A lot of LDAP request at one page load

somogyi · May '24

Hi!

We are using Egroupware (latest version, Docker) with ActiveDirectory authentication for auth/caldav/carddav/accounts.
In this configuration we have an issue with this auth method.

Only one page load can cause a lot of LDAP request to the AD server and after a while (with many user) it can cause a really high CPU usage on AD server.

We have no complex configuration in setup page related to Active directory or authentication.

Sample for one page load:

Egroupware auth.log:

2024-05-14 13:59:39: Instantiated EGroupware\Api\Auth\Ads() (for type 'ads')
2024-05-14 13:59:39: Instantiated EGroupware\Api\Auth\Ads() (for type 'ads')
2024-05-14 13:59:40: Instantiated EGroupware\Api\Auth\Ads() (for type 'ads')
2024-05-14 13:59:48: Instantiated EGroupware\Api\Auth\Ads() (for type 'ads')
2024-05-14 13:59:48: Instantiated EGroupware\Api\Auth\Ads() (for type 'ads')
2024-05-14 13:59:48: EGroupware\Api\Auth\Ads('****', '***********', 'text') returned true
2024-05-14 13:59:48: EGroupware\Api\Auth::authenticate('****', '***********', 'text') returned true
2024-05-14 13:59:48: Instantiated EGroupware\Api\Auth\Ads() (for type 'ads')

AD tcpdump when one page load:

