Tinc sudden spike in traffic usage

[Daniel Lo Nigro]

I just encountered a weird issue on my servers - Tinc was using a constant
10-50% CPU on several servers, and these servers were also receiving a
constant ~3 Mb/s of data over the Tinc interface, which is usually
otherwise pretty quiet.

Example: https://d.sb/2019/04/firefox_11-15.54.22.png
Grafana dashboard:
https://dash.d.sb/dashboard/snapshot/6nWZqagpgxzxUrybDZkNbF6JSflLlKmO?orgId=1

This seems to have all been coming from one system, as I noticed that a
single system was using ~18 Mb/s outbound:
https://d.sb/2019/04/firefox_11-15.55.30.png. As soon as I restarted Tinc
on this server, all the traffic stopped.

The only relevant thing I see in the logs is a lot of these messages:

Apr 11 15:35:20 host tinc.vpn[6223]: Can't write to Linux tun/tap device
(tun mode) /dev/net/tun: Input/output error
Apr 11 15:35:20 host tinc.vpn[6223]: Can't write to Linux tun/tap device
(tun mode) /dev/net/tun: Input/output error
Apr 11 15:35:20 host tinc.vpn[6223]: Can't write to Linux tun/tap device
(tun mode) /dev/net/tun: Input/output error
Apr 11 15:35:20 host tinc.vpn[6223]: Can't write to Linux tun/tap device
(tun mode) /dev/net/tun: Input/output error
Apr 11 15:35:20 host tinc.vpn[6223]: Can't write to Linux tun/tap device
(tun mode) /dev/net/tun: Input/output error
Apr 11 15:35:20 host tinc.vpn[6223]: Can't write to Linux tun/tap device
(tun mode) /dev/net/tun: Input/output error
Apr 11 15:35:20 host tinc.vpn[6223]: Can't write to Linux tun/tap device
(tun mode) /dev/net/tun: Input/output error
Apr 11 15:35:20 host tinc.vpn[6223]: Can't write to Linux tun/tap device
(tun mode) /dev/net/tun: Input/output error
Apr 11 15:35:20 host tinc.vpn[6223]: Can't write to Linux tun/tap device
(tun mode) /dev/net/tun: Input/output error
Apr 11 15:35:20 host tinc.vpn[6223]: Can't write to Linux tun/tap device
(tun mode) /dev/net/tun: Input/output error

Any ideas what could cause this, or how to debug what Tinc was doing?

Most systems are Debian Testing with Tinc 1.0.35, and one is Windows Server
2016 with Tinc 1.0.35.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.tinc-vpn.org/pipermail/tinc/attachments/20190411/a08a91ea/attachment.html>