[SOLVED] Server respond late to requests

[csabix]

Hello all


Does anybody know why my server responds in such a lazy manner? It doesn't matter if I try to connect to it via SSH, FTP or HTTP. It takes more than 5 seconds to reply.
I checked traffic and it's all OK, no huge load, no nothing. Neither is the processor under load.
Any ideas are appreciated.
Thanks!

[dasein]

Does the problem occur if you connect via numeric IP address?

(If not, then this is most probably a DNS issue, or perhaps a problem with IPv6.)

[csabix]

Yes, it happens using IP and domain name, too. And no matter if I connect from LAN or from the outside.

[dasein]

Next thing to eliminate is hardware. Any switches/routers should be swapped out or bypassed; disable any mobo NIC on the server and pop in a spare.

[csabix]

I connected the PC directly to the server.Same result. Also tried via wi-fi (tablet). It seemed a little bit faster (with one second?) but not sure yet.
I wonder if Fail2ban or Monitorix could have had an update and analysing incoming traffic takes to much time.

[dasein]

I connected the PC directly to the server.Same result.

That eliminates the router, but not a flaky NIC on the server. The easiest way to eliminate a dying-but-not-yet-dead NIC is to try to reproduce the problem in an environment other than Debian.

I wonder if Fail2ban or Monitorix...

It woulda been soooooo handy if you'd mentioned these in your OP.
At the risk of overstating the obvious, anything that potentially affects traffic should be disabled while you're doing diagnostics.

You know what you have to do, now the only thing left is for you to do them.

Good luck.

[csabix]

Defective NIC is excluded since connecting through wi-fi yields similar phenomenon (wi-fi is coming from the server via a PCIe wireless card).
I stopped fail2ban and monitorix but no change.

Regarding NIC: after connecting, all commands are transmitted to server in a flash. Also, feedback (like top, htop etc) is instant. File transfers are also fast. It's "just" the first connection to the server that takes time
This is annoying me for two reasons:
- it worked perfect until recently
- sometimes botnets are trying my passwords or flooding with page requests and I want to connect ASAP to kick them in the ass

[csabix]

Found the solution!

The server makes use of a file called iptables.rules (made by me) in order to store NAT and ip denial info. There have been some duplicate lines, probably due to the way Monitorix or Fail2ban work when the user executes iptables-save > iptables.rules.
After cleaning out the file, connecting to server was instant, versus 5-8 seconds before the cleanup.

Thank you all for the supportive attitude!