TCP stands for Transmission Control Protocol and is one of the core protocols of the Internet Protocol Suite. TCP complements the Internet Protocol (IP), and therefore the entire suite is commonly referred to as TCP/IP.

learn more… | top users | synonyms

-1
votes
1answer
12 views

Run shell script on the event of “possible SYN flooding”

Since it doesn't appear to be possible to get "netstat" stats at the time I got an SYN flooding, I'd like to write a script that gets all the stats I need (top IPs, used memory, etc) and write to a ...
0
votes
1answer
24 views

Handle “possible SYN flooding on port 443. Sending cookies.”

My website constantly has several users online all the time. The server uses Apache/PHP, database and Memcached. On normal use, the application works well and fast. However, the server appears to ...
-1
votes
0answers
13 views

Is a tcp port number somehow used as a pointer to memory? [migrated]

I'm trying to understand ports on a low-level. This isn't a use-case specific question (off-topic) but I tried google with no luck so I'm posting here. Ports are just numbers used to access a ...
-2
votes
1answer
17 views

Linux port forwarding that automatically tries to establish a connection to the far side while keeping the originating side waiting [on hold]

I've been playing around with port forwarding for web servers What I'm looking for is a way to forward the port in such a manner that even if the connection to the forwarded port is down for a moment,...
0
votes
0answers
22 views

Redirect TCP traffic from interface wlan0 (AP mode) to localhost:8080?

Here I want to redirect all traffic heading to all_IP:80 from wlan0 ( AP mode, as a hotspot, in a router) to my local TCP listener, listening on localhost:8080 OS : debian I used these command to do ...
1
vote
1answer
17 views

TCP retransmission delays - lost acks

Maybe somebody will be able to help me out with this. I'm trying to find out if there is anything that can be optimized server-side to reduce delays in case of packet loss. Environment: Windows 2012 ...
1
vote
0answers
10 views

Why does reading /proc/net/tcp take a long time ss is quick to return the same sort of data about the connections table? [migrated]

On Linux 2.6.32, if you read (for example, cat) /proc/net/tcp, on a very loaded system (for example, a web server), you will find that reading 100K entries takes over 30 seconds. That's a long time. ...
2
votes
1answer
30 views

Close all _existing_ TCP connections on some ports using IPTables?

Say I have a quick network partition test that I'd like to run, like disconnecting two halves of a ReDiS cluster from each other, and I want to use IPTables to temporarily disconnect one group of ...
0
votes
0answers
13 views

How to handle thousands of messages to C socket? [migrated]

I currently have a setup looking like this: __________________ _________ ________ ___________ | Front end server |----| Varnish |----| NodeJS |----| C-service | ‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾ ...
1
vote
1answer
54 views

Identify the ip to which an UDP port established connection

I'm trying to obtain the ip to which Rocketleague.exe has established connection on a UDP port. I've tried with netstat -p udp but for some strange reason it does not show any active udp connections . ...
0
votes
1answer
13 views

Syslog-ng can close connection

I have a server that collect secure/auth logs in my datacenter from all other server, it runs syslog-ng 3.2.5. It's configured to receive tcp connection, here is the conf: tcp(ip(0.0.0.0) port(514) ...
0
votes
0answers
25 views

initial connections refused - connection warm up?

I've got two firewalled VMs connected to the same vLAN but I see RST/ACK responses on initial connection attempts in a while only to succeed on immediate following attempts, like some sort of cache ...
0
votes
1answer
47 views

SYN flooding on port 443 while nginx reload

While reloading nginx, I started getting errors in messages log "possible SYN flooding on port 443", and it seems like nginx becomes completely irresponsive at that time (quite for a while), cause ...
-1
votes
0answers
16 views

ksoftirqd using up 100% of one core when using Netmap?

Observations: When netmap pkt-gen is run on one core and one thread: top shows pkt-gen using up 100% of CPU and ksoftirqd using up about 90-98% of CPU When netmap pkt-gen is run on two cores and ...
0
votes
0answers
26 views

Alghough TCP SYN Backlog size is set to 128 but in practical it is limited to 16

as you know in ubuntu, tcp syn backlog size is 128 by default. i tried to syn flood my ubuntu linux by hping3. to do that, i send 100 spoofed tcp syn packets per second to the ubuntu and meanwhile i ...
0
votes
0answers
46 views

Duplicating and combining transmissions over TCP in Windows

I have a program, on socket S1, which I would like to send a message over TCP to socket, S2, the same message is then somehow sent to two my devices on S3 and S4 (they both listen to unique sockets). ...
6
votes
2answers
169 views

Can Squid be used as “TLS termination proxy” to encrypt TCP connections using client certificates?

