Summary: TIME_WAIT

From: Otto, Doug (
Date: Wed Nov 24 1999 - 17:14:37 CST

Darren Dunham hit the nail on the head.

> Make it closer to 30000 and I've seen that a couple of times. Both
> times were on machines that were doing Y2K testing, and it occured after
> the time was set back to a more 'normal' time.
> Rebooting cleared it up.

This system was part of some Y2K production testing and was not restarted
after rolling the date back. The time values associated with the socket
closures aren't sane so the tcp_close_interval is never reached. As soon as
I get a break in the production schedule I'm going to reboot to clear the

> -----Original Message-----
> From: Otto, Doug
> Sent: Wednesday, November 24, 1999 1:49 PM
> To: Sun Managers (E-mail)
> Subject: TIME_WAIT
> I've got, what appears to me, an interesting problem. We have an E3500
> running 2.6 with the very latest patch cluster. A user complained that
> when attempting to rsh from this host to another machine he recieved the
> following error:
> socket: All ports in use
> This appears accurate:
> # netstat | wc -l
> 4886
> What puzzles me is that of that 4886 open sockets, 4784 are TIME_WAIT.
> Roughly half of those are on port 139 to our NT PDC. We run samba on the
> system and authenticate to the NT domain. I know that the Microsoft
> TCP/IP stack often fails to close a port cleanly so my assumption is that
> those are leftovers from disconnected sessions. Anyone have any ideas
> about how I can go about clearing ~4800 sockets without downing the box?
> I'm not doing anything strange in regard to stack tuning and I don't thing
> this is a DOS attack as tcpListenDropQ0 is 0.
> Thoughts, ideas, free beers?
> Thanks and I'll summarize
> --
> Doug Otto
> Director, IT Systems Support
> Alldata LLC 800.829.8727 ext.3137

This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:13:33 CDT