on 12-11-2008 10:08 AM Steve Snyder spake the following:
The traffic is a combination of tunneled VNC (to Win2K), tunneled Remote Desktop (to WinXP), and interactive command line (to Linux) sessions.
For the first two types (VNC & RD), the image data is compressed before entering the encrypted tunnel. For the last traffic type there are a lot of small packets, owning to the nature of keyboard activity.
Thanks.
Do you have ssh also trying to compress the tunnel with the already compressed packets? That could add to the CPU time trying to compress twice.