Abstract I need an encrypted TCP connection from multiple clients to a single port over the internet. Can this be realized with Squid? Concrete situation We use a monitoring and client management ...
0
votes
1answer
26 views

Establishing TCP Connections by hping3

when a client sends 10 TCP SYN packets by hping3(not spoofing), server responds and sends 10 TCP SYN+ACK packets. now client should answer to server and Establish the connection by sending 10 ACK ...
0
votes
1answer
42 views

Need help in understanding the packet analysis(wireshark) [closed]

The snapshot capture below contains a single HTTP request to a web server, in which the client web browser requests some files from server, and the server returns an HTTP/1.1 200 (OK) response which ...
-2
votes
1answer
124 views

Any tool for forking/teeing/sharing a TCP connection to the remote server? [closed]

Could down voter please post your reason, as it's not obvious to me? Here's my problem. I'm building an automation program that talks to a remote server (think of it as a chat server or MUD game ...
0
votes
0answers
15 views

What is the default value for TCP accept queue length on Linux?

I have read this article but it doesn't mention where the default accept queue length can be found (it does mention tcp_max_syn_backlog though, but it's different). I'm working on a Java 8 project ...
0
votes
0answers
24 views

Large payload - connection get's Hung with CLOSE_WAIT or LAST_ACK state

We have a webservice client which posts data to a 3rd party Webservice. We are having an issue when the payload is a bit large (Around 600KB) xml. Once we pay the process hangs forever. The Netstat -...
0
votes
0answers
17 views

Infinite loop of RST/ACK and ACK

I have web servers (Apache-Tomcat) at IDC to serve https requests from Android and iOS clients. Suddenly I noticed traffic to web servers was dramatically increased (10Mbps to 80Mbps). So I tried to ...
0
votes
2answers
37 views

Wireshark Packet Capture Data Data ACK Confusion

I understand how acks work and windowing works. What I am not getting is why am I seeing the following behavior in packet captures Client Server data1-----> data2-----> <--------ack ...
0
votes
1answer
47 views

How to setup linux to retransmit TCP packets by reducing the packet size like OS X

On OS X I noticed that for packets which are not ACKed, the system retransmits them with reduced packet size. This can be seen in the image below. Is it possible to enable the same behavior in ...
-1
votes
1answer
13 views

Time until a TCP socket closes if the connection is lost

How long will a TCP socket remain open if there's a loss of a network connection between the source and the destination?
0
votes
0answers
28 views

Why sar ETCP shows TCP retransmission but wireshark tcp.analysis.retransmission doesn't

I am trying to investigate the cause of TCP retransmission. When I use sadc and sar, it shows there are tcp retransmission; but when I use wireshark on all of the server's interfaces, it doesn't show ...
0
votes
1answer
52 views

What's the default TCP window size of iperf3?

Does anyone know what's the default TCP window size for iperf3? It is not mentioned in the manual and I also can't find it in the output, when running a test.
0
votes
0answers
23 views

Can't transmit from multiple virtual vlan id interfaces on same interface

I'm creating virtual interfaces of vlan id on same interface, i.e: eth0 - the main interface with ip 0.0.0.0 . eth0.1 - tagged interface under eth0 with ip 10.0.0.1 . eth0.2 - tagged interface ...
-1
votes
2answers
78 views

How does TCP offload NIC cause the TCP checksum to be invalid?

A tcpdump pcap exported and being investigated on another machine with wireshark is showing a lot of invalid TCP checksum messages. This is a known and documented phenomenon when using TCP offload ...
0
votes
1answer
43 views

Linux server failing to send SYN/ACK after receiving SYN remotely, works locally

Problem: A server process can be accessed by a device on the LAN or by the server itself, but it cannot be accessed outside the LAN (port forwarding is configured correctly as the server does receive ...
1
vote
1answer
52 views

How to set the maximum TCP receive window size in Linux?