...
    13:58:06.981042 IP ************.36662 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828712115 ecr 2085645718], length 173
    13:58:06.981876 IP ************.36662 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828712116 ecr 2085645719], length 116
    13:58:06.986467 IP ************.36662 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828712120 ecr 2085645724], length 0
    13:58:06.986863 IP ************.36662 > ************.ldap: Flags [.], ack 30018, win 436, options [nop,nop,TS val 3828712121 ecr 2085645724], length 0
    13:58:06.986990 IP ************.36662 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828712121 ecr 2085645724], length 0
    13:58:06.987175 IP ************.36662 > ************.ldap: Flags [.], ack 47394, win 501, options [nop,nop,TS val 3828712121 ecr 2085645724], length 0
    13:58:06.987261 IP ************.36662 > ************.ldap: Flags [.], ack 56887, win 459, options [nop,nop,TS val 3828712121 ecr 2085645724], length 0
    13:58:06.999809 IP ************.36664 > ************.ldap: Flags [S], seq 3684359359, win 64240, options [mss 1460,sackOK,TS val 3828712134 ecr 0,nop,wscale 7], length 0
    13:58:07.000109 IP ************.36664 > ************.ldap: Flags [.], ack 643971592, win 502, options [nop,nop,TS val 3828712134 ecr 2085645737], length 0
    13:58:07.000206 IP ************.36664 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828712134 ecr 2085645737], length 53
    13:58:07.000754 IP ************.36662 > ************.ldap: Flags [P.], seq 342:349, ack 56887, win 501, options [nop,nop,TS val 3828712135 ecr 2085645724], length 7
    13:58:07.000770 IP ************.36662 > ************.ldap: Flags [F.], seq 349, ack 56887, win 501, options [nop,nop,TS val 3828712135 ecr 2085645724], length 0
    13:58:07.006859 IP ************.36662 > ************.ldap: Flags [.], ack 56888, win 501, options [nop,nop,TS val 3828712141 ecr 2085645744], length 0
    13:58:07.027132 IP ************.36664 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828712161 ecr 2085645764], length 0
    13:58:07.027245 IP ************.36664 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828712161 ecr 2085645764], length 173
    13:58:07.029086 IP ************.36664 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828712163 ecr 2085645766], length 116
    13:58:07.033484 IP ************.36664 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828712167 ecr 2085645771], length 0
    13:58:07.033780 IP ************.36664 > ************.ldap: Flags [.], ack 30018, win 436, options [nop,nop,TS val 3828712168 ecr 2085645771], length 0
    13:58:07.033927 IP ************.36664 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828712168 ecr 2085645771], length 0
    13:58:07.034123 IP ************.36664 > ************.ldap: Flags [.], ack 56887, win 444, options [nop,nop,TS val 3828712168 ecr 2085645771], length 0
    13:58:07.045520 IP ************.36664 > ************.ldap: Flags [P.], seq 342:349, ack 56887, win 501, options [nop,nop,TS val 3828712179 ecr 2085645771], length 7
    13:58:07.045668 IP ************.36664 > ************.ldap: Flags [F.], seq 349, ack 56887, win 501, options [nop,nop,TS val 3828712180 ecr 2085645771], length 0
    13:58:07.045983 IP ************.36664 > ************.ldap: Flags [.], ack 56888, win 501, options [nop,nop,TS val 3828712180 ecr 2085645783], length 0
    13:58:07.047111 IP ************.36680 > ************.ldap: Flags [S], seq 1926419170, win 64240, options [mss 1460,sackOK,TS val 3828712181 ecr 0,nop,wscale 7], length 0
    13:58:07.047406 IP ************.36680 > ************.ldap: Flags [.], ack 3543437634, win 502, options [nop,nop,TS val 3828712181 ecr 2085645785], length 0
    13:58:07.047512 IP ************.36680 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828712181 ecr 2085645785], length 53
    13:58:07.072646 IP ************.36680 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828712207 ecr 2085645810], length 0
    13:58:07.072846 IP ************.36680 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828712207 ecr 2085645810], length 173
    13:58:07.073635 IP ************.36680 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828712208 ecr 2085645811], length 116
    13:58:07.078244 IP ************.36680 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828712212 ecr 2085645815], length 0
    13:58:07.078651 IP ************.36680 > ************.ldap: Flags [.], ack 30018, win 436, options [nop,nop,TS val 3828712213 ecr 2085645816], length 0
    13:58:07.078752 IP ************.36680 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828712213 ecr 2085645816], length 0
    13:58:07.079043 IP ************.36680 > ************.ldap: Flags [.], ack 56887, win 444, options [nop,nop,TS val 3828712213 ecr 2085645816], length 0
    13:58:07.089871 IP ************.36680 > ************.ldap: Flags [P.], seq 342:349, ack 56887, win 501, options [nop,nop,TS val 3828712224 ecr 2085645816], length 7
    13:58:07.089913 IP ************.36680 > ************.ldap: Flags [F.], seq 349, ack 56887, win 501, options [nop,nop,TS val 3828712224 ecr 2085645816], length 0
    13:58:07.090418 IP ************.36680 > ************.ldap: Flags [.], ack 56888, win 501, options [nop,nop,TS val 3828712224 ecr 2085645828], length 0
    13:58:07.091772 IP ************.36682 > ************.ldap: Flags [S], seq 4227770945, win 64240, options [mss 1460,sackOK,TS val 3828712226 ecr 0,nop,wscale 7], length 0
    13:58:07.092009 IP ************.36682 > ************.ldap: Flags [.], ack 3032364534, win 502, options [nop,nop,TS val 3828712226 ecr 2085645829], length 0
    13:58:07.092084 IP ************.36682 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828712226 ecr 2085645829], length 53
    13:58:07.118091 IP ************.36682 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828712252 ecr 2085645855], length 0
    13:58:07.118198 IP ************.36682 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828712252 ecr 2085645855], length 173
    13:58:07.118998 IP ************.36682 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828712253 ecr 2085645856], length 116
    13:58:07.123246 IP ************.36682 > ************.ldap: Flags [.], ack 8298, win 474, options [nop,nop,TS val 3828712257 ecr 2085645860], length 0
    13:58:07.123325 IP ************.36682 > ************.ldap: Flags [.], ack 15538, win 501, options [nop,nop,TS val 3828712257 ecr 2085645861], length 0
    13:58:07.123567 IP ************.36682 > ************.ldap: Flags [.], ack 25674, win 501, options [nop,nop,TS val 3828712258 ecr 2085645861], length 0
    13:58:07.123741 IP ************.36682 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828712258 ecr 2085645861], length 0
    13:58:07.123827 IP ************.36682 > ************.ldap: Flags [.], ack 47394, win 501, options [nop,nop,TS val 3828712258 ecr 2085645861], length 0
    13:58:07.123917 IP ************.36682 > ************.ldap: Flags [.], ack 56887, win 459, options [nop,nop,TS val 3828712258 ecr 2085645861], length 0
    13:58:07.126907 IP ************.36682 > ************.ldap: Flags [P.], seq 342:349, ack 56887, win 501, options [nop,nop,TS val 3828712261 ecr 2085645861], length 7
    13:58:07.126970 IP ************.36682 > ************.ldap: Flags [F.], seq 349, ack 56887, win 501, options [nop,nop,TS val 3828712261 ecr 2085645861], length 0
    13:58:07.127356 IP ************.36682 > ************.ldap: Flags [.], ack 56888, win 501, options [nop,nop,TS val 3828712261 ecr 2085645865], length 0
    13:58:07.341320 IP ************.36696 > ************.ldap: Flags [S], seq 17791153, win 64240, options [mss 1460,sackOK,TS val 3828712475 ecr 0,nop,wscale 7], length 0
    13:58:07.341636 IP ************.36696 > ************.ldap: Flags [.], ack 783871111, win 502, options [nop,nop,TS val 3828712476 ecr 2085646079], length 0
    13:58:07.341708 IP ************.36696 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828712476 ecr 2085646079], length 53
    13:58:07.366189 IP ************.36696 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828712500 ecr 2085646103], length 0
    13:58:07.366327 IP ************.36696 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828712500 ecr 2085646103], length 173
    13:58:07.367090 IP ************.36696 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828712501 ecr 2085646104], length 116
    13:58:07.371292 IP ************.36696 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828712505 ecr 2085646108], length 0
    13:58:07.371599 IP ************.36696 > ************.ldap: Flags [.], ack 30018, win 436, options [nop,nop,TS val 3828712506 ecr 2085646109], length 0
    13:58:07.371683 IP ************.36696 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828712506 ecr 2085646109], length 0
    13:58:07.371926 IP ************.36696 > ************.ldap: Flags [.], ack 56887, win 444, options [nop,nop,TS val 3828712506 ecr 2085646109], length 0
    13:58:07.379658 IP ************.36696 > ************.ldap: Flags [P.], seq 342:349, ack 56887, win 501, options [nop,nop,TS val 3828712514 ecr 2085646109], length 7
