Discussion:
A LOT of TIME_WAIT connections
Silviu Marin-Caea
2006-02-23 12:27:09 UTC
Permalink
I have noticed a lot of connections in TIME_WAIT status. I suspect that the
network cards don't match well with the gigabit switch.

node1-cluster1:~ # netstat -an | grep TIME_WAIT | wc -l
1724
node1-cluster1:~ # netstat -an | grep TIME_WAIT | wc -l
1607

Examples (on node1)

192.168.1.223 is the public address of node1. 7782 is the http port of
Apache. Why are there connections from itself to itself?
tcp 0 0 192.168.1.223:7782 192.168.1.223:8479 TIME_WAIT
tcp 0 0 192.168.1.223:7782 192.168.1.223:8223 TIME_WAIT
tcp 0 0 192.168.1.223:7782 192.168.1.223:7711 TIME_WAIT
tcp 0 0 192.168.1.223:7782 192.168.1.223:8732 TIME_WAIT
tcp 0 0 192.168.1.223:7782 192.168.1.223:7196 TIME_WAIT
tcp 0 0 192.168.1.223:7782 192.168.1.223:7708 TIME_WAIT

The same, but in the other direction:
tcp 0 0 192.168.1.223:8265 192.168.1.223:7782 TIME_WAIT
tcp 0 0 192.168.1.223:8214 192.168.1.223:7782 TIME_WAIT
tcp 0 0 192.168.1.223:8251 192.168.1.223:7782 TIME_WAIT
tcp 0 0 192.168.1.223:8384 192.168.1.223:7782 TIME_WAIT
tcp 0 0 192.168.1.223:8391 192.168.1.223:7782 TIME_WAIT
tcp 0 0 192.168.1.223:8437 192.168.1.223:7782 TIME_WAIT
tcp 0 0 192.168.1.223:8439 192.168.1.223:7782 TIME_WAIT


7780 is the webcache port. These look normal, except, why are they TIME_WAIT
instead of ESTABLISHED?
tcp 0 0 192.168.1.223:7782 10.1.8.16:2331 TIME_WAIT
tcp 0 0 192.168.1.223:7780 192.168.1.49:2201 TIME_WAIT
tcp 0 0 192.168.1.223:7780 192.168.1.49:2201 TIME_WAIT
tcp 0 0 192.168.1.223:7780 192.168.1.49:2200 TIME_WAIT
tcp 0 0 192.168.1.223:7780 192.168.150.186:4219 TIME_WAIT
tcp 0 0 192.168.1.223:7780 192.168.1.49:2199 TIME_WAIT
tcp 0 0 192.168.1.223:7780 192.168.6.14:3247 TIME_WAIT
tcp 0 0 192.168.1.223:7780 192.168.6.14:3244 TIME_WAIT
tcp 0 0 192.168.1.223:7780 192.168.6.14:3244 TIME_WAIT
tcp 0 0 192.168.1.223:7780 10.1.8.16:2325 TIME_WAIT

192.168.1.224 is the address of node2. 7782 is the http port.
tcp 0 0 192.168.1.223:10631 192.168.1.224:7782 TIME_WAIT
tcp 0 0 192.168.1.223:10654 192.168.1.224:7782 TIME_WAIT
tcp 0 0 192.168.1.223:10647 192.168.1.224:7782 TIME_WAIT
tcp 0 0 192.168.1.223:10643 192.168.1.224:7782 TIME_WAIT
tcp 0 0 192.168.1.223:10365 192.168.1.224:7782 TIME_WAIT
tcp 0 0 192.168.1.223:10354 192.168.1.224:7782 TIME_WAIT
tcp 0 0 192.168.1.223:10643 192.168.1.224:7782 TIME_WAIT
tcp 0 0 192.168.1.223:10365 192.168.1.224:7782 TIME_WAIT
tcp 0 0 192.168.1.223:10354 192.168.1.224:7782 TIME_WAIT
tcp 0 0 192.168.1.223:10323 192.168.1.224:7782 TIME_WAIT
--
To unsubscribe, email: suse-oracle-***@suse.com
For additional commands, email: suse-oracle-***@suse.com
Please see http://www.suse.com/oracle/ before posting
Magni Fabrizio
2006-02-23 13:18:15 UTC
Permalink
It's normal for a socket to go in TIME_WAIT state before closing.

