* ip_conntrack CLOSE_WAIT issue.
@ 2004-01-27 21:23 Dirk Morris
2004-01-27 21:38 ` Dirk Morris
2004-01-28 15:43 ` Jozsef Kadlecsik
0 siblings, 2 replies; 4+ messages in thread
From: Dirk Morris @ 2004-01-27 21:23 UTC (permalink / raw)
To: netfilter-devel
my conntrack table on machines are building up with tons of connections
in the CLOSE_WAIT state.
Because the timeout is so long, they stick around until the table fills up.
Why are these connections not transitioning to the full closed state?
tcpdump shows that the full Fin/Fin-Ack/Ack takes place at the end of
these connections, but they still stick around.
In the following example, timmy is running an echo server on port 7000.
~ # cat /proc/net/ip_conntrack| grep 7000 [dmorris @
timmy]
<nothing>
~ # s tcpdump "host bebe" [dmorris @ timmy]
...
13:10:15.436354 bebe.43035 > timmy.7000: . ack 10 win 5840
<nop,nop,timestamp 164347449 1498713> (DF)
13:10:17.702593 bebe.43035 > timmy.7000: F 10:10(0) ack 10 win 5840
<nop,nop,timestamp 164347675 1498713> (DF)
13:10:17.702841 timmy.7000 > bebe.43035: F 10:10(0) ack 11 win 5792
<nop,nop,timestamp 1500980 164347675> (DF)
13:10:17.703086 bebe.43035 > timmy.7000: . ack 11 win 5840
<nop,nop,timestamp 164347675 1500980> (DF)
now on bebe I did:
~ # netcat timmy 7000 [dmorris
@ bebe]
aoesutnh
aoesutnh
Ctrl-C
~#
This causes the connection opening (not shown) and closing you see in
the tcpdump above.
But the connection never leaves the conntrack table.
~ # cat /proc/net/ip_conntrack| grep 7000 [dmorris @
timmy]
tcp 6 257147 CLOSE_WAIT src=10.0.0.44 dst=10.0.0.187 sport=43035
dport=7000 src=10.0.0.187 dst=10.0.0.44 sport=7000 dport=43035 [ASSURED]
use=1
I realize I could just turn
/proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_close_wait, is
that the fix or is this not supposed to happen?
This happens on two similar machines, in both 2.4.18 and 2.6.0-test8
info on timmy:
~
#
[dmorris @ timmy]
~ # uname
-a
[dmorris @ timmy]
Linux timmy 2.6.0-test8 #4 SMP Tue Dec 16 15:55:23 PST 2003 i686 unknown
~ # ifconfig
eth0
[dmorris @ timmy]
eth0 Link encap:Ethernet HWaddr 00:40:05:A0:20:07
inet addr:10.0.0.187 Bcast:10.0.0.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:6487 errors:1 dropped:0 overruns:0 frame:0
TX packets:5717 errors:24 dropped:0 overruns:0 carrier:24
collisions:0 txqueuelen:1000
RX bytes:793932 (775.3 KiB) TX bytes:1599858 (1.5 MiB)
Interrupt:11 Base address:0xac00
~ # netstat
-rn
[dmorris @ timmy]
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt
Iface
10.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0
eth0
0.0.0.0 10.0.0.1 0.0.0.0 UG 0 0 0
eth0
~ # netstat | grep CLOSE_WAIT | wc
-l [dmorris @ timmy]
0
~ # cat /proc/net/ip_conntrack| grep CLOSE_WAIT | wc
-l [dmorris @ timmy]
10
Thanks,
-Dirk
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: ip_conntrack CLOSE_WAIT issue.
2004-01-27 21:23 ip_conntrack CLOSE_WAIT issue Dirk Morris
@ 2004-01-27 21:38 ` Dirk Morris
2004-01-28 9:01 ` Harald Welte
2004-01-28 15:43 ` Jozsef Kadlecsik
1 sibling, 1 reply; 4+ messages in thread
From: Dirk Morris @ 2004-01-27 21:38 UTC (permalink / raw)
To: Dirk Morris; +Cc: netfilter-devel
My apologies,
I believe this is related to an experimental patch that I am using, and
is not conntrack related.
Conntrack nevers sees the first FIN, which would explain this behavior.
-Dirk
Dirk Morris wrote:
> my conntrack table on machines are building up with tons of
> connections in the CLOSE_WAIT state.
> Because the timeout is so long, they stick around until the table
> fills up.
>
> Why are these connections not transitioning to the full closed state?
> tcpdump shows that the full Fin/Fin-Ack/Ack takes place at the end of
> these connections, but they still stick around.
>
>
> In the following example, timmy is running an echo server on port 7000.
>
>
> ~ # cat /proc/net/ip_conntrack| grep 7000 [dmorris
> @ timmy]
> <nothing>
>
> ~ # s tcpdump "host bebe" [dmorris @
> timmy]
> ...