    13:58:07.379682 IP ************.36696 > ************.ldap: Flags [F.], seq 349, ack 56887, win 501, options [nop,nop,TS val 3828712514 ecr 2085646109], length 0
    13:58:07.380115 IP ************.36696 > ************.ldap: Flags [.], ack 56888, win 501, options [nop,nop,TS val 3828712514 ecr 2085646117], length 0
    13:58:07.425431 IP ************.36706 > ************.ldap: Flags [S], seq 1695286666, win 64240, options [mss 1460,sackOK,TS val 3828712559 ecr 0,nop,wscale 7], length 0
    13:58:07.425722 IP ************.36706 > ************.ldap: Flags [.], ack 3479038958, win 502, options [nop,nop,TS val 3828712560 ecr 2085646163], length 0
    13:58:07.426062 IP ************.36706 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828712560 ecr 2085646163], length 53
    13:58:07.453279 IP ************.36706 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828712587 ecr 2085646190], length 0
    13:58:07.453548 IP ************.36706 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828712588 ecr 2085646190], length 173
    13:58:07.454292 IP ************.36706 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828712588 ecr 2085646191], length 116
    13:58:07.458624 IP ************.36706 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828712593 ecr 2085646196], length 0
    13:58:07.459015 IP ************.36706 > ************.ldap: Flags [.], ack 30018, win 436, options [nop,nop,TS val 3828712593 ecr 2085646196], length 0
    13:58:07.459085 IP ************.36706 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828712593 ecr 2085646196], length 0
    13:58:07.459321 IP ************.36706 > ************.ldap: Flags [.], ack 56887, win 444, options [nop,nop,TS val 3828712593 ecr 2085646197], length 0
    13:58:07.464468 IP ************.36706 > ************.ldap: Flags [P.], seq 342:349, ack 56887, win 501, options [nop,nop,TS val 3828712598 ecr 2085646197], length 7
    13:58:07.464501 IP ************.36706 > ************.ldap: Flags [F.], seq 349, ack 56887, win 501, options [nop,nop,TS val 3828712598 ecr 2085646197], length 0
    13:58:07.464868 IP ************.36706 > ************.ldap: Flags [.], ack 56888, win 501, options [nop,nop,TS val 3828712599 ecr 2085646202], length 0
    13:58:07.470048 IP ************.36720 > ************.ldap: Flags [S], seq 2900996260, win 64240, options [mss 1460,sackOK,TS val 3828712604 ecr 0,nop,wscale 7], length 0
    13:58:07.470302 IP ************.36720 > ************.ldap: Flags [.], ack 520757461, win 502, options [nop,nop,TS val 3828712604 ecr 2085646208], length 0
    13:58:07.470377 IP ************.36720 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828712604 ecr 2085646208], length 53
    13:58:07.495038 IP ************.36720 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828712629 ecr 2085646232], length 0
    13:58:07.495194 IP ************.36720 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828712629 ecr 2085646232], length 173
    13:58:07.495877 IP ************.36720 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828712630 ecr 2085646233], length 116
    13:58:07.500132 IP ************.36720 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828712634 ecr 2085646237], length 0
    13:58:07.500500 IP ************.36720 > ************.ldap: Flags [.], ack 30018, win 436, options [nop,nop,TS val 3828712635 ecr 2085646238], length 0
    13:58:07.500669 IP ************.36720 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828712635 ecr 2085646238], length 0
    13:58:07.500850 IP ************.36720 > ************.ldap: Flags [.], ack 56887, win 444, options [nop,nop,TS val 3828712635 ecr 2085646238], length 0
    13:58:09.094806 IP ************.36720 > ************.ldap: Flags [P.], seq 342:349, ack 56887, win 501, options [nop,nop,TS val 3828714229 ecr 2085646238], length 7
    13:58:09.094939 IP ************.36720 > ************.ldap: Flags [F.], seq 349, ack 56887, win 501, options [nop,nop,TS val 3828714229 ecr 2085646238], length 0
    13:58:09.095404 IP ************.36720 > ************.ldap: Flags [.], ack 56888, win 501, options [nop,nop,TS val 3828714229 ecr 2085647833], length 0
    13:58:09.098907 IP ************.36732 > ************.ldap: Flags [S], seq 1370555433, win 64240, options [mss 1460,sackOK,TS val 3828714233 ecr 0,nop,wscale 7], length 0
    13:58:09.099196 IP ************.36732 > ************.ldap: Flags [.], ack 3880190268, win 502, options [nop,nop,TS val 3828714233 ecr 2085647836], length 0
    13:58:09.099271 IP ************.36732 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828714233 ecr 2085647836], length 53
    13:58:09.124264 IP ************.36732 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828714258 ecr 2085647861], length 0
    13:58:09.124373 IP ************.36732 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828714258 ecr 2085647861], length 173
    13:58:09.125066 IP ************.36732 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828714259 ecr 2085647862], length 116
    13:58:09.129316 IP ************.36732 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828714263 ecr 2085647867], length 0
    13:58:09.129708 IP ************.36732 > ************.ldap: Flags [.], ack 30018, win 436, options [nop,nop,TS val 3828714264 ecr 2085647867], length 0
    13:58:09.129774 IP ************.36732 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828714264 ecr 2085647867], length 0
    13:58:09.130036 IP ************.36732 > ************.ldap: Flags [.], ack 56887, win 444, options [nop,nop,TS val 3828714264 ecr 2085647867], length 0
    13:58:09.133689 IP ************.36732 > ************.ldap: Flags [P.], seq 342:349, ack 56887, win 501, options [nop,nop,TS val 3828714268 ecr 2085647867], length 7
    13:58:09.133709 IP ************.36732 > ************.ldap: Flags [F.], seq 349, ack 56887, win 501, options [nop,nop,TS val 3828714268 ecr 2085647867], length 0
    13:58:09.134114 IP ************.36732 > ************.ldap: Flags [.], ack 56888, win 501, options [nop,nop,TS val 3828714268 ecr 2085647871], length 0
    13:58:09.173453 IP ************.36734 > ************.ldap: Flags [S], seq 1524401404, win 64240, options [mss 1460,sackOK,TS val 3828714307 ecr 0,nop,wscale 7], length 0
    13:58:09.173741 IP ************.36734 > ************.ldap: Flags [.], ack 2415379641, win 502, options [nop,nop,TS val 3828714308 ecr 2085647911], length 0
    13:58:09.173831 IP ************.36734 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828714308 ecr 2085647911], length 53
    13:58:09.199226 IP ************.36734 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828714333 ecr 2085647936], length 0
    13:58:09.199360 IP ************.36734 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828714333 ecr 2085647936], length 173
    13:58:09.200884 IP ************.36734 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828714335 ecr 2085647937], length 116
    13:58:09.205092 IP ************.36734 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828714339 ecr 2085647942], length 0
    13:58:09.205432 IP ************.36734 > ************.ldap: Flags [.], ack 30018, win 436, options [nop,nop,TS val 3828714339 ecr 2085647943], length 0
    13:58:09.205580 IP ************.36734 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828714340 ecr 2085647943], length 0
    13:58:09.205786 IP ************.36734 > ************.ldap: Flags [.], ack 56887, win 444, options [nop,nop,TS val 3828714340 ecr 2085647943], length 0
    13:58:09.208379 IP ************.36734 > ************.ldap: Flags [P.], seq 342:349, ack 56887, win 501, options [nop,nop,TS val 3828714342 ecr 2085647943], length 7
    13:58:09.208410 IP ************.36734 > ************.ldap: Flags [F.], seq 349, ack 56887, win 501, options [nop,nop,TS val 3828714342 ecr 2085647943], length 0
    13:58:09.209295 IP ************.36734 > ************.ldap: Flags [.], ack 56888, win 501, options [nop,nop,TS val 3828714343 ecr 2085647946], length 0
    13:58:09.217254 IP ************.36750 > ************.ldap: Flags [S], seq 2990957480, win 64240, options [mss 1460,sackOK,TS val 3828714351 ecr 0,nop,wscale 7], length 0
    13:58:09.217956 IP ************.36750 > ************.ldap: Flags [.], ack 1422098238, win 502, options [nop,nop,TS val 3828714352 ecr 2085647955], length 0
    13:58:09.218006 IP ************.36750 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828714352 ecr 2085647955], length 53
    13:58:09.243974 IP ************.36750 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828714378 ecr 2085647981], length 0
    13:58:09.244091 IP ************.36750 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828714378 ecr 2085647981], length 173
    13:58:09.244821 IP ************.36750 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828714379 ecr 2085647982], length 116
    13:58:09.249163 IP ************.36750 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828714383 ecr 2085647986], length 0
    13:58:09.249572 IP ************.36750 > ************.ldap: Flags [.], ack 30018, win 436, options [nop,nop,TS val 3828714384 ecr 2085647987], length 0
    13:58:09.249628 IP ************.36750 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828714384 ecr 2085647987], length 0
