Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On one of our systems we see many requests that take 75 seconds. Under low traffic responses are ca 0.3 seconds.

What I am wondering is if someone is trying to keep connections open in order to drain the connection pool. But then closing it before a in timeout in order to avoid detection.

Our servers are behind load balancers.

Or does anyone know if 75 seconds is the default value for something?

share|improve this question

You could start by looking at performance counters in Windows, using the Windows Performance Monitor.

It includes a counter TCPv4\Connections Established ("Connections Established is the number of TCP connections for which the current state is either ESTABLISHED or CLOSE-WAIT.") that might be helpful.

You could compare that with the other systems, and monitor that over time. There are other counters as well that might be of interest.

Finally, you could use Wireshark or Network Monitor (both free) to monitor incoming packets. Both apps support applying filters.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.