Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've rewritten this question to focus on a specific part. Originally titled "Apache hangs or quits, but keeps TCP sockets open and won't accept connections"

Problem

Problem is a website (Moodle) that is configured to use LDAP for authentication hangs when LDAP authentication is attempted.

Details

I used tcpdump to capture the TCP packets of both the LDAP request sent by Apache (i.e. from the web app) and the LDAP request send by CLI ldapsearch utility. The Apache-sent packets seem to hang and then there is this repeating, 125 byte packet sent. I don't know what to make of it and I was hoping someone else might.

  • Nothing is captured in the Apache error logs. I cranked error logging up to "debug" and still nothing.
  • PHP/The web app also do not report any errors; I cranked error_reporting up all the way for PHP, as well.
  • This problem only happens when the LDAP requests are generated and performed by the web app.
  • i.e. when I run "ldapsearch" with the same credentials and details that the web app is using, I get a quick and complete response from the LDAP server
  • LDAP is Windows AD. I don't know what version, and I do not have administrative access (or any access, actually) to it.
  • Output from tcpdump

    # ## TCP Packets from Apache
    #
    # tcpdump -r tcpdump_from_apache.out 
    reading from file tcpdump_from_apache.out, link-type EN10MB (Ethernet)
    13:45:00.063879 IP webserver-0001.56557 > ldapserver.someuniversity.edu.ldap: Flags [S], seq 920683327, win 5840, options [mss 1460,sackOK,TS val 3353249407 ecr 0,nop,wscale 7], length 0
    13:45:00.106582 IP ldapserver.someuniversity.edu.ldap > webserver-0001.56557: Flags [S.], seq 388153653, ack 920683328, win 8192, options [mss 1380,nop,wscale 8,sackOK,TS val 176288620 ecr 3353249407], length 0
    13:45:00.106602 IP webserver-0001.56557 > ldapserver.someuniversity.edu.ldap: Flags [.], ack 1, win 46, options [nop,nop,TS val 3353249411 ecr 176288620], length 0
    13:45:00.106677 IP webserver-0001.56557 > ldapserver.someuniversity.edu.ldap: Flags [P.], seq 1:82, ack 1, win 46, options [nop,nop,TS val 3353249411 ecr 176288620], length 81
    13:45:00.152943 IP ldapserver.someuniversity.edu.ldap > webserver-0001.56557: Flags [P.], seq 1:23, ack 82, win 256, options [nop,nop,TS val 176288624 ecr 3353249411], length 22
    13:45:00.152961 IP webserver-0001.56557 > ldapserver.someuniversity.edu.ldap: Flags [.], ack 23, win 46, options [nop,nop,TS val 3353249416 ecr 176288624], length 0
    13:45:00.153216 IP webserver-0001.56557 > ldapserver.someuniversity.edu.ldap: Flags [P.], seq 82:207, ack 23, win 46, options [nop,nop,TS val 3353249416 ecr 176288624], length 125
    13:45:00.458751 IP webserver-0001.56557 > ldapserver.someuniversity.edu.ldap: Flags [P.], seq 82:207, ack 23, win 46, options [nop,nop,TS val 3353249447 ecr 176288624], length 125
    13:45:01.078694 IP webserver-0001.56557 > ldapserver.someuniversity.edu.ldap: Flags [P.], seq 82:207, ack 23, win 46, options [nop,nop,TS val 3353249509 ecr 176288624], length 125
    13:45:02.318668 IP webserver-0001.56557 > ldapserver.someuniversity.edu.ldap: Flags [P.], seq 82:207, ack 23, win 46, options [nop,nop,TS val 3353249633 ecr 176288624], length 125
    13:45:04.798702 IP webserver-0001.56557 > ldapserver.someuniversity.edu.ldap: Flags [P.], seq 82:207, ack 23, win 46, options [nop,nop,TS val 3353249881 ecr 176288624], length 125
    13:45:09.758699 IP webserver-0001.56557 > ldapserver.someuniversity.edu.ldap: Flags [P.], seq 82:207, ack 23, win 46, options [nop,nop,TS val 3353250377 ecr 176288624], length 125
    13:45:19.678660 IP webserver-0001.56557 > ldapserver.someuniversity.edu.ldap: Flags [P.], seq 82:207, ack 23, win 46, options [nop,nop,TS val 3353251369 ecr 176288624], length 125
    13:45:39.518685 IP webserver-0001.56557 > ldapserver.someuniversity.edu.ldap: Flags [P.], seq 82:207, ack 23, win 46, options [nop,nop,TS val 3353253353 ecr 176288624], length 125
            ...etc...
    
