1
Diagnostic step 1
Capture simultaneous pcaps on LAN, WAN1, and WAN2 during an affected transfer and compare TCP sequence numbers and NAT mapping to prove which interface carries which packets and whether NAT entries are recreated.
FULL AI ANALYSIS
Dual‑WAN Edge Router Sends HTTPS Traffic Out Slower Link Despite Healthy Primary — Large TCP Transfers Stall
Generated Oct 3, 2026, 12:35:03 AM
Analysis summary
Symptoms fit asymmetric path selection or a routing decision change inside the edge device after connection establishment (policy/failover re-evaluation, per‑flow hashing bug, or broken session‑affinity). Large TCP transfers are more sensitive because retransmits expose return path asymmetry and MTU/MSS interactions. Router firmware or NAT implementation may be switching next‑hop for established connections based on external conditions (e.g., perceived congestion, probe failures, or incorrect sticky hashing).
Possible causes
Router bug in policy-based routing module that recalculates next‑hop for existing NAT sessions after periodic health checks (per‑flow affinity not honored).
85%NAT/connection-tracking table entry corruption or exhaustion causing recreation of sessions that get hashed to WAN2 for subsequent packets.
40%MSS/MTU mismatch on WAN1 leading to stalled large transfers; router heuristics mark WAN1 as degraded for large flows and shift them to WAN2, while small flows continue on WAN1.
35%Asymmetric routing due to upstream path change: BGP/ISP rebalancing causes inbound/outbound asymmetry and the router interprets probe results as WAN1 degradation only for certain flows.
10%Suggested fixes
2
Diagnostic step 2
Enable persistent per‑flow session affinity (source IP + port sticky NAT) if your router supports it; document current settings and apply change temporarily for testing, then revert if no improvement.
3
Diagnostic step 3
Test large transfer from a host directly attached to WAN1 (or via a bridged test device) to confirm WAN1 path capacity and MTU independent of router policy logic.
4
Diagnostic step 4
Temporarily disable automatic failover heuristics and set a hard policy to force all traffic from the test client out WAN1 for the duration of a single transfer; observe whether stall disappears—this narrows cause to router policy logic vs upstream path.
5
Diagnostic step 5
Check connection-tracking table size and system logs for conntrack drops; increase conntrack limits temporarily and monitor whether sessions remain on WAN1 during long transfers (reversible via sysctl). Escalate to router vendor with captured pcaps and router log snippets if firmware bug is suspected.