> 13:10:15.436354 bebe.43035 > timmy.7000: . ack 10 win 5840
> <nop,nop,timestamp 164347449 1498713> (DF)
> 13:10:17.702593 bebe.43035 > timmy.7000: F 10:10(0) ack 10 win 5840
> <nop,nop,timestamp 164347675 1498713> (DF)
> 13:10:17.702841 timmy.7000 > bebe.43035: F 10:10(0) ack 11 win 5792
> <nop,nop,timestamp 1500980 164347675> (DF)
> 13:10:17.703086 bebe.43035 > timmy.7000: . ack 11 win 5840
> <nop,nop,timestamp 164347675 1500980> (DF)
>
> now on bebe I did:
>
> ~ # netcat timmy 7000
> [dmorris @ bebe]
> aoesutnh
> aoesutnh
>
> Ctrl-C
> ~#
>
> This causes the connection opening (not shown) and closing you see in
> the tcpdump above.
>
> But the connection never leaves the conntrack table.
>
> ~ # cat /proc/net/ip_conntrack| grep 7000 [dmorris
> @ timmy]
> tcp 6 257147 CLOSE_WAIT src=10.0.0.44 dst=10.0.0.187 sport=43035
> dport=7000 src=10.0.0.187 dst=10.0.0.44 sport=7000 dport=43035
> [ASSURED] use=1
>
>
> I realize I could just turn
> /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_close_wait, is
> that the fix or is this not supposed to happen?
> This happens on two similar machines, in both 2.4.18 and 2.6.0-test8
>
>
>
> info on timmy:
>
> ~
> #
> [dmorris @ timmy]
> ~ # uname
> -a
> [dmorris @ timmy]
> Linux timmy 2.6.0-test8 #4 SMP Tue Dec 16 15:55:23 PST 2003 i686 unknown
> ~ # ifconfig
> eth0
> [dmorris @ timmy]
> eth0 Link encap:Ethernet HWaddr 00:40:05:A0:20:07 inet
> addr:10.0.0.187 Bcast:10.0.0.255 Mask:255.255.255.0
> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
> RX packets:6487 errors:1 dropped:0 overruns:0 frame:0
> TX packets:5717 errors:24 dropped:0 overruns:0 carrier:24
> collisions:0 txqueuelen:1000
> RX bytes:793932 (775.3 KiB) TX bytes:1599858 (1.5 MiB)
> Interrupt:11 Base address:0xac00
>
> ~ # netstat
> -rn
> [dmorris @ timmy]
> Kernel IP routing table
> Destination Gateway Genmask Flags MSS Window
> irtt Iface
> 10.0.0.0 0.0.0.0 255.255.255.0 U 0 0
> 0 eth0
> 0.0.0.0 10.0.0.1 0.0.0.0 UG 0 0
> 0 eth0
> ~ # netstat | grep CLOSE_WAIT | wc
> -l [dmorris @
> timmy]
> 0
> ~ # cat /proc/net/ip_conntrack| grep CLOSE_WAIT | wc
> -l [dmorris @ timmy]
> 10
>
>
> Thanks,
> -Dirk
>
>
>
>
>
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: ip_conntrack CLOSE_WAIT issue.
2004-01-27 21:38 ` Dirk Morris
@ 2004-01-28 9:01 ` Harald Welte
0 siblings, 0 replies; 4+ messages in thread
From: Harald Welte @ 2004-01-28 9:01 UTC (permalink / raw)
To: Dirk Morris; +Cc: netfilter-devel
[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]
On Tue, Jan 27, 2004 at 01:38:38PM -0800, Dirk Morris wrote:
> My apologies,
>
> I believe this is related to an experimental patch that I am using, and
> is not conntrack related.
> Conntrack nevers sees the first FIN, which would explain this behavior.
It has to be. ip_conntrack_proto_tcp uses:
unsigned long ip_ct_tcp_timeout_fin_wait = 2 MINS;
unsigned long ip_ct_tcp_timeout_close_wait = 60 SECS;
unsigned long ip_ct_tcp_timeout_last_ack = 30 SECS;
unsigned long ip_ct_tcp_timeout_time_wait = 2 MINS;
unsigned long ip_ct_tcp_timeout_close = 10 SECS;
So I see no way you could end up with this:
> >tcp 6 257147 CLOSE_WAIT src=10.0.0.44 dst=10.0.0.187 sport=43035
> >dport=7000 src=10.0.0.187 dst=10.0.0.44 sport=7000 dport=43035
> >[ASSURED] use=1
--
- Harald Welte <laforge@netfilter.org> http://www.netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: ip_conntrack CLOSE_WAIT issue.
2004-01-27 21:23 ip_conntrack CLOSE_WAIT issue Dirk Morris
2004-01-27 21:38 ` Dirk Morris
@ 2004-01-28 15:43 ` Jozsef Kadlecsik
1 sibling, 0 replies; 4+ messages in thread
From: Jozsef Kadlecsik @ 2004-01-28 15:43 UTC (permalink / raw)
To: Dirk Morris; +Cc: netfilter-devel
On Tue, 27 Jan 2004, Dirk Morris wrote:
> I realize I could just turn
> /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_close_wait, is
> that the fix or is this not supposed to happen?
> This happens on two similar machines, in both 2.4.18 and 2.6.0-test8
What version of the TCP window tracking code do you run?
Best regards,
Jozsef
-
E-mail : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
H-1525 Budapest 114, POB. 49, Hungary
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2004-01-28 15:43 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-01-27 21:23 ip_conntrack CLOSE_WAIT issue Dirk Morris
2004-01-27 21:38 ` Dirk Morris
2004-01-28 9:01 ` Harald Welte
2004-01-28 15:43 ` Jozsef Kadlecsik
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.