It wait two time the maximum segment lifetime (MSL).

Regards
Fabrizio
-----Original Message-----
Sent: 23 February, 2006 1:27 PM
Subject: [suse-oracle] A LOT of TIME_WAIT connections
I have noticed a lot of connections in TIME_WAIT status. I
suspect that the network cards don't match well with the
gigabit switch.
node1-cluster1:~ # netstat -an | grep TIME_WAIT | wc -l
1724
node1-cluster1:~ # netstat -an | grep TIME_WAIT | wc -l
1607
Examples (on node1)
192.168.1.223 is the public address of node1. 7782 is the
http port of Apache. Why are there connections from itself to itself?
tcp 0 0 192.168.1.223:7782
192.168.1.223:8479 TIME_WAIT
tcp 0 0 192.168.1.223:7782
192.168.1.223:8223 TIME_WAIT
tcp 0 0 192.168.1.223:7782
192.168.1.223:7711 TIME_WAIT
tcp 0 0 192.168.1.223:7782
192.168.1.223:8732 TIME_WAIT
tcp 0 0 192.168.1.223:7782
192.168.1.223:7196 TIME_WAIT
tcp 0 0 192.168.1.223:7782
192.168.1.223:7708 TIME_WAIT
tcp 0 0 192.168.1.223:8265
192.168.1.223:7782 TIME_WAIT
tcp 0 0 192.168.1.223:8214
192.168.1.223:7782 TIME_WAIT
tcp 0 0 192.168.1.223:8251
192.168.1.223:7782 TIME_WAIT
tcp 0 0 192.168.1.223:8384
192.168.1.223:7782 TIME_WAIT
tcp 0 0 192.168.1.223:8391
192.168.1.223:7782 TIME_WAIT
tcp 0 0 192.168.1.223:8437
192.168.1.223:7782 TIME_WAIT
tcp 0 0 192.168.1.223:8439
192.168.1.223:7782 TIME_WAIT
7780 is the webcache port. These look normal, except, why
are they TIME_WAIT instead of ESTABLISHED?
tcp 0 0 192.168.1.223:7782 10.1.8.16:2331
TIME_WAIT
tcp 0 0 192.168.1.223:7780 192.168.1.49:2201
TIME_WAIT
tcp 0 0 192.168.1.223:7780 192.168.1.49:2201
TIME_WAIT
tcp 0 0 192.168.1.223:7780 192.168.1.49:2200
TIME_WAIT
tcp 0 0 192.168.1.223:7780
192.168.150.186:4219 TIME_WAIT
tcp 0 0 192.168.1.223:7780 192.168.1.49:2199
TIME_WAIT
tcp 0 0 192.168.1.223:7780 192.168.6.14:3247
TIME_WAIT
tcp 0 0 192.168.1.223:7780 192.168.6.14:3244
TIME_WAIT
tcp 0 0 192.168.1.223:7780 192.168.6.14:3244
TIME_WAIT
tcp 0 0 192.168.1.223:7780 10.1.8.16:2325
TIME_WAIT
192.168.1.224 is the address of node2. 7782 is the http port.
tcp 0 0 192.168.1.223:10631
192.168.1.224:7782 TIME_WAIT
tcp 0 0 192.168.1.223:10654
192.168.1.224:7782 TIME_WAIT
tcp 0 0 192.168.1.223:10647
192.168.1.224:7782 TIME_WAIT
tcp 0 0 192.168.1.223:10643
192.168.1.224:7782 TIME_WAIT
tcp 0 0 192.168.1.223:10365
192.168.1.224:7782 TIME_WAIT
tcp 0 0 192.168.1.223:10354
192.168.1.224:7782 TIME_WAIT
tcp 0 0 192.168.1.223:10643
192.168.1.224:7782 TIME_WAIT
tcp 0 0 192.168.1.223:10365
192.168.1.224:7782 TIME_WAIT
tcp 0 0 192.168.1.223:10354
192.168.1.224:7782 TIME_WAIT
tcp 0 0 192.168.1.223:10323
192.168.1.224:7782 TIME_WAIT
--
see http://www.suse.com/oracle/ before posting
--
To unsubscribe, email: suse-oracle-***@suse.com
For additional commands, email: suse-oracle-***@suse.com
Please see http://www.suse.com/oracle/ before posting
Loading...