I have a monitor that loads https://www.openwrt.org as a way to check my connectivity and speed. It normally takes 3-4 seconds to load the page, and I've been running this for over a year.
Starting on Oct. 26 around 11 AM EST, the loading time increased dramatically and is now averaging 50 seconds to load. I did a Wireshark trace on it, and I see a considerable number of TCP errors and re-sends.
It's not necessarily php-fpm that is misbehaving, it actually behaves how it is configured (and was configured before the maintenance). The real problem is either something in the dokuwiki code, or the system is simply overloaded.
It's much faster now via my web browser. I'm still seeing times of ~40 seconds in my monitoring software, but I suspect that's an issue of the monitor, not the web site.
For the record, I do still see a reasonable amount of TCP duplicate ACKs and out of order packets even when the site loads quickly in my browser. I'd be curious to know if anyone else runs a Wireshark trace and sees (or doesn't see) what I'm seeing.
Just as a side note, please don't. Automated ping tests like these do create a quite massive base load, which can easily overload the server resources of most smaller (opensource) projects without the pockets for big cdn offloading.
Please prefer big (commercial) cdn/ data centre backed servers for tests like these, google, facebook, amazon et al are better suited to deal with this kind of DDoS attack.
Ok, so you are now continuously probing a DDoS protection system instead?
Well they will probably handle your traffic without overloading but they will also look at your IP and wondering what DDoS bot you have in your router😂
Why are you probing and wiresharking so much to begin with just for the sake of see if you have internet and how fast it is?