Re: TIME_WAIT connections

From: Troy E. Ablan (chaser@mewl.net)
Date: Mon Jun 19 2000 - 05:20:56 EST


TIME_WAIT will linger for twice the value of the "maximum segment
lifetime" (MSL)

"Every implemenation of TCP must choose a value for the MSL. The
recommended value in RDC 1122 is 2 minutes, although Berkeley-derived
implementations have traditionally used a value of 30 seconds
instead. This means the duration of the TIME_WAIT state is between 1 and
4 minutes. The MSL is the maximum amount of time that any given IP
datagram can live in an internet."
[UNP Volume 1, W. R. Stevens]

Your TCP/IP stack keeps this state information to allow TCP connections to
terminate reliably. For instance, if host A src port 1222 connects to
host B port 23, and then disconnects, on a network connection prone to
losing packets, and it just happens to lose the final ACK sent by the
server, the client can now resend its FIN, and the server will respond
with an ACK (since the socket is in TIME_WAIT), rather than an RST (as if
the connection didn't exist).

This behavior can be seen on any terminated TCP connection, and you can
now tell that you have had 4054 sockets closed within the last (2 *
MSL), which can be used as a sort of "scoreboard". :)

-Troy

On Mon, 19 Jun 2000, Daniel Podlejski wrote:

> # netstat -a -n|grep ".80 "|cut -c 68-|sort|uniq -c|sort -n
> 6 LISTEN
> 36 LAST_ACK
> 53 CLOSING
> 61 CLOSE
> 68 SYN_RECV
> 157 FIN_WAIT2
> 225 FIN_WAIT1
> 369 ESTABLISHED
> 4054 TIME_WAIT
>
> Machine is web serwer with reather big traffic. Why there is
> so much connections in TIME_WAIT state ?
>
> Similar problem was in FreeBSD 3.x, but in 4.0 there is better.
> Connections in TIME_WAIT state is below 500.
>
>

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Fri Jun 23 2000 - 21:00:16 EST