    13:58:09.249921 IP ************.36750 > ************.ldap: Flags [.], ack 56887, win 444, options [nop,nop,TS val 3828714384 ecr 2085647987], length 0
    13:58:09.252009 IP ************.36750 > ************.ldap: Flags [P.], seq 342:349, ack 56887, win 501, options [nop,nop,TS val 3828714386 ecr 2085647987], length 7
    13:58:09.252206 IP ************.36750 > ************.ldap: Flags [F.], seq 349, ack 56887, win 501, options [nop,nop,TS val 3828714386 ecr 2085647987], length 0
    13:58:09.252360 IP ************.36750 > ************.ldap: Flags [.], ack 56888, win 501, options [nop,nop,TS val 3828714386 ecr 2085647990], length 0
    13:58:09.261655 IP ************.36764 > ************.ldap: Flags [S], seq 2935291792, win 64240, options [mss 1460,sackOK,TS val 3828714396 ecr 0,nop,wscale 7], length 0
    13:58:09.261978 IP ************.36764 > ************.ldap: Flags [.], ack 22195192, win 502, options [nop,nop,TS val 3828714396 ecr 2085647999], length 0
    13:58:09.262070 IP ************.36764 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828714396 ecr 2085647999], length 53
    13:58:09.286497 IP ************.36764 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828714420 ecr 2085648024], length 0
    13:58:09.286691 IP ************.36764 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828714421 ecr 2085648024], length 173
    13:58:09.287585 IP ************.36764 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828714422 ecr 2085648025], length 116
    13:58:09.291998 IP ************.36764 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828714426 ecr 2085648029], length 0
    13:58:09.292445 IP ************.36764 > ************.ldap: Flags [.], ack 30018, win 436, options [nop,nop,TS val 3828714426 ecr 2085648030], length 0
    13:58:09.292646 IP ************.36764 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828714427 ecr 2085648030], length 0
    13:58:09.292841 IP ************.36764 > ************.ldap: Flags [.], ack 56887, win 444, options [nop,nop,TS val 3828714427 ecr 2085648030], length 0
    13:58:09.305689 IP ************.36778 > ************.ldap: Flags [S], seq 509413159, win 64240, options [mss 1460,sackOK,TS val 3828714440 ecr 0,nop,wscale 7], length 0
    13:58:09.306027 IP ************.36778 > ************.ldap: Flags [.], ack 1980303834, win 502, options [nop,nop,TS val 3828714440 ecr 2085648043], length 0
    13:58:09.306108 IP ************.36778 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828714440 ecr 2085648043], length 53
    13:58:09.308257 IP ************.36786 > ************.ldap: Flags [S], seq 462324042, win 64240, options [mss 1460,sackOK,TS val 3828714442 ecr 0,nop,wscale 7], length 0
    13:58:09.308553 IP ************.36786 > ************.ldap: Flags [.], ack 3287020723, win 502, options [nop,nop,TS val 3828714443 ecr 2085648046], length 0
    13:58:09.308596 IP ************.36786 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828714443 ecr 2085648046], length 53
    13:58:09.333530 IP ************.36786 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828714467 ecr 2085648071], length 0
    13:58:09.333641 IP ************.36786 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828714468 ecr 2085648071], length 173
    13:58:09.333769 IP ************.36778 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828714468 ecr 2085648071], length 0
    13:58:09.333935 IP ************.36778 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828714468 ecr 2085648071], length 173
    13:58:09.334487 IP ************.36786 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828714468 ecr 2085648072], length 116
    13:58:09.334770 IP ************.36778 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828714469 ecr 2085648072], length 116
    13:58:09.338907 IP ************.36778 > ************.ldap: Flags [.], ack 8298, win 474, options [nop,nop,TS val 3828714473 ecr 2085648076], length 0
    13:58:09.339117 IP ************.36778 > ************.ldap: Flags [.], ack 15538, win 474, options [nop,nop,TS val 3828714473 ecr 2085648076], length 0
    13:58:09.339141 IP ************.36786 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828714473 ecr 2085648076], length 0
    13:58:09.339382 IP ************.36778 > ************.ldap: Flags [.], ack 25674, win 501, options [nop,nop,TS val 3828714473 ecr 2085648076], length 0
    13:58:09.339673 IP ************.36786 > ************.ldap: Flags [.], ack 30018, win 436, options [nop,nop,TS val 3828714474 ecr 2085648077], length 0
    13:58:09.339830 IP ************.36778 > ************.ldap: Flags [.], ack 47394, win 501, options [nop,nop,TS val 3828714474 ecr 2085648077], length 0
    13:58:09.339840 IP ************.36778 > ************.ldap: Flags [.], ack 56887, win 466, options [nop,nop,TS val 3828714474 ecr 2085648077], length 0
    13:58:09.340014 IP ************.36786 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828714474 ecr 2085648077], length 0
    13:58:09.340207 IP ************.36786 > ************.ldap: Flags [.], ack 47394, win 501, options [nop,nop,TS val 3828714474 ecr 2085648077], length 0
    13:58:09.340219 IP ************.36786 > ************.ldap: Flags [.], ack 56887, win 650, options [nop,nop,TS val 3828714474 ecr 2085648077], length 0
    13:58:09.344647 IP ************.36786 > ************.ldap: Flags [.], seq 342:1790, ack 56887, win 650, options [nop,nop,TS val 3828714479 ecr 2085648077], length 1448
    13:58:09.344684 IP ************.36786 > ************.ldap: Flags [.], seq 1790:3238, ack 56887, win 650, options [nop,nop,TS val 3828714479 ecr 2085648077], length 1448
    13:58:09.344693 IP ************.36786 > ************.ldap: Flags [.], seq 3238:4686, ack 56887, win 650, options [nop,nop,TS val 3828714479 ecr 2085648077], length 1448
    13:58:09.344698 IP ************.36786 > ************.ldap: Flags [.], seq 4686:6134, ack 56887, win 650, options [nop,nop,TS val 3828714479 ecr 2085648077], length 1448
    13:58:09.344703 IP ************.36786 > ************.ldap: Flags [P.], seq 6134:6983, ack 56887, win 650, options [nop,nop,TS val 3828714479 ecr 2085648077], length 849
    13:58:09.348036 IP ************.36778 > ************.ldap: Flags [P.], seq 342:349, ack 56887, win 501, options [nop,nop,TS val 3828714482 ecr 2085648077], length 7
    13:58:09.348062 IP ************.36778 > ************.ldap: Flags [F.], seq 349, ack 56887, win 501, options [nop,nop,TS val 3828714482 ecr 2085648077], length 0
    13:58:09.348494 IP ************.36778 > ************.ldap: Flags [.], ack 56888, win 501, options [nop,nop,TS val 3828714482 ecr 2085648086], length 0
    13:58:09.350639 IP ************.36796 > ************.ldap: Flags [S], seq 363542489, win 64240, options [mss 1460,sackOK,TS val 3828714485 ecr 0,nop,wscale 7], length 0
    13:58:09.350880 IP ************.36796 > ************.ldap: Flags [.], ack 2980172496, win 502, options [nop,nop,TS val 3828714485 ecr 2085648088], length 0
    13:58:09.350942 IP ************.36796 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828714485 ecr 2085648088], length 53
    13:58:09.376273 IP ************.36796 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828714510 ecr 2085648113], length 0
    13:58:09.376460 IP ************.36796 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828714510 ecr 2085648113], length 173
    13:58:09.377157 IP ************.36796 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828714511 ecr 2085648114], length 116
    13:58:09.381453 IP ************.36796 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828714515 ecr 2085648119], length 0
    13:58:09.381789 IP ************.36796 > ************.ldap: Flags [.], ack 30018, win 436, options [nop,nop,TS val 3828714516 ecr 2085648119], length 0
    13:58:09.381888 IP ************.36796 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828714516 ecr 2085648119], length 0
    13:58:09.382088 IP ************.36796 > ************.ldap: Flags [.], ack 56887, win 444, options [nop,nop,TS val 3828714516 ecr 2085648119], length 0
    13:58:09.384438 IP ************.36796 > ************.ldap: Flags [P.], seq 342:349, ack 56887, win 501, options [nop,nop,TS val 3828714518 ecr 2085648119], length 7
    13:58:09.384590 IP ************.36796 > ************.ldap: Flags [F.], seq 349, ack 56887, win 501, options [nop,nop,TS val 3828714519 ecr 2085648119], length 0
    13:58:09.384729 IP ************.36796 > ************.ldap: Flags [.], ack 56888, win 501, options [nop,nop,TS val 3828714519 ecr 2085648122], length 0
    13:58:09.404881 IP ************.36786 > ************.ldap: Flags [.], ack 91639, win 1193, options [nop,nop,TS val 3828714539 ecr 2085648142], length 0
    13:58:09.405173 IP ************.36786 > ************.ldap: Flags [.], ack 126391, win 1736, options [nop,nop,TS val 3828714539 ecr 2085648142], length 0
    13:58:09.405563 IP ************.36786 > ************.ldap: Flags [.], ack 129287, win 1781, options [nop,nop,TS val 3828714539 ecr 2085648142], length 0
    13:58:09.405574 IP ************.36786 > ************.ldap: Flags [.], ack 168383, win 2392, options [nop,nop,TS val 3828714539 ecr 2085648142], length 0
