11:58:20.259382 IP (tos 0x0, ttl 54, id 14397, offset 0, flags [DF], proto TCP (6), length 306)
    185.31.16.133.https > MYHOSTNAME.54876: Flags [P.], cksum 0x938f (correct), seq 3427:3681, ack 540, win 33, options [nop,nop,TS val 930619901 ecr 16210395], length 254
11:58:20.259856 IP (tos 0x0, ttl 64, id 50949, offset 0, flags [DF], proto TCP (6), length 225)
    MYHOSTNAME.54876 > 185.31.16.133.https: Flags [P.], cksum 0xabff (incorrect -> 0x8c85), seq 540:713, ack 3681, win 191, options [nop,nop,TS val 16210401 ecr 930619901], length 173
11:58:20.283306 IP (tos 0x0, ttl 54, id 14398, offset 0, flags [DF], proto TCP (6), length 52)
    185.31.16.133.https > MYHOSTNAME.54876: Flags [.], cksum 0x8e5a (correct), ack 713, win 35, options [nop,nop,TS val 930619907 ecr 16210401], length 0
11:58:20.381866 IP (tos 0x0, ttl 54, id 14399, offset 0, flags [DF], proto TCP (6), length 13084)
    185.31.16.133.https > MYHOSTNAME.54876: Flags [P.], cksum 0xde3a (incorrect -> 0x313c), seq 3681:16713, ack 713, win 35, options [nop,nop,TS val 930619932 ecr 16210401], length 13032
11:58:20.381914 IP (tos 0x0, ttl 64, id 50950, offset 0, flags [DF], proto TCP (6), length 52)
    MYHOSTNAME.54876 > 185.31.16.133.https: Flags [.], cksum 0xab52 (incorrect -> 0x5a54), ack 16713, win 265, options [nop,nop,TS val 16210432 ecr 930619932], length 0
11:58:20.381930 IP (tos 0x0, ttl 54, id 14408, offset 0, flags [DF], proto TCP (6), length 1500)
    185.31.16.133.https > MYHOSTNAME.54876: Flags [.], cksum 0x0492 (correct), seq 16713:18161, ack 713, win 35, options [nop,nop,TS val 930619932 ecr 16210401], length 1448
11:58:20.405414 IP (tos 0x0, ttl 54, id 14409, offset 0, flags [DF], proto TCP (6), length 14532)
    185.31.16.133.https > MYHOSTNAME.54876: Flags [P.], cksum 0xe3e2 (incorrect -> 0xfc2a), seq 18161:32641, ack 713, win 35, options [nop,nop,TS val 930619937 ecr 16210432], length 14480

SSL Handshake fails on instances

Hello, I've got a fresh grizzly setup and on my instances, I can't connect to some websites via SSL.

This is my test url:

wget --debug --no-check-certificate https://raw.github.com/pypa/pip/master/contrib/get-pip.py

It works perfectly on the controller/network node, or on the compute node, so it's basically reachable.

On an instance though, wget hangs at "Initiating SSL handshake" indefinitely. We first suspected it to be the fastly SSL certificate, as fetching from PyPI also didn't work, but that would not explain it working from the host. (Both Ubunut 12.04.3).

Fetching stuff via SSL from other hosts works as well, so it's probably not a broken libssl either.

Could it be something with iptables?

So here's some // EDIT: Removed tcpdump output to compare:improve readability.

The fetch from github:

