I suspect the simplest description is in the DTrace manual in the MIB provider chapter:
"Probe that fires whenever a TCP connection makes a direct transition to the CLOSED state from either the SYN_SENT state or the SYN_RCVD state and whenever a TCP connection makes a direct transition to the LISTEN state from the SYN_RCVD state." Alright, so that might still be waffle, although it seems to describe accurately the logic in http://src.opensolaris.org/source/xref/onnv/onnv-gate/usr/src/stand/lib/tcp/tcp.c#1006 Normally to establish a TCP connection there is a 3-way handshake. Somebody sends a SYN, other side sends a SYN-ACK in response, original side sends an ACK in response to the SYN-ACK. The description above suggests that the 3-way handshake isn't getting completed and a close is done while the connection is an incomplete state. I'm wondering therefore whether ACKs are being sent and getting lost, or whether under some conditions a host is choosing not to send ACKs, or perhaps even the original SYN never makes to the remote side. You might get some hints by looking at the value of msg if txp_xmit_ctl() gets called straight after the tcpAttemptFails variable is bumped. You might also try collecting a snoop and analyzing it with wireshark (used to be called ethereal). -- ============================================================================ ,-_|\ Richard Smith Staff Engineer PAE / \ Sun Microsystems Phone : +61 3 9869 6200 richard.smith at Sun.COM Direct : +61 3 9869 6224 \_,-._/ 476 St Kilda Road Fax : +61 3 9869 6290 v Melbourne Vic 3004 Australia ===========================================================================