    13:58:09.405959 IP ************.36786 > ************.ldap: Flags [.], ack 208927, win 3025, options [nop,nop,TS val 3828714540 ecr 2085648143], length 0
    13:58:09.405985 IP ************.36786 > ************.ldap: Flags [.], ack 261055, win 3840, options [nop,nop,TS val 3828714540 ecr 2085648143], length 0
    13:58:09.406028 IP ************.36786 > ************.ldap: Flags [.], ack 266847, win 3930, options [nop,nop,TS val 3828714540 ecr 2085648143], length 0
    13:58:09.406037 IP ************.36786 > ************.ldap: Flags [.], ack 274087, win 4043, options [nop,nop,TS val 3828714540 ecr 2085648143], length 0
    13:58:09.406403 IP ************.36786 > ************.ldap: Flags [.], ack 339247, win 5061, options [nop,nop,TS val 3828714540 ecr 2085648143], length 0
    13:58:09.406756 IP ************.36786 > ************.ldap: Flags [.], ack 404407, win 6080, options [nop,nop,TS val 3828714541 ecr 2085648144], length 0
    13:58:09.406780 IP ************.36786 > ************.ldap: Flags [.], ack 431919, win 6509, options [nop,nop,TS val 3828714541 ecr 2085648144], length 0
    13:58:09.407002 IP ************.36786 > ************.ldap: Flags [.], ack 469567, win 7098, options [nop,nop,TS val 3828714541 ecr 2085648144], length 0
    13:58:09.407013 IP ************.36786 > ************.ldap: Flags [.], ack 481151, win 7279, options [nop,nop,TS val 3828714541 ecr 2085648144], length 0
    13:58:09.407019 IP ************.36786 > ************.ldap: Flags [.], ack 534727, win 8116, options [nop,nop,TS val 3828714541 ecr 2085648144], length 0
    13:58:09.407812 IP ************.36786 > ************.ldap: Flags [.], ack 599887, win 9134, options [nop,nop,TS val 3828714542 ecr 2085648144], length 0
    13:58:09.407838 IP ************.36786 > ************.ldap: Flags [.], ack 627399, win 9564, options [nop,nop,TS val 3828714542 ecr 2085648144], length 0
    13:58:09.407852 IP ************.36786 > ************.ldap: Flags [.], ack 665047, win 10152, options [nop,nop,TS val 3828714542 ecr 2085648144], length 0
    13:58:09.407860 IP ************.36786 > ************.ldap: Flags [.], ack 720071, win 9961, options [nop,nop,TS val 3828714542 ecr 2085648145], length 0
    13:58:09.407955 IP ************.36786 > ************.ldap: Flags [.], ack 730207, win 9968, options [nop,nop,TS val 3828714542 ecr 2085648145], length 0
    13:58:09.408369 IP ************.36786 > ************.ldap: Flags [.], ack 773647, win 10022, options [nop,nop,TS val 3828714542 ecr 2085648145], length 0
    13:58:09.408377 IP ************.36786 > ************.ldap: Flags [.], ack 795367, win 10393, options [nop,nop,TS val 3828714542 ecr 2085648145], length 0
    13:58:09.408668 IP ************.36786 > ************.ldap: Flags [.], ack 878780, win 10151, options [nop,nop,TS val 3828714543 ecr 2085648145], length 0
    13:58:09.415119 IP ************.36804 > ************.ldap: Flags [S], seq 2712613192, win 64240, options [mss 1460,sackOK,TS val 3828714549 ecr 0,nop,wscale 7], length 0
    13:58:09.415369 IP ************.36804 > ************.ldap: Flags [.], ack 1346662019, win 502, options [nop,nop,TS val 3828714549 ecr 2085648153], length 0
    13:58:09.415428 IP ************.36804 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828714549 ecr 2085648153], length 53
    13:58:09.429544 IP ************.36764 > ************.ldap: Flags [P.], seq 342:785, ack 56887, win 501, options [nop,nop,TS val 3828714563 ecr 2085648030], length 443
    13:58:09.441063 IP ************.36804 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828714575 ecr 2085648178], length 0
    13:58:09.441175 IP ************.36804 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828714575 ecr 2085648178], length 173
    13:58:09.442043 IP ************.36804 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828714576 ecr 2085648179], length 116
    13:58:09.443234 IP ************.36786 > ************.ldap: Flags [.], seq 6983:8431, ack 878780, win 10393, options [nop,nop,TS val 3828714577 ecr 2085648145], length 1448
    13:58:09.443270 IP ************.36786 > ************.ldap: Flags [.], seq 8431:9879, ack 878780, win 10393, options [nop,nop,TS val 3828714577 ecr 2085648145], length 1448
    13:58:09.443292 IP ************.36786 > ************.ldap: Flags [P.], seq 9879:11327, ack 878780, win 10393, options [nop,nop,TS val 3828714577 ecr 2085648145], length 1448
    13:58:09.443308 IP ************.36786 > ************.ldap: Flags [P.], seq 11327:11744, ack 878780, win 10393, options [nop,nop,TS val 3828714577 ecr 2085648145], length 417
    13:58:09.446952 IP ************.36804 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828714581 ecr 2085648184], length 0
    13:58:09.447340 IP ************.36804 > ************.ldap: Flags [.], ack 30018, win 436, options [nop,nop,TS val 3828714581 ecr 2085648185], length 0
    13:58:09.447375 IP ************.36804 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828714581 ecr 2085648185], length 0
    13:58:09.447659 IP ************.36804 > ************.ldap: Flags [.], ack 56887, win 444, options [nop,nop,TS val 3828714582 ecr 2085648185], length 0
    13:58:09.451172 IP ************.36804 > ************.ldap: Flags [P.], seq 342:349, ack 56887, win 501, options [nop,nop,TS val 3828714585 ecr 2085648185], length 7
    13:58:09.451189 IP ************.36804 > ************.ldap: Flags [F.], seq 349, ack 56887, win 501, options [nop,nop,TS val 3828714585 ecr 2085648185], length 0
    13:58:09.466601 IP ************.36804 > ************.ldap: Flags [F.], seq 349, ack 56887, win 501, options [nop,nop,TS val 3828714601 ecr 2085648185], length 0
    13:58:09.482627 IP ************.36764 > ************.ldap: Flags [.], ack 57119, win 501, options [nop,nop,TS val 3828714617 ecr 2085648179], length 0
    13:58:09.506152 IP ************.36804 > ************.ldap: Flags [.], ack 56888, win 501, options [nop,nop,TS val 3828714640 ecr 2085648243], length 0
    13:58:09.506468 IP ************.36786 > ************.ldap: Flags [.], ack 943940, win 10932, options [nop,nop,TS val 3828714640 ecr 2085648242], length 0
    13:58:09.507057 IP ************.36786 > ************.ldap: Flags [.], ack 1064124, win 10302, options [nop,nop,TS val 3828714641 ecr 2085648242], length 0
    13:58:09.507102 IP ************.36786 > ************.ldap: Flags [.], ack 1135076, win 9931, options [nop,nop,TS val 3828714641 ecr 2085648242], length 0
    13:58:09.507284 IP ************.36786 > ************.ldap: Flags [.], ack 1200236, win 9932, options [nop,nop,TS val 3828714641 ecr 2085648244], length 0
    13:58:09.508061 IP ************.36786 > ************.ldap: Flags [.], ack 1265396, win 10932, options [nop,nop,TS val 3828714642 ecr 2085648245], length 0
    13:58:09.508167 IP ************.36786 > ************.ldap: Flags [.], ack 1292908, win 10787, options [nop,nop,TS val 3828714642 ecr 2085648245], length 0
    13:58:09.508185 IP ************.36786 > ************.ldap: Flags [.], ack 1330556, win 10590, options [nop,nop,TS val 3828714642 ecr 2085648245], length 0
    13:58:09.508526 IP ************.36786 > ************.ldap: Flags [.], ack 1385580, win 10302, options [nop,nop,TS val 3828714642 ecr 2085648245], length 0
    13:58:09.508786 IP ************.36786 > ************.ldap: Flags [.], ack 1472460, win 10332, options [nop,nop,TS val 3828714642 ecr 2085648245], length 0
    13:58:09.509465 IP ************.36786 > ************.ldap: Flags [.], ack 1526036, win 10249, options [nop,nop,TS val 3828714643 ecr 2085648246], length 0
    13:58:09.509497 IP ************.36786 > ************.ldap: Flags [.], ack 1591196, win 10295, options [nop,nop,TS val 3828714643 ecr 2085648246], length 0
    13:58:09.509553 IP ************.36786 > ************.ldap: Flags [.], ack 1683868, win 10447, options [nop,nop,TS val 3828714643 ecr 2085648246], length 0
    13:58:09.509813 IP ************.36786 > ************.ldap: Flags [.], ack 1721516, win 10590, options [nop,nop,TS val 3828714644 ecr 2085648246], length 0
    13:58:09.509990 IP ************.36786 > ************.ldap: Flags [.], ack 1754091, win 10901, options [nop,nop,TS val 3828714644 ecr 2085648247], length 0
    13:58:09.520072 IP ************.36820 > ************.ldap: Flags [S], seq 2111786537, win 64240, options [mss 1460,sackOK,TS val 3828714654 ecr 0,nop,wscale 7], length 0
    13:58:09.520427 IP ************.36820 > ************.ldap: Flags [.], ack 266209166, win 502, options [nop,nop,TS val 3828714654 ecr 2085648258], length 0
    13:58:09.520489 IP ************.36820 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828714654 ecr 2085648258], length 53
    13:58:09.546198 IP ************.36820 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828714680 ecr 2085648283], length 0
    13:58:09.546325 IP ************.36820 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828714680 ecr 2085648283], length 173
    13:58:09.547110 IP ************.36820 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828714681 ecr 2085648284], length 116
    13:58:09.551332 IP ************.36820 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828714685 ecr 2085648288], length 0
    13:58:09.551733 IP ************.36820 > ************.ldap: Flags [.], ack 30018, win 436, options [nop,nop,TS val 3828714686 ecr 2085648289], length 0