11:47:33.393309 IP (tos 0x0, ttl 63, id 20950, offset 0, flags [DF], proto TCP (6), length 60)
    MYHOSTNAME.55018 > 185.31.16.133.https: Flags [S], cksum 0xb420 (correct), seq 1075557220, win 14600, options [mss 1460,sackOK,TS val 13689522 ecr 0,nop,wscale 6], length 0
11:47:33.416652 IP (tos 0x0, ttl 54, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    185.31.16.133.https > MYHOSTNAME.55018: Flags [S.], cksum 0x3463 (correct), seq 2699455200, ack 1075557221, win 14480, options [mss 1460,sackOK,TS val 351821666 ecr 13689522,nop,wscale 9], length 0
11:47:33.436880 IP (tos 0x0, ttl 63, id 20951, offset 0, flags [DF], proto TCP (6), length 52)
    MYHOSTNAME.55018 > 185.31.16.133.https: Flags [.], cksum 0x9ad1 (correct), ack 1, win 229, options [nop,nop,TS val 13689533 ecr 351821666], length 0
11:47:33.578661 IP (tos 0x0, ttl 63, id 20952, offset 0, flags [DF], proto TCP (6), length 277)
    MYHOSTNAME.55018 > 185.31.16.133.https: Flags [P.], cksum 0x82fb (correct), seq 1:226, ack 1, win 229, options [nop,nop,TS val 13689568 ecr 351821666], length 225
11:47:33.602019 IP (tos 0x0, ttl 54, id 13680, offset 0, flags [DF], proto TCP (6), length 52)
    185.31.16.133.https > MYHOSTNAME.55018: Flags [.], cksum 0x9a64 (correct), ack 226, win 31, options [nop,nop,TS val 351821713 ecr 13689568], length 0
11:47:33.602466 IP (tos 0x0, ttl 54, id 13681, offset 0, flags [DF], proto TCP (6), length 1500)
    185.31.16.133.https > MYHOSTNAME.55018: Flags [.], cksum 0x4e82 (correct), seq 1:1449, ack 226, win 31, options [nop,nop,TS val 351821713 ecr 13689568], length 1448
11:47:33.602638 IP (tos 0x0, ttl 54, id 13682, offset 0, flags [DF], proto TCP (6), length 2030)
    185.31.16.133.https > MYHOSTNAME.55018: Flags [P.], cksum 0xb310 (incorrect -> 0x0e8b), seq 1449:3427, ack 226, win 31, options [nop,nop,TS val 351821713 ecr 13689568], length 1978
11:47:34.164925 IP (tos 0x0, ttl 55, id 13684, offset 0, flags [DF], proto TCP (6), length 1500)
    185.31.16.133.https > MYHOSTNAME.55018: Flags [.], cksum 0x4df5 (correct), seq 1:1449, ack 226, win 31, options [nop,nop,TS val 351821854 ecr 13689568], length 1448
11:47:35.296901 IP (tos 0x0, ttl 55, id 13685, offset 0, flags [DF], proto TCP (6), length 1500)
    185.31.16.133.https > MYHOSTNAME.55018: Flags [.], cksum 0x4cda (correct), seq 1:1449, ack 226, win 31, options [nop,nop,TS val 351822137 ecr 13689568], length 1448
11:47:37.556814 IP (tos 0x0, ttl 55, id 13686, offset 0, flags [DF], proto TCP (6), length 1500)
    185.31.16.133.https > MYHOSTNAME.55018: Flags [.], cksum 0x4aa5 (correct), seq 1:1449, ack 226, win 31, options [nop,nop,TS val 351822702 ecr 13689568], length 1448
11:47:38.933615 IP (tos 0x0, ttl 63, id 20953, offset 0, flags [DF], proto TCP (6), length 52)
    MYHOSTNAME.55018 > 185.31.16.133.https: Flags [F.], cksum 0x9462 (correct), seq 226, ack 1, win 229, options [nop,nop,TS val 13690907 ecr 351821713], length 0
11:47:38.956997 IP (tos 0x0, ttl 55, id 13687, offset 0, flags [DF], proto TCP (6), length 52)
    185.31.16.133.https > MYHOSTNAME.55018: Flags [.], cksum 0x828b (correct), ack 227, win 31, options [nop,nop,TS val 351823052 ecr 13690907], length 0
11:47:38.957079 IP (tos 0x0, ttl 55, id 13688, offset 0, flags [DF], proto TCP (6), length 52)
    185.31.16.133.https > MYHOSTNAME.55018: Flags [F.], cksum 0x828a (correct), seq 3427, ack 227, win 31, options [nop,nop,TS val 351823052 ecr 13690907], length 0
11:47:38.961039 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto TCP (6), length 40)
    MYHOSTNAME.55018 > 185.31.16.133.https: Flags [R], cksum 0x37a8 (correct), seq 1075557447, win 0, length 0

Fetching a different file from a different host that works:

11:48:50.687181 IP (tos 0x0, ttl 59, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    WORKINGREMOTE.https > MYHOSTNAME.37470: Flags [S.], cksum 0x69ee (correct), seq 3391191947, ack 24887111, win 14480, options [mss 1460,sackOK,TS val 2459973110 ecr 13708840,nop,wscale 7], length 0
11:48:50.695125 IP (tos 0x0, ttl 63, id 37231, offset 0, flags [DF], proto TCP (6), length 52)
    MYHOSTNAME.37470 > WORKINGREMOTE.https: Flags [.], cksum 0xd05e (correct), ack 1, win 229, options [nop,nop,TS val 13708847 ecr 2459973110], length 0
11:48:50.708427 IP (tos 0x0, ttl 63, id 37232, offset 0, flags [DF], proto TCP (6), length 277)
    MYHOSTNAME.37470 > WORKINGREMOTE.https: Flags [P.], cksum 0xba26 (correct), seq 1:226, ack 1, win 229, options [nop,nop,TS val 13708851 ecr 2459973110], length 225
11:48:50.729792 IP (tos 0x0, ttl 59, id 19884, offset 0, flags [DF], proto TCP (6), length 52)
    WORKINGREMOTE.https > MYHOSTNAME.37470: Flags [.], cksum 0xcfba (correct), ack 226, win 122, options [nop,nop,TS val 2459973152 ecr 13708851], length 0
11:48:50.743377 IP (tos 0x0, ttl 59, id 19885, offset 0, flags [DF], proto TCP (6), length 1639)
    WORKINGREMOTE.https > MYHOSTNAME.37470: Flags [P.], cksum 0x19b2 (incorrect -> 0x8843), seq 1:1588, ack 226, win 122, options [nop,nop,TS val 2459973166 ecr 13708851], length 1587
11:48:50.744588 IP (tos 0x0, ttl 63, id 37233, offset 0, flags [DF], proto TCP (6), length 52)
    MYHOSTNAME.37470 > WORKINGREMOTE.https: Flags [.], cksum 0xc993 (correct), ack 1403, win 272, options [nop,nop,TS val 13708860 ecr 2459973166], length 0
11:48:50.751295 IP (tos 0x0, ttl 63, id 37234, offset 0, flags [DF], proto TCP (6), length 52)
    MYHOSTNAME.37470 > WORKINGREMOTE.https: Flags [.], cksum 0xc8ae (correct), ack 1588, win 316, options [nop,nop,TS val 13708860 ecr 2459973166], length 0
11:48:51.207586 IP (tos 0x0, ttl 63, id 37235, offset 0, flags [DF], proto TCP (6), length 250)
    MYHOSTNAME.37470 > WORKINGREMOTE.https: Flags [P.], cksum 0x22ae (correct), seq 226:424, ack 1588, win 316, options [nop,nop,TS val 13708975 ecr 2459973166], length 198
11:48:51.240005 IP (tos 0x0, ttl 59, id 19887, offset 0, flags [DF], proto TCP (6), length 318)
    WORKINGREMOTE.https > MYHOSTNAME.37470: Flags [P.], cksum 0x6cee (correct), seq 1588:1854, ack 424, win 130, options [nop,nop,TS val 2459973663 ecr 13708975], length 266
11:48:51.241192 IP (tos 0x0, ttl 63, id 37236, offset 0, flags [DF], proto TCP (6), length 52)
    MYHOSTNAME.37470 > WORKINGREMOTE.https: Flags [.], cksum 0xc445 (correct), ack 1854, win 360, options [nop,nop,TS val 13708984 ecr 2459973663], length 0
11:48:51.623602 IP (tos 0x0, ttl 63, id 37237, offset 0, flags [DF], proto TCP (6), length 254)
    MYHOSTNAME.37470 > WORKINGREMOTE.https: Flags [P.], cksum 0x5edd (correct), seq 424:626, ack 1854, win 360, options [nop,nop,TS val 13709079 ecr 2459973663], length 202
11:48:51.645749 IP (tos 0x0, ttl 59, id 19888, offset 0, flags [DF], proto TCP (6), length 2856)
    WORKINGREMOTE.https > MYHOSTNAME.37470: Flags [.], cksum 0x1e73 (incorrect -> 0xe752), seq 1854:4658, ack 626, win 139, options [nop,nop,TS val 2459974068 ecr 13709079], length 2804
11:48:51.645773 IP (tos 0x0, ttl 59, id 19890, offset 0, flags [DF], proto TCP (6), length 4258)
    WORKINGREMOTE.https > MYHOSTNAME.37470: Flags [.], cksum 0x23ed (incorrect -> 0xc768), seq 4658:8864, ack 626, win 139, options [nop,nop,TS val 2459974069 ecr 13709079], length 4206

Fetching the first file from the controller (this works as well):

