=G=
*From:* Gary Baluha [mailto:user-ae3e15c22de1@xymon.invalid]
*Sent:* Tuesday, January 29, 2008 10:36 AM
*To:* user-ae9b8668bcde@xymon.invalid
*Subject:* Re: [hobbit] Large number of TIME_WAITs
Red Hat ES 4 Update 5.
That's what I normally would think, but it doesn't make any sense that the
source AND destination are both localhost or the local IP. It's as though
the Hobbit server is trying to communicate with itself using network
sockets. It would make more sense if either the source or destination was a
client IP, but that isn't the case.
On Jan 29, 2008 10:15 AM, Hubbard, Greg L <user-d970b5e56ec9@xymon.invalid> wrote:
What OS? Some operating systems allow network connections to hang around
a bit after disconnection. On Solaris you can set a parameter to reduce the
timeout period. Hobbit could trigger this because each client connects to
the server, sends a data blast, and then disconnects.
*From:* Gary Baluha [mailto:user-ae3e15c22de1@xymon.invalid]
*Sent:* Tuesday, January 29, 2008 8:58 AM
*To:* user-ae9b8668bcde@xymon.invalid
*Subject:* [hobbit] Large number of TIME_WAITs
I noticed something strange on my Hobbit server, though I'm not sure if
it's a problem or not. There are about 140 TIME_WAITs from the local IP of
the Hobbit server, and about 30 TIME_WAITs from localhost, all using port
1984. They look something like this:
0 0 1.2.3.4:42389 1.2.3.4:1984 TIME_WAIT
0 0 1.2.3.4:42394 1.2.3.4:1984 TIME_WAIT
0 0 1.2.3.4:42399 1.2.3.4:1984 TIME_WAIT
0 0 1.2.3.4:42396 1.2.3.4:1984 TIME_WAIT
0 0 1.2.3.4:42397 1.2.3.4:1984 TIME_WAIT
0 0 127.0.0.1:42310 127.0.0.1:1984 TIME_WAIT
0 0 127.0.0.1:42309 127.0.0.1:1984 TIME_WAIT
0 0 127.0.0.1:42315 127.0.0.1:1984 TIME_WAIT
0 0 127.0.0.1:42322 127.0.0.1:1984 TIME_WAIT
0 0 127.0.0.1:42320 127.0.0.1:1984 TIME_WAIT
There are also a few on various other ports:
0 0 127.0.0.1:42246 127.0.0.1:29021 TIME_WAIT
0 0 127.0.0.1:42301 127.0.0.1:29023 TIME_WAIT
0 0 127.0.0.1:42362 127.0.0.1:29017 TIME_WAIT
0 0 127.0.0.1:29030 127.0.0.1:42380 TIME_WAIT
0 0 127.0.0.1:42348 127.0.0.1:29019 TIME_WAIT
Any idea why there should be so many of them, particularly on the
localhost address? And any idea if this looks abnormal or not?