    13:58:09.551775 IP ************.36820 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828714686 ecr 2085648289], length 0
    13:58:09.552054 IP ************.36820 > ************.ldap: Flags [.], ack 47394, win 501, options [nop,nop,TS val 3828714686 ecr 2085648289], length 0
    13:58:09.552089 IP ************.36820 > ************.ldap: Flags [.], ack 56887, win 459, options [nop,nop,TS val 3828714686 ecr 2085648289], length 0
    13:58:09.554921 IP ************.36820 > ************.ldap: Flags [P.], seq 342:349, ack 56887, win 501, options [nop,nop,TS val 3828714689 ecr 2085648289], length 7
    13:58:09.555037 IP ************.36820 > ************.ldap: Flags [F.], seq 349, ack 56887, win 501, options [nop,nop,TS val 3828714689 ecr 2085648289], length 0
    13:58:09.555379 IP ************.36820 > ************.ldap: Flags [.], ack 56888, win 501, options [nop,nop,TS val 3828714689 ecr 2085648293], length 0
    13:58:09.562542 IP ************.36834 > ************.ldap: Flags [S], seq 849641778, win 64240, options [mss 1460,sackOK,TS val 3828714696 ecr 0,nop,wscale 7], length 0
    13:58:09.562837 IP ************.36834 > ************.ldap: Flags [.], ack 2271629067, win 502, options [nop,nop,TS val 3828714697 ecr 2085648300], length 0
    13:58:09.562896 IP ************.36834 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828714697 ecr 2085648300], length 53
    13:58:09.588164 IP ************.36834 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828714722 ecr 2085648325], length 0
    13:58:09.588277 IP ************.36834 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828714722 ecr 2085648325], length 173
    13:58:09.589035 IP ************.36834 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828714723 ecr 2085648326], length 116
    13:58:09.593355 IP ************.36834 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828714727 ecr 2085648331], length 0
    13:58:09.593713 IP ************.36834 > ************.ldap: Flags [.], ack 30018, win 436, options [nop,nop,TS val 3828714728 ecr 2085648331], length 0
    13:58:09.593746 IP ************.36834 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828714728 ecr 2085648331], length 0
    13:58:09.594068 IP ************.36834 > ************.ldap: Flags [.], ack 56887, win 444, options [nop,nop,TS val 3828714728 ecr 2085648331], length 0
    13:58:09.599048 IP ************.36786 > ************.ldap: Flags [P.], seq 11744:11751, ack 1754091, win 10932, options [nop,nop,TS val 3828714733 ecr 2085648247], length 7
    13:58:09.599103 IP ************.36786 > ************.ldap: Flags [F.], seq 11751, ack 1754091, win 10932, options [nop,nop,TS val 3828714733 ecr 2085648247], length 0
    13:58:09.599130 IP ************.36764 > ************.ldap: Flags [P.], seq 785:792, ack 57119, win 501, options [nop,nop,TS val 3828714733 ecr 2085648179], length 7
    13:58:09.599234 IP ************.36764 > ************.ldap: Flags [F.], seq 792, ack 57119, win 501, options [nop,nop,TS val 3828714733 ecr 2085648179], length 0
    13:58:09.599328 IP ************.36834 > ************.ldap: Flags [P.], seq 342:349, ack 56887, win 501, options [nop,nop,TS val 3828714733 ecr 2085648331], length 7
    13:58:09.599358 IP ************.36834 > ************.ldap: Flags [F.], seq 349, ack 56887, win 501, options [nop,nop,TS val 3828714733 ecr 2085648331], length 0
    13:58:09.599720 IP ************.36786 > ************.ldap: Flags [.], ack 1754092, win 10932, options [nop,nop,TS val 3828714734 ecr 2085648337], length 0
    13:58:09.599721 IP ************.36834 > ************.ldap: Flags [.], ack 56888, win 501, options [nop,nop,TS val 3828714734 ecr 2085648337], length 0
    13:58:09.600016 IP ************.36764 > ************.ldap: Flags [.], ack 57120, win 501, options [nop,nop,TS val 3828714734 ecr 2085648337], length 0
    13:58:09.709905 IP ************.36840 > ************.ldap: Flags [S], seq 2768246589, win 64240, options [mss 1460,sackOK,TS val 3828714844 ecr 0,nop,wscale 7], length 0
    13:58:09.710211 IP ************.36840 > ************.ldap: Flags [.], ack 200882915, win 502, options [nop,nop,TS val 3828714844 ecr 2085648447], length 0
    13:58:09.710297 IP ************.36840 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828714844 ecr 2085648447], length 53
    13:58:09.734968 IP ************.36840 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828714869 ecr 2085648472], length 0
    13:58:09.735142 IP ************.36840 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828714869 ecr 2085648472], length 173
    13:58:09.736001 IP ************.36840 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828714870 ecr 2085648473], length 116
    13:58:09.742675 IP ************.36840 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828714877 ecr 2085648477], length 0
    13:58:09.743064 IP ************.36840 > ************.ldap: Flags [.], ack 30018, win 436, options [nop,nop,TS val 3828714877 ecr 2085648480], length 0
    13:58:09.743156 IP ************.36840 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828714877 ecr 2085648480], length 0
    13:58:09.743436 IP ************.36840 > ************.ldap: Flags [.], ack 56887, win 444, options [nop,nop,TS val 3828714877 ecr 2085648481], length 0
    13:58:11.295156 IP ************.36848 > ************.ldap: Flags [S], seq 4025616960, win 64240, options [mss 1460,sackOK,TS val 3828716429 ecr 0,nop,wscale 7], length 0
    13:58:11.295462 IP ************.36848 > ************.ldap: Flags [.], ack 4294906929, win 502, options [nop,nop,TS val 3828716429 ecr 2085650033], length 0
    13:58:11.295572 IP ************.36848 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828716430 ecr 2085650033], length 53
    13:58:11.320626 IP ************.36848 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828716455 ecr 2085650058], length 0
    13:58:11.320769 IP ************.36848 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828716455 ecr 2085650058], length 173
    13:58:11.321471 IP ************.36848 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828716455 ecr 2085650059], length 116
    13:58:11.325634 IP ************.36848 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828716460 ecr 2085650063], length 0
    13:58:11.326014 IP ************.36848 > ************.ldap: Flags [.], ack 30018, win 436, options [nop,nop,TS val 3828716460 ecr 2085650063], length 0
    13:58:11.326143 IP ************.36848 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828716460 ecr 2085650063], length 0
    13:58:11.326317 IP ************.36848 > ************.ldap: Flags [.], ack 56887, win 444, options [nop,nop,TS val 3828716460 ecr 2085650064], length 0
    13:58:12.850458 IP ************.36848 > ************.ldap: Flags [P.], seq 342:349, ack 56887, win 501, options [nop,nop,TS val 3828717984 ecr 2085650064], length 7
    13:58:12.850513 IP ************.36848 > ************.ldap: Flags [F.], seq 349, ack 56887, win 501, options [nop,nop,TS val 3828717984 ecr 2085650064], length 0
    13:58:12.850949 IP ************.36848 > ************.ldap: Flags [.], ack 56888, win 501, options [nop,nop,TS val 3828717985 ecr 2085651588], length 0
    13:58:12.859327 IP ************.36850 > ************.ldap: Flags [S], seq 1930668517, win 64240, options [mss 1460,sackOK,TS val 3828717993 ecr 0,nop,wscale 7], length 0
    13:58:12.859610 IP ************.36850 > ************.ldap: Flags [.], ack 1768774187, win 502, options [nop,nop,TS val 3828717994 ecr 2085651597], length 0
    13:58:12.859665 IP ************.36850 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828717994 ecr 2085651597], length 53
    13:58:12.889775 IP ************.36850 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828718024 ecr 2085651627], length 0
    13:58:12.889944 IP ************.36850 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828718024 ecr 2085651627], length 173
    13:58:12.890827 IP ************.36850 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828718025 ecr 2085651628], length 116
    13:58:12.895359 IP ************.36850 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828718029 ecr 2085651633], length 0
    13:58:12.895701 IP ************.36850 > ************.ldap: Flags [.], ack 30018, win 436, options [nop,nop,TS val 3828718030 ecr 2085651633], length 0
    13:58:12.895770 IP ************.36850 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828718030 ecr 2085651633], length 0
    13:58:12.895994 IP ************.36850 > ************.ldap: Flags [.], ack 56887, win 444, options [nop,nop,TS val 3828718030 ecr 2085651633], length 0
    13:58:12.899197 IP ************.36850 > ************.ldap: Flags [P.], seq 342:349, ack 56887, win 501, options [nop,nop,TS val 3828718033 ecr 2085651633], length 7
    13:58:12.899376 IP ************.36850 > ************.ldap: Flags [F.], seq 349, ack 56887, win 501, options [nop,nop,TS val 3828718033 ecr 2085651633], length 0
    13:58:12.899547 IP ************.36850 > ************.ldap: Flags [.], ack 56888, win 501, options [nop,nop,TS val 3828718034 ecr 2085651637], length 0
