I've got a host that has experienced a sudden increase in the rate of failed TCP connections. It's gone from something like 0.3/sec to 1.5/sec.
Regardless of the severity of my particular issue, what's the basic process for finding root cause?
Consider contacting your hosting company/Network Admins and asking them about these failed connections. To avoid finger-pointing tell them that you see it with netstat
command in addition to LogicMonitor(which shows longer term graphs and sudden increase). They might have more information into what's going on their network.
If this server is protected behind a firewall/proxy, make sure that only proper traffic is allowed to pass through. (It is wild out there on the internet.)
Additionally, consider capturing some traffic using tcpdump
(make sure to capture full packets, not just headers) or similar compatible tool and loading it into Wireshark
. Wireshark will allow you to explore your raw captured packets. See if you can spot any traffic pattern that is not supposed to be there. Perhaps many connections from an unknown IP to an unused port or some misbehaving local networking device. Wireshark also has some general statistics about the captured, perhaps you'll spot something useful there.
netstat -st | grep failed connection attempts
.netstat -st
specific enough?