    
    # ## TCP Packets when running "ldapsearch"
    #
    # tcpdump -r tcpdump_from_ldapsearch.out 
    reading from file tcpdump_from_ldapsearch.out, link-type EN10MB (Ethernet)
    13:43:16.194111 IP webserver-0001.mroomstech.com.56550 > ldapserver.someuniversity.edu.ldap: Flags [S], seq 3594896697, win 5840, options [mss 1460,sackOK,TS val 3353239020 ecr 0,nop,wscale 7], length 0
    13:43:16.250285 IP ldapserver.someuniversity.edu.ldap > webserver-0001.mroomstech.com.56550: Flags [S.], seq 3373619350, ack 3594896698, win 8192, options [mss 1380,nop,wscale 8,sackOK,TS val 176278235 ecr 3353239020], length 0
    13:43:16.250322 IP webserver-0001.mroomstech.com.56550 > ldapserver.someuniversity.edu.ldap: Flags [.], ack 1, win 46, options [nop,nop,TS val 3353239026 ecr 176278235], length 0
    13:43:16.250370 IP webserver-0001.mroomstech.com.56550 > ldapserver.someuniversity.edu.ldap: Flags [P.], seq 1:82, ack 1, win 46, options [nop,nop,TS val 3353239026 ecr 176278235], length 81
    13:43:16.308445 IP ldapserver.someuniversity.edu.ldap > webserver-0001.mroomstech.com.56550: Flags [P.], seq 1:23, ack 82, win 256, options [nop,nop,TS val 176278241 ecr 3353239026], length 22
    13:43:16.308482 IP webserver-0001.mroomstech.com.56550 > ldapserver.someuniversity.edu.ldap: Flags [.], ack 23, win 46, options [nop,nop,TS val 3353239031 ecr 176278241], length 0
    13:43:16.308680 IP webserver-0001.mroomstech.com.56550 > ldapserver.someuniversity.edu.ldap: Flags [P.], seq 82:174, ack 23, win 46, options [nop,nop,TS val 3353239031 ecr 176278241], length 92
    13:43:16.372985 IP ldapserver.someuniversity.edu.ldap > webserver-0001.mroomstech.com.56550: Flags [P.], seq 23:476, ack 174, win 256, options [nop,nop,TS val 176278248 ecr 3353239031], length 453
    13:43:16.373200 IP webserver-0001.mroomstech.com.56550 > ldapserver.someuniversity.edu.ldap: Flags [P.], seq 174:181, ack 476, win 54, options [nop,nop,TS val 3353239038 ecr 176278248], length 7
    13:43:16.373250 IP webserver-0001.mroomstech.com.56550 > ldapserver.someuniversity.edu.ldap: Flags [F.], seq 181, ack 476, win 54, options [nop,nop,TS val 3353239038 ecr 176278248], length 0
    13:43:16.439382 IP ldapserver.someuniversity.edu.ldap > webserver-0001.mroomstech.com.56550: Flags [.], ack 182, win 256, options [nop,nop,TS val 176278254 ecr 3353239038], length 0
    13:43:16.439413 IP ldapserver.someuniversity.edu.ldap > webserver-0001.mroomstech.com.56550: Flags [R.], seq 476, ack 182, win 0, length 0
    
share|improve this question
    
Have you determined what the request it hangs on is? Are you issuing this request or is it coming from an unknown client? Might it be an intentionally malicious request? (And it's almost definitely not Apache that's hanging but Moodle.) –  David Schwartz Oct 7 '11 at 22:31
    
(1) It is definitely not malicious. (2) You are probably right that it is Moodle, not Apache. (3) It is me running this, on a sandbox server that I entirely control. (4) To isolate it, I reduced the number of possible servers to only one and looked at that. I ran strace against the single Apache proc and didn't really get anything conclusive. I can pastebin it somewhere if that would be helpful. –  JDS Oct 7 '11 at 23:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.