    13:58:12.908425 IP ************.36864 > ************.ldap: Flags [S], seq 3926167084, win 64240, options [mss 1460,sackOK,TS val 3828718042 ecr 0,nop,wscale 7], length 0
    13:58:12.908658 IP ************.36864 > ************.ldap: Flags [.], ack 945824287, win 502, options [nop,nop,TS val 3828718043 ecr 2085651646], length 0
    13:58:12.908731 IP ************.36864 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828718043 ecr 2085651646], length 53
    13:58:12.933367 IP ************.36864 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828718067 ecr 2085651671], length 0
    13:58:12.933511 IP ************.36864 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828718068 ecr 2085651671], length 173
    13:58:12.934231 IP ************.36864 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828718068 ecr 2085651671], length 116
    13:58:12.938386 IP ************.36864 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828718072 ecr 2085651676], length 0
    13:58:12.938732 IP ************.36864 > ************.ldap: Flags [.], ack 30018, win 436, options [nop,nop,TS val 3828718073 ecr 2085651676], length 0
    13:58:12.938796 IP ************.36864 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828718073 ecr 2085651676], length 0
    13:58:12.939010 IP ************.36864 > ************.ldap: Flags [.], ack 56887, win 444, options [nop,nop,TS val 3828718073 ecr 2085651676], length 0
    13:58:12.945954 IP ************.36864 > ************.ldap: Flags [P.], seq 342:349, ack 56887, win 501, options [nop,nop,TS val 3828718080 ecr 2085651676], length 7
    13:58:12.945993 IP ************.36864 > ************.ldap: Flags [F.], seq 349, ack 56887, win 501, options [nop,nop,TS val 3828718080 ecr 2085651676], length 0
    13:58:12.946393 IP ************.36864 > ************.ldap: Flags [.], ack 56888, win 501, options [nop,nop,TS val 3828718080 ecr 2085651684], length 0
    13:58:12.947891 IP ************.36870 > ************.ldap: Flags [S], seq 3679480375, win 64240, options [mss 1460,sackOK,TS val 3828718082 ecr 0,nop,wscale 7], length 0
    13:58:12.948165 IP ************.36870 > ************.ldap: Flags [.], ack 446735754, win 502, options [nop,nop,TS val 3828718082 ecr 2085651685], length 0
    13:58:12.948279 IP ************.36870 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828718082 ecr 2085651685], length 53
    13:58:12.974086 IP ************.36870 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828718108 ecr 2085651711], length 0
    13:58:12.974278 IP ************.36870 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828718108 ecr 2085651711], length 173
    13:58:12.975014 IP ************.36870 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828718109 ecr 2085651712], length 116
    13:58:12.979242 IP ************.36870 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828718113 ecr 2085651716], length 0
    13:58:12.979734 IP ************.36870 > ************.ldap: Flags [.], ack 18434, win 496, options [nop,nop,TS val 3828718114 ecr 2085651717], length 0
    13:58:12.980101 IP ************.36870 > ************.ldap: Flags [.], ack 47394, win 501, options [nop,nop,TS val 3828718114 ecr 2085651717], length 0
    13:58:12.980487 IP ************.36870 > ************.ldap: Flags [.], ack 56887, win 459, options [nop,nop,TS val 3828718114 ecr 2085651718], length 0
    13:58:12.990018 IP ************.36880 > ************.ldap: Flags [S], seq 3550710938, win 64240, options [mss 1460,sackOK,TS val 3828718124 ecr 0,nop,wscale 7], length 0
    13:58:12.990326 IP ************.36880 > ************.ldap: Flags [.], ack 351528325, win 502, options [nop,nop,TS val 3828718124 ecr 2085651728], length 0
    13:58:12.990410 IP ************.36880 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828718124 ecr 2085651728], length 53
    13:58:13.016034 IP ************.36880 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828718150 ecr 2085651753], length 0
    13:58:13.016229 IP ************.36880 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828718150 ecr 2085651753], length 173
    13:58:13.017182 IP ************.36880 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828718151 ecr 2085651754], length 116
    13:58:13.021527 IP ************.36880 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828718156 ecr 2085651759], length 0
    13:58:13.021969 IP ************.36880 > ************.ldap: Flags [.], ack 30018, win 436, options [nop,nop,TS val 3828718156 ecr 2085651759], length 0
    13:58:13.022160 IP ************.36880 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828718156 ecr 2085651759], length 0
    13:58:13.022325 IP ************.36880 > ************.ldap: Flags [.], ack 56887, win 444, options [nop,nop,TS val 3828718156 ecr 2085651760], length 0
    13:58:13.031772 IP ************.36884 > ************.ldap: Flags [S], seq 3332145960, win 64240, options [mss 1460,sackOK,TS val 3828718166 ecr 0,nop,wscale 7], length 0
    13:58:13.032073 IP ************.36884 > ************.ldap: Flags [.], ack 47103573, win 502, options [nop,nop,TS val 3828718166 ecr 2085651769], length 0
    13:58:13.032149 IP ************.36884 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828718166 ecr 2085651769], length 53
    13:58:13.057394 IP ************.36884 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828718191 ecr 2085651795], length 0
    13:58:13.057549 IP ************.36884 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828718192 ecr 2085651795], length 173
    13:58:13.058294 IP ************.36884 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828718192 ecr 2085651795], length 116
    13:58:13.062620 IP ************.36884 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828718197 ecr 2085651800], length 0
    13:58:13.063300 IP ************.36884 > ************.ldap: Flags [.], ack 21330, win 489, options [nop,nop,TS val 3828718197 ecr 2085651800], length 0
    13:58:13.063333 IP ************.36884 > ************.ldap: Flags [.], ack 32914, win 501, options [nop,nop,TS val 3828718197 ecr 2085651800], length 0
    13:58:13.063370 IP ************.36884 > ************.ldap: Flags [.], ack 41602, win 496, options [nop,nop,TS val 3828718197 ecr 2085651800], length 0
    13:58:13.063416 IP ************.36884 > ************.ldap: Flags [.], ack 44498, win 501, options [nop,nop,TS val 3828718197 ecr 2085651800], length 0
    13:58:13.064081 IP ************.36884 > ************.ldap: Flags [.], ack 47394, win 524, options [nop,nop,TS val 3828718198 ecr 2085651801], length 0
    13:58:13.064126 IP ************.36884 > ************.ldap: Flags [.], ack 50290, win 569, options [nop,nop,TS val 3828718198 ecr 2085651801], length 0
    13:58:13.064167 IP ************.36884 > ************.ldap: Flags [.], ack 53186, win 614, options [nop,nop,TS val 3828718198 ecr 2085651801], length 0
    13:58:13.064500 IP ************.36884 > ************.ldap: Flags [.], ack 56887, win 672, options [nop,nop,TS val 3828718198 ecr 2085651801], length 0
    13:58:13.071535 IP ************.36840 > ************.ldap: Flags [P.], seq 342:349, ack 56887, win 501, options [nop,nop,TS val 3828718205 ecr 2085648481], length 7
    13:58:13.072219 IP ************.36840 > ************.ldap: Flags [F.], seq 349, ack 56887, win 501, options [nop,nop,TS val 3828718206 ecr 2085648481], length 0
    13:58:13.072394 IP ************.36840 > ************.ldap: Flags [.], ack 56888, win 501, options [nop,nop,TS val 3828718206 ecr 2085651809], length 0
    13:58:13.074351 IP ************.36880 > ************.ldap: Flags [P.], seq 342:349, ack 56887, win 501, options [nop,nop,TS val 3828718208 ecr 2085651760], length 7
    13:58:13.074378 IP ************.36880 > ************.ldap: Flags [F.], seq 349, ack 56887, win 501, options [nop,nop,TS val 3828718208 ecr 2085651760], length 0
    13:58:13.074748 IP ************.36880 > ************.ldap: Flags [.], ack 56888, win 501, options [nop,nop,TS val 3828718209 ecr 2085651812], length 0
    13:58:13.178645 IP ************.36896 > ************.ldap: Flags [S], seq 1186508841, win 64240, options [mss 1460,sackOK,TS val 3828718313 ecr 0,nop,wscale 7], length 0
    13:58:13.178966 IP ************.36896 > ************.ldap: Flags [.], ack 2736512187, win 502, options [nop,nop,TS val 3828718313 ecr 2085651916], length 0
    13:58:13.179079 IP ************.36896 > ************.ldap: Flags [P.], seq 0:53, ack 1, win 502, options [nop,nop,TS val 3828718313 ecr 2085651916], length 53
    13:58:13.208012 IP ************.36896 > ************.ldap: Flags [.], ack 15, win 502, options [nop,nop,TS val 3828718342 ecr 2085651945], length 0
    13:58:13.208148 IP ************.36896 > ************.ldap: Flags [P.], seq 53:226, ack 15, win 502, options [nop,nop,TS val 3828718342 ecr 2085651945], length 173
    13:58:13.209168 IP ************.36896 > ************.ldap: Flags [P.], seq 226:342, ack 1058, win 501, options [nop,nop,TS val 3828718343 ecr 2085651946], length 116
    13:58:13.219795 IP ************.36896 > ************.ldap: Flags [.], ack 15538, win 436, options [nop,nop,TS val 3828718354 ecr 2085651957], length 0
    13:58:13.220324 IP ************.36896 > ************.ldap: Flags [.], ack 30018, win 436, options [nop,nop,TS val 
...