I want to limit the rate of every TCP connection. Can I set the maximum TCP receive window size in Linux? With iptables + tc can only limit IP source. The parameters net.core.rmem_max and net.core....
0
votes
2answers
32 views

Count number of incoming connection on a port - Linux

We have a server which listens on port X. The server has a large number of clients, from time to time the process gets hung, I am seeing SYN flooding messages in the log. I have been trying to tune ...
0
votes
1answer
32 views

TCP connection RST after FIN, ACK

I have a situation that would like to clarify with the experts here. I am no network expert so maybe it's normal, but i rather ask. We are trying to diagnose a problem between two servers, both are ...
3
votes
3answers
67 views

Do clients typically implement failover/load-balancing on multiple A records?

Typically, load balancers like Amazon's Elastic Load Balancers use a DNS record set with multiple A records to provide multiple load balancer instances which can handle traffic to requesting endpoints:...
0
votes
0answers
52 views

multiplexing a TCP connection through a dumb shell connection?

I am connecting to a VPN whose gateway is sufficiently misconfigured that basically the only useful thing I can do with it is to ssh to a specific Linux host set up for my usage inside the VPN, and ...
0
votes
0answers
19 views

stunnel keeps stopping with WSAECONNREFUSED given

Right so bit of background to start with I've got 2 stunnel installs on 2 different servers and basically using ensemble and stunnel to bounce a message around with ssl cert. Here is the flow. Where ...
0
votes
0answers
46 views

TCP Balancer active/standby active/passive

I have two Servers, Server A,ServerB. running as TCP socket server. I want to a active/standby or /active/passive failover. that means: 1:Server A and Server B Running, route ALL connection to ...
1
vote
0answers
108 views

Nginx log to syslog on TCP port

I need to redirect Nginx access and error logs to a remote syslog server. From http://nginx.org/en/docs/syslog.html I saw that I can do: error_log syslog:server=192.168.1.1; However I need to ...
1
vote
1answer
61 views

TcpTimedWaitDelay is missing in Windows Server 2012

Suddenly my server log shows: An operation on a socket could not be performed because the system lacked sufficient buffer space or because a queue was full And I googled and found these links as ...
0
votes
1answer
38 views

PCI Scan failing at TCP Source Port Pass Firewall testing

I'm trying to get PCI scan PASS for my website, Scan failing at this step. The host responded 4 times to 4 TCP SYN probes sent to destination port 20 using source port 80. However, it did not ...
1
vote
1answer
24 views

utility of using ALL in --tcp-flags in iptables rule

I m wondering what is the difference between the following 2 --tcp-flags rules: 1) -p tcp --tcp-flags SYN,FIN,RST SYN,FIN,RST 2) -p tcp --tcp-flags ALL SYN,FIN,RST
0
votes
0answers
12 views

Windows/IIS7.5 half-closing connections resulting in sockets in TIME_WAIT

I'm seeing scenarios where the client side initiates the TCP close but the webserver (IIS 7.5) simply responds with an ACK and the connection ends up in TIME_WAIT. Why would it do that? Typical HTTP ...
0
votes
0answers
26 views

lower tcp throughput than expected

I've conducted some tests which measured tcp throughput via wireless and wired connection. (a) was wired link between my desktop and my home router. (b) was wireless link between my desktop and my ...
-1
votes
1answer
35 views

Manually sent ICMP redirect packets [closed]

I'm trying to sent a ICMP redirect to my router to add a new route, as I can not configure it from the portal, and have no access to it though telnet/ssh. The scenario is the next. LAN network 192....
0
votes
0answers
11 views

What filter in Wireshark, can return the ACKs packets employed to complete TCP three-way handshakes instigated by a particular party?

What filter in Wireshark, can return the ACKs packets employed to complete TCP three-way handshakes instigated by a particular party? For instance if machine A requests for a TCP connection to be ...
0
votes
1answer
44 views

Is it normal to have HTTP 499 errors in 1 out of 4000 requests?

I made a website, behind CloudFlare, and sometimes I get an early terminated (nginx 499) request, which is really hard to work around in the codebase. This happens in about 1 out of 4000 requests. ...
1
vote
0answers
19 views

TCP tuning for DPM on Windows 2012

I've got a pair of servers on opposite ends of a fast (1-10Gb depending on the server) but higher latency (40-60ms) link. Various network tuning options have been set resulting in iperf3 yielding ...
0
votes
0answers
405 views

Weird CLOSE_WAIT statuses at standard PHP application

I am asking for help regarding tcp problems on a webserver serving a web application built in PHP. The client is a standard html/js page viewed in the web browser. This client sends Ajax requests ...