Re: [CentOS] TIME_WAITs...

2009-03-02 Thread nate
John Doe wrote: > Only things I found are the hardcoded values in include/net/tcp.h: I found these tunable parameters: tcp_tw_recycle & tcp_tw_reuse > Our "issue" is on the LAN side: front servers connecting to the dbs. > So I wonder if 60s is not too long for the delayed packets problem, when th

Re: [CentOS] TIME_WAITs...

2009-03-02 Thread John Doe
> I spent a bunch of time researching TIME_WAIT on linux and didn't > find much useful information. There's a couple kernel parameters > to change the settings though the only docs for them that I could > find say don't touch them unless you REALLY know what your doing Only things I found are the

Re: [CentOS] TIME_WAITs...

2009-03-02 Thread John Doe
> > If I make 1 rapid connections/selects/deconnections to mysql on this > > server, I get like 1 TW after around 3000, another TW around 6000 and > > another TW > > around 9000... That makes 3 TWs only. And they last 60 seconds... > In your testing is the source IP the same for all with

Re: [CentOS] TIME_WAITs...

2009-02-27 Thread nate
John Doe wrote: > > So, am I correct in thinking that seeing thousands TWs when there was a > burst of thousands connections is normal? yes that is normal > Any idea why so few TWs on this server? Any conf file I should check? I spent a bunch of time researching TIME_WAIT on linux and didn't f

Re: [CentOS] TIME_WAITs...

2009-02-27 Thread Robert Moskowitz
John Doe wrote: > Hi, > > I was asked to check some TIME_WAITs "problems" (my boss thinks there should > almost never be any) and I bumped into something strange... > I SHOULD be able to answer this, I was involved when we solved the PANIX TCP-WAIT attack way back when... But the OS has chan

[CentOS] TIME_WAITs...

2009-02-27 Thread John Doe
Hi, I was asked to check some TIME_WAITs "problems" (my boss thinks there should almost never be any) and I bumped into something strange... All of our servers have apparently normal (in my opinion) 60s TIME_WAITs (even if it strangely caps around 14000 in my tests)... But one of them behaves d