Can you help to solve this? Is there others related in this issue?

Thank yout!

BR.,
Z

StefanU · May '24

Hi Zoltán.

Please always write the version.
Otherwise nobody will be able to judge later on which version a problem occurs.

Is that new or have you only just realised it?

Basically, we have built in functions (sync, chache) so that EGw can also work with AD with several thousand users.

Do you have your user accounts in the EGw database?

Stefan

somogyi · May '24

Hi!

Our version: egroupware-docker (23.1.20240430)

The problem is not new, but we tried to find issues in our systems, but we cant find anything.
The users not stored in Egroupware DB, only in Active Directory.

The sync feature is not an option for as, because we use egroupware to edit some user attributes.

BR.,
Z

RalfBecker · May '24

Authentication with AD is cached, but you’re not just authenticating.

All accounts, memberships and groups are read from your AD.
If you decode the TCP dump, e.g. with Wireshark, I’m pretty sure it will not show authentication requests.

Ok, you use EGroupware to update / maintain your AD.

That’s fine, thought in that scenario the sync won’t update the AD, it only allows to update attributes not set in AD and maintain them within EGroupware.

It’s planned to allow updates in direction of the AD, when using the sync, but that’s not yet implemented.

Organizations to sponsor improvements are always welcome

Ralf

somogyi · May '24

Hi Ralf!

We were switched to periodic import instead pure Active Directory accounts. BUT the ldap requests doesn’t stop. Probably the issue source is the groupdav.

When the ldap request flood starts the nginx logs show this path: /egroupware/groupdav.php/*****/calendar/ HTTP/2.0" 207 168 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:115.0) Gecko/20100101 Thunderbird/115.10.2”

Can you make a test with a Thunderbird client that is connected to an eGroupware caldav calendar?

BR.,
Z

Topic	Category	Replies	Views	Activity
Disable Sieve server	English	4	518	Jul '24
Calendar permission issue	English	1	193	Sep '24
Call to undefined function adodb_date()	English	5	232	Oct '24
eGW 1.8.007 - upgrade to current version or run the old version	English	4	236	Nov '24
No notifications on incoming mail / no auto refresh	English	2	113	Dec '24

A lot of LDAP request at one page load

created

last reply

replies

views

users

Suggested Topics

Want to read more? Browse other topics in English or view latest topics.

A lot of LDAP request at one page load

created

last reply

replies

views

users

Suggested Topics

Want to read more? Browse other topics in English or view latest topics.

share a link to this topic