I am trying to troubleshoot slow file transfers between certain agents that are located in different security zones and firewalls federate the traffic between agents.
For agents within a security zone, it takes about 3 minutes to upload a full upgrade file (500MB+), vs 20 minutes+ for uploading to agents in a different security zone through the firewall.
After doing a wireshark, it looks like we are sending an HTTP message over port 8004 that has an encrypted payload. Is this a file transfer packet?
If not, what method are we using to transfer upgrade packages between agents in a cluster?
The HTTP requests you're seeing are the .NET Remoting (which is actually wrapped in HTTP communication) that DataMiner uses to communicate with clients and other DataMiner agents. (these are compressed and encrypted)
The upgrade package will indeed transfer over these .NET Remoting (or HTTP) requests.
As additional information: the files for upgrade packets are uploaded in chunks of 100 KB. If the agents are configured to use encrypted connections (which is the default nowadays), the data in those chunks will also be encrypted.