Network oddity....

Network oddity....

[Rogier Wolff]

Hi all, 

I have a server, and it reports ("netstat -a")

tcp        0      0 server:ssh    client:1022 SYN_RECV

This sounds normal right?

However there are 79 of these lines in the netstat output. Not normal!

A TCP connection is identified by the 12 bytes source IP, dest IP,
source port, dest port. Right? Then as far as I can see, these should
all refer to the SAME socket. (yes, they all refer to server:ssh, and
client: 1022!)

Oh, this situation seems to continue: it sends a syn-ack and then the
client replies with a reset. This goes on and on. I'm going to make
the client disappear, and hope that this makes the number of these
connections go away.

Kernel is 2.2.13. That was "fresh" when the system was booted. Yes,
that's over 14 months ago. 

				Roger. 

-- 
** R.E.Wolff@BitWizard.nl ** http://www.BitWizard.nl/ ** +31-15-2137555 **
*-- BitWizard writes Linux device drivers for any device you may have! --*
* There are old pilots, and there are bold pilots. 
* There are also old, bald pilots. 
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

Re: Network oddity....

[Devik]

Interesting,
yesterday I have TCP problems with my three independent systems.
They all acts as simple firewalls with MASQ. Yesterday they all
suddenly stopped responding to ssh TCP connections to IP on eth1 
(internal net) but they continued to work on IP attached to eth0 
and lo. The problem survived reboot. Then it suddenly ceased and 
I can't trigger it again.
Kernels was 2.2.13, 2.2.16 and 2.2.17 and the systems was
completely unrelated.
Kind of woodoo or what ...
devik


> Oh, this situation seems to continue: it sends a syn-ack and then the
> client replies with a reset. This goes on and on. I'm going to make
> the client disappear, and hope that this makes the number of these
> connections go away.
> 
> Kernel is 2.2.13. That was "fresh" when the system was booted. Yes,
> that's over 14 months ago. 

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

Re: Network oddity....

[Mike A. Harris]

On Fri, 5 Jan 2001, Rogier Wolff wrote:

>Date: Fri, 5 Jan 2001 01:08:49 +0100 (MET)
>From: Rogier Wolff <R.E.Wolff@BitWizard.nl>
>To: linux-kernel@vger.kernel.org
>Content-Type: text/plain; charset=US-ASCII
>Subject: Network oddity....
>
>
>Hi all,
>
>I have a server, and it reports ("netstat -a")
>
>tcp        0      0 server:ssh    client:1022 SYN_RECV
>
>This sounds normal right?
>
>However there are 79 of these lines in the netstat output. Not normal!
>
>A TCP connection is identified by the 12 bytes source IP, dest IP,
>source port, dest port. Right? Then as far as I can see, these should
>all refer to the SAME socket. (yes, they all refer to server:ssh, and
>client: 1022!)
>
>Oh, this situation seems to continue: it sends a syn-ack and then the
>client replies with a reset. This goes on and on. I'm going to make
>the client disappear, and hope that this makes the number of these
>connections go away.
>
>Kernel is 2.2.13. That was "fresh" when the system was booted. Yes,
>that's over 14 months ago.

Someone synflooding you perhaps?


----------------------------------------------------------------------
    Mike A. Harris  -  Linux advocate  -  Free Software advocate
          This message is copyright 2001, all rights reserved.
  Views expressed are my own, not necessarily shared by my employer.
----------------------------------------------------------------------

If you think C++ is not overly complicated, just what is a protected
abstract virtual base pure virtual private destructor, and when
was the last time you needed one?
  -- Tom Cargill, C++ Journal, Fall 1990.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/