11:58:20.184527 IP (tos 0x0, ttl 64, id 50944, offset 0, flags [DF], proto TCP (6), length 60)
    MYHOSTNAME.54876 > 185.31.16.133.https: Flags [S], cksum 0xab5a (incorrect -> 0x2613), seq 1812700879, win 14600, options [mss 1460,sackOK,TS val 16210383 ecr 0,nop,wscale 7], length 0
11:58:20.207871 IP (tos 0x0, ttl 55, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    185.31.16.133.https > MYHOSTNAME.54876: Flags [S.], cksum 0x386c (correct), seq 2060851661, ack 1812700880, win 14480, options [mss 1460,sackOK,TS val 930619888 ecr 16210383,nop,wscale 9], length 0
11:58:20.207937 IP (tos 0x0, ttl 64, id 50945, offset 0, flags [DF], proto TCP (6), length 52)
    MYHOSTNAME.54876 > 185.31.16.133.https: Flags [.], cksum 0xab52 (incorrect -> 0x9f52), ack 1, win 115, options [nop,nop,TS val 16210388 ecr 930619888], length 0
11:58:20.208112 IP (tos 0x0, ttl 64, id 50946, offset 0, flags [DF], proto TCP (6), length 277)
    MYHOSTNAME.54876 > 185.31.16.133.https: Flags [P.], cksum 0xac33 (incorrect -> 0x6ab3), seq 1:226, ack 1, win 115, options [nop,nop,TS val 16210388 ecr 930619888], length 225
11:58:20.231489 IP (tos 0x0, ttl 54, id 14392, offset 0, flags [DF], proto TCP (6), length 52)
    185.31.16.133.https > MYHOSTNAME.54876: Flags [.], cksum 0x9ebf (correct), ack 226, win 31, options [nop,nop,TS val 930619894 ecr 16210388], length 0
11:58:20.231944 IP (tos 0x0, ttl 54, id 14393, offset 0, flags [DF], proto TCP (6), length 3478)
    185.31.16.133.https > MYHOSTNAME.54876: Flags [P.], cksum 0xb8b4 (incorrect -> 0x46d2), seq 1:3427, ack 226, win 31, options [nop,nop,TS val 930619894 ecr 16210388], length 3426
11:58:20.232037 IP (tos 0x0, ttl 64, id 50947, offset 0, flags [DF], proto TCP (6), length 52)
    MYHOSTNAME.54876 > 185.31.16.133.https: Flags [.], cksum 0xab52 (incorrect -> 0x90ce), ack 3427, win 168, options [nop,nop,TS val 16210394 ecr 930619894], length 0
11:58:20.233976 IP (tos 0x0, ttl 64, id 50948, offset 0, flags [DF], proto TCP (6), length 366)
    MYHOSTNAME.54876 > 185.31.16.133.https: Flags [P.], cksum 0xac8c (incorrect -> 0x3d3d), seq 226:540, ack 3427, win 168, options [nop,nop,TS val 16210395 ecr 930619894], length 314
11:58:20.257386 IP (tos 0x0, ttl 54, id 14396, offset 0, flags [DF], proto TCP (6), length 52)
    185.31.16.133.https > MYHOSTNAME.54876: Flags [.], cksum 0x9014 (correct), ack 540, win 33, options [nop,nop,TS val 930619900 ecr 16210395], length 0
11:58:20.259382 IP (tos 0x0, ttl 54, id 14397, offset 0, flags [DF], proto TCP (6), length 306)
    185.31.16.133.https > MYHOSTNAME.54876: Flags [P.], cksum 0x938f (correct), seq 3427:3681, ack 540, win 33, options [nop,nop,TS val 930619901 ecr 16210395], length 254
11:58:20.259856 IP (tos 0x0, ttl 64, id 50949, offset 0, flags [DF], proto TCP (6), length 225)
    MYHOSTNAME.54876 > 185.31.16.133.https: Flags [P.], cksum 0xabff (incorrect -> 0x8c85), seq 540:713, ack 3681, win 191, options [nop,nop,TS val 16210401 ecr 930619901], length 173
11:58:20.283306 IP (tos 0x0, ttl 54, id 14398, offset 0, flags [DF], proto TCP (6), length 52)
    185.31.16.133.https > MYHOSTNAME.54876: Flags [.], cksum 0x8e5a (correct), ack 713, win 35, options [nop,nop,TS val 930619907 ecr 16210401], length 0
11:58:20.381866 IP (tos 0x0, ttl 54, id 14399, offset 0, flags [DF], proto TCP (6), length 13084)
    185.31.16.133.https > MYHOSTNAME.54876: Flags [P.], cksum 0xde3a (incorrect -> 0x313c), seq 3681:16713, ack 713, win 35, options [nop,nop,TS val 930619932 ecr 16210401], length 13032
11:58:20.381914 IP (tos 0x0, ttl 64, id 50950, offset 0, flags [DF], proto TCP (6), length 52)
    MYHOSTNAME.54876 > 185.31.16.133.https: Flags [.], cksum 0xab52 (incorrect -> 0x5a54), ack 16713, win 265, options [nop,nop,TS val 16210432 ecr 930619932], length 0
11:58:20.381930 IP (tos 0x0, ttl 54, id 14408, offset 0, flags [DF], proto TCP (6), length 1500)
    185.31.16.133.https > MYHOSTNAME.54876: Flags [.], cksum 0x0492 (correct), seq 16713:18161, ack 713, win 35, options [nop,nop,TS val 930619932 ecr 16210401], length 1448
11:58:20.405414 IP (tos 0x0, ttl 54, id 14409, offset 0, flags [DF], proto TCP (6), length 14532)
    185.31.16.133.https > MYHOSTNAME.54876: Flags [P.], cksum 0xe3e2 (incorrect -> 0xfc2a), seq 18161:32641, ack 713, win 35, options [nop,nop,TS val 930619937 ecr 16210432], length 14480