TCP stands for Transmission Control Protocol and is one of the core protocols of the Internet Protocol Suite. TCP complements the Internet Protocol (IP), and therefore the entire suite is commonly referred to as TCP/IP.

learn more… | top users | synonyms

54
votes
6answers
60k views

How to forcibly close a socket in TIME_WAIT?

I run a particular program on linux which sometimes crashes. If you open it quickly after that, it listens on socket 49201 instead of 49200 as it did the first time. netstat reveals that 49200 is in ...
32
votes
11answers
20k views

What is the difference between UDP and TCP?

My router has two protocols (and a "both" option) that I can select when setting up port forwarding: UDP and TCP. What is the difference between these two protocols and when would you select one over ...
29
votes
3answers
4k views

Tuning iSCSI storage

This is a Canonical Question about iSCSI we can use as a reference. iSCSI is a protocol that puts SCSI commands as payload into TCP network packets. As such, it is subject to a different set of ...
28
votes
8answers
214k views

What does “TTL expired in transit” mean on a ping attempt?

We get the message “TTL expired in transit” when we try to ping to a server in a different network segment. When we run tracert, 4 ip addresses repeat themselves indefinitely: 14 60 ms 59 ms ...
21
votes
5answers
1k views

Can TCP and UDP packets be split into pieces?

Can TCP packets arrive to receiver by pieces? For example, if I send 20 bytes using TCP protocol, can I be 100% sure that I will receive exactly 20 bytes at once, not 10 bytes then another 10 bytes ...
21
votes
5answers
23k views

What is the best way to transfer a single large file over a high-speed, high-latency WAN link?

This looks related to this one, but it's somewhat different. There is this WAN link between two company sites, and we need to transfer a single very large file (Oracle dump, ~160 GB). We've got full ...
20
votes
5answers
17k views

How passively monitor for tcp packet loss? (Linux)

How can I passively monitor the packet loss on TCP connections to/from my machine? Basically, I'd like a tool that sits in the background and watches TCP ack/nak/re-transmits to generate a report on ...
19
votes
4answers
1k views

Slow Transfers over Distance

From our NY Datacenter, transfers to locations that are farther away are having poor performance. Using speed test to test various locations, we can saturate our 100 mbit uplink to Boston and ...
17
votes
2answers
5k views

What is the “in-the-wire” size of a ethernet frame? 1518 or 1542?

According to the table here, it says that MTU = 1500 bytes and that the payload part is 1500 - 42 bytes or 1458 bytes (<- this is actually wrong!). Now on top of that you have to add IPv4 and UDP ...
16
votes
3answers
1k views

Troubleshooting Network Speeds — The Age Old Inquiry

I'm looking for help with what I'm sure is an age old question. I've found myself in a situation of yearning to understand network throughput more clearly, but I can't seem to find information that ...
16
votes
6answers
12k views

Why would a server not send a SYN/ACK packet in response to a SYN packet

Lately, we've become aware of a TCP connection issue that is mostly limited to mac and Linux users who browse our websites. From the user perspective, it presents itself as a really long connection ...
14
votes
3answers
50k views

“Possible SYN flooding” in log despite low number of SYN_RECV connections

Recently we had an apache server which was responding very slowly due to SYN flooding. The workaround for this was to enable tcp_syncookies (net.ipv4.tcp_syncookies=1 in /etc/sysctl.conf). I posted a ...
14
votes
2answers
726 views

Is my TCP connections sabotaged by my country's government?

I am suspicious that my country's government is destroying the received ACK packet on TCP connections, somehow. When I try to establish a TCP connection to an outside host on ports other than 80 the ...
13
votes
5answers
5k views

Understanding Ports: How do multiple browser tabs communicate at the same time? [closed]

I realized today that I fundamentally don't understand how port communication works. If I fire up an instance of a webserver listening on port 80, it can respond to many requests from many different ...
13
votes
1answer
1k views

What am I misunderstanding about calculating MTU?

Okay, I just finished resolving a jumbo frames issue between a few Xserves, a Netgear GSM7224, and a Drobo B800i. It turned out that the Xserves (Mac OS X 10.6.8 Server) and the Drobo B800i accept the ...
12
votes
4answers
19k views

Does HTTPS use TCP or UDP?

