Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On the Linux boxes that host the application I work on, we've started seeing an issue where connection attempts against a port on a remote host are sometimes taking longer to come back.

As a test, a simple script was set up that just tries to telnet against a non-existent remote port in an endless loop.

On most connection attempts, we would get something like the following back near instantaneously:

telnet remoteHost 12345
telnet: connect to address Connection refused

However, at a fairly regular interval, the connection seems to hang for several seconds before continuing on to the next connection attempt which will go back to being near instant. It will just sit at the "Trying" stage:

telnet remoteHost 12345

Normally this wouldn't be that much of an issue, but in an application that does thousands of things every second between ~100 servers, these random slow downs are starting to become a problem. Does anyone know what drives this length or time or why it might be inconsistent?

In case it matters, here's some system info:

uname -r           ->
uname -m           -> x86_64
cat /etc/*-release -> SUSE Linux Enterprise Server 10 (x86_64)
                     VERSION = 10
                     PATCHLEVEL = 2
share|improve this question
Do the servers have the tcp_syncookies flag set? – Avery Payne Jul 14 '10 at 22:56
up vote 1 down vote accepted

It sounds like your scanning technique resembles port-scanning, so is it possible that the servers are configured to drop SYN packets in response to a perceived port scan? Any firewall settings on the servers similar to those in #8 of 10 iptables rules to help secure your Linux box?

share|improve this answer
I don't have permissions to do anything regarding the iptable stuff myself, but I've got an email out to the sysadmins. Hopefully they get back to me because it certainly sounds like this may be the culprit. – bcasp Jul 14 '10 at 19:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.