Does HTTPS use TCP or UDP?
12
votes
4answers
3k views

What is the “slash” after the IP?

In Amazon EC2, where I set "security groups", It says: Source: 0.0.0.0/0 And then it gives an example of: 192.168.2.0/24 What is "/24"? I know what port and IP is.
12
votes
5answers
5k views

I'm designing a system to handle 10000 TCP connections per second, what problems will I run into?

I have a relatively new 8-core box running CentOS. I would like to develop a stats server that uses TCP. It's very simple, it accepts a TCP connection, increments a counter and closes the connection. ...
12
votes
2answers
29k views

Which is the default TCP connect timeout in Windows?

Which is the default TCP connect timeout in Windows? There is a registry key to configure it or it's set dynamically?
11
votes
3answers
6k views

What's the difference between Unix socket and TCP/IP socket?

It's from this answer: http://stackoverflow.com/questions/2482411/is-this-pdo-bug-fixed-now/2482424#2482424
11
votes
7answers
9k views

Apache Tomcat chokes after 300 connections

We have an apache webserver in front of Tomcat hosted on EC2, instance type is extra large with 34GB memory. Our application deals with lot of external webservices and we have a very lousy external ...
10
votes
3answers
2k views

Is it possible for a TCP connection to remain open when the client has disconnected?

We have a server application which is facing TCP exhaustion problems at around 4000 connections. This will occur every 3 or 4 weeks (approximately). The vendor, which has created this server ...
10
votes
7answers
12k views

traceroute TCP equivalent for Windows [closed]

I'm trying to determine where connectivity to an external host using a specific TCP port is being blocked. Traceroute for Windows only uses ICMP, and telnet will only tell me that the port is blocked ...
10
votes
2answers
221 views

How long are fragmented TCP fragments kept in the TCP server

Suppose that a given TCP fragment is fragmented into two IP datagrams, and that the first datagram arrives to the TCP server, but the second datagram never arrives. After a certain amount of time the ...
10
votes
3answers
7k views

Sockets found by lsof but not by netstat

I have an application which is running out of file descriptors, apparently by opening sockets, but I can't find out exactly what these sockets do. These appear in the lsof output as java 9689 ...
9
votes
6answers
16k views

How to capture ack or syn packets by Tcpdump?

I want to know the filter rule , thanks!
9
votes
9answers
22k views

ping alternative for tcp?

It's a common task to check network 'quality' - latency, number of dropped packets etc. But 'ping' has a number of drawbacks: - It uses ICMP. Many ISP has different shapers for ICMP and TCP traffic, ...
9
votes
2answers
2k views

Linux Slow Start: Changing ip route does not have any effect on initial window

I changed the tcp initial window in my machine to 10 as shown below [user@site etc]$ sudo ip route change default via 17.255.209.1 dev eth0 proto static initcwnd 10 And changed ...
9
votes
6answers
17k views

Finding cause of TCP retransmission within a LAN

Hello denizens of Server Fault I have an irritating problem with a LAN of about 100 computers, 2 Windows domain servers, and 12 VoIP phones. Since their installation around a year ago, every week or ...
9
votes
2answers
837 views

How to find process which uses most bandwidth

How can I find the process which uses most bandwidth on a Linux PC? With iftop it's possible to find which connections produce most bandwidth, but how to find the process?
9
votes
3answers
937 views

Lower TCP throughput from 1Gbps server than 100Mbps server over large RTT

We've got infrastructure distributed in a few major locations around the world - Singapore, London and Los Angeles. The RTT between any two locations is over >150ms. We've recently upgraded all of ...
9
votes
1answer
441 views

TCP congestion control for low-latency 10GbE -> 1GbE network?

I have a server with a 10GbE connection to a switch, and 10 clients each with a 1GbE connection to the same switch. Running nuttcp in parallel on each of the clients, I can push 10 TCP streams of ...
8
votes
11answers
17k views

How to discover the mac address of machines in a network?

How to discover the mac address of machines in a network? I need to discover the machines that are available just with only BIOS installed (NO Operating System) And I need to find the mac address of ...
8
votes
5answers
1k views

In TCP/IP terms, how does a download speed limiter in an office work?

Assume an office of people, they want to limit HTTP downloads to a max of 40% bandwidth of their internet connection speed so that it doesn't block other traffic. We say "it's not supported in your ...
8
votes
4answers
5k views

haproxy + stunnel + keep-alive?

I'd like to put stunnel in front of haproxy 1.4 to handle HTTPS traffic. I also need stunnel to add the X-Forwarded-For header. This can be achieved by the "stunnel-4.xx-xforwarded-for.diff" patches ...
8
votes
4answers
18k views

How do I make cURL use keepalive from the command line?

I'm trying to verify that HTTP persistent connections are being used during communication with a Tomcat webserver I've got running. Currently, I can retrieve a resource on my server from a browser ...
8
votes
2answers
5k views

How can I tune the initial TCP retransmit timeout?

The initial TCP RTO value of 3s is too long for most LAN-based applications. How can I tune it lower? Is there a sysctl?
8
votes
1answer
23k views

What does “net_ratelimit: 44 callbacks suppressed” mean on a linux based router?

I'm trying to tune Snort performance on a Debian based router. I was seeing stuff like: snort packet recv contents failure: No buffer space available So I upped the buffers to 8M and when that ...
8
votes
3answers
1k views

Can I make TCP/IP session to run less than 60 seconds?

Our server is overloaded with TCP/IP sessions, we have 1200 - 1500 of them. Most of them are hanging in TIME_OUT state. It turns out that a connection in TIME_OUT state occupies a socket until 60 ...
8
votes
2answers
9k views

Many dropped packets of my NIC

I have a server running on CentOS 5.3 (a comet chat server, will have lots of tcp connections). Recently I found it was very slow (http service and ssh) so I use "ifconfig" command to figured out what ...
8
votes
1answer
220 views

Where can I embed proprietary information in a layer 2 or layer 3 packet?

The Citrix Netscaler has an interesting property that embeds information in the TCP packet that gets sent to the host. This property is echoed back to the Netscaler in such a way that the Netscaler ...
7
votes
5answers
690 views

Convey multicast (to another LAN) through WAN disabling multicast

My Server and Client softwares run both on Linux. The Server broadcasts multicast, the Client listens multicast. My Client has to migrate to another site, and unfortunately multicast is not allowed ...
7
votes
4answers
42k views

What causes duplicate ACK records?

We're reviewing Wireshark captures from a few client machines that are showing multiple duplicate ACK records which then triggers retransmit and out-of-sequence packets. These are shown in the ...
7
votes
2answers
659 views

Why are people trying to connect to my network on TCP port 445?

I was playing with my new syslog server and had my m0n0wall firewall logs forwarded as a test, I noticed a bunch of recent firewall log entries that say that it blocked other WAN IPs from my ISP (I ...
7
votes
2answers
2k views

How can I take advantage of IW10 in kernel 2.6.33?

I've read that 2.6.33+ allows setting custom cwnd. if the IW is 10 by default (for all distros? only some?) how does one view what the current IW is on a particular compiled kernel? references: ...
7
votes
1answer
719 views

What is theoretical maximum of TCP traffic over GigaEthernet?

What is theoretical maximum of TCP traffic over GigaEthernet ?
7
votes
3answers
5k views

TIME_WAIT connections not being cleaned up after timeout period expires

I am stress testing one of my servers by hitting it with a constant stream of new network connections, the tcp_fin_timeout is set to 60, so if I send a constant stream of something like 100 requests ...
7
votes
2answers
1k views

tcpdump: snaplen set to 0 but still get “Packet size limited during capture”?

Due to this problem, I'm going to sniff some packets on the MySQL server backend to see what happens: # tcpdump -vv -s0 -c 100 -i bond0 tcp port 3306 and host 192.168.3.87 -w ...
7
votes
4answers
7k views

How does TCP Ping or Traceroute Work?

How does the tcp ping or traceroute work? Does it take in account just the time it takes to establis the TCP handshake? Also in ICMP ping you can specify the packet size, can this be achieved in TCP ...
7
votes
1answer
297 views

What are possible downsides to setting a (very) large initcwnd for high-bandwidth connections?

I have been experimenting with the TCP parameters in Linux (with a 3.5 kernel). Basically concerning this connection: Server: Gigabit uplink in datacenter, actual bandwidth (due to sharing uplinks) ...