TCP stands for Transmission Control Protocol and is one of the core protocols of the Internet Protocol Suite. TCP complements the Internet Protocol (IP), and therefore the entire suite is commonly referred to as TCP/IP.

learn more… | top users | synonyms

7
votes
2answers
692 views

Why are people trying to connect to my network on TCP port 445?

I was playing with my new syslog server and had my m0n0wall firewall logs forwarded as a test, I noticed a bunch of recent firewall log entries that say that it blocked other WAN IPs from my ISP (I ...
7
votes
2answers
2k views

How can I take advantage of IW10 in kernel 2.6.33?

I've read that 2.6.33+ allows setting custom cwnd. if the IW is 10 by default (for all distros? only some?) how does one view what the current IW is on a particular compiled kernel? references: ...
7
votes
1answer
887 views

What is theoretical maximum of TCP traffic over GigaEthernet?

What is theoretical maximum of TCP traffic over GigaEthernet ?
7
votes
3answers
5k views

tool for splitting pcap files by TCP connection?

Is there tool to split a packet capture file (in pcap format) into separate files for each TCP connection ? (other than a home grown shell script which probably needs to run twice over the ...
7
votes
3answers
5k views

TIME_WAIT connections not being cleaned up after timeout period expires

I am stress testing one of my servers by hitting it with a constant stream of new network connections, the tcp_fin_timeout is set to 60, so if I send a constant stream of something like 100 requests ...
7
votes
2answers
2k views

tcpdump: snaplen set to 0 but still get “Packet size limited during capture”?

Due to this problem, I'm going to sniff some packets on the MySQL server backend to see what happens: # tcpdump -vv -s0 -c 100 -i bond0 tcp port 3306 and host 192.168.3.87 -w ...
7
votes
4answers
8k views

How does TCP Ping or Traceroute Work?

How does the tcp ping or traceroute work? Does it take in account just the time it takes to establis the TCP handshake? Also in ICMP ping you can specify the packet size, can this be achieved in TCP ...
7
votes
2answers
371 views

What are possible downsides to setting a (very) large initcwnd for high-bandwidth connections?

I have been experimenting with the TCP parameters in Linux (with a 3.5 kernel). Basically concerning this connection: Server: Gigabit uplink in datacenter, actual bandwidth (due to sharing uplinks) ...
6
votes
5answers
3k views

Does the TCP source port have to be unique per host?

I've learned that a TCP connection is identified by the tuple (source IP, source port, destination ip, destination port). Theoretically, it should thus be possible to have a client from host1:port1 ...
6
votes
2answers
5k views

Clarification about Linux TCP window size and delays

I have delays when sending data through a TCP channel I am not able to understand. The link is a 1Gb link with a end to end latency of roughly 40ms. In my current setup, latency (the time from one ...
6
votes
2answers
4k views

Force forwarder DNS requests to TCP mode

I have set up a DNS-server on SLES10 (currently bind 9.6) on a multi-homed server. This server can be queried from all internal networks and delivers answers for all internal networks. We have two ...
6
votes
1answer
2k views

tcpdump filter for tcp zero window messages

Is there a pcap filter for TCPDump that will allow be to filter zero window messages? I know how to filter these in a wireshark display filter (tcp.analysis.zero_window) but the amount of data I ...
6
votes
4answers
2k views

TCP monitoring on a server: comparing netstat vs lsof?

I'm monitoring the TCP stack on a server hoping to generically infer problems with application on the box. My first inclination is to measure the number of sockets in all reported states ...
6
votes
2answers
1k views

TCP SYN Flooding Detection Method in the Linux Kernel

When the Linux kernel detects SYN Flooding it logs a message like: possible SYN flooding on port 80. Sending cookies Does anyone know the exact method that the kernel uses to detect this?
6
votes
2answers
9k views

How can I search the info column in WireShark?

WireShark | Windows I want to search a packet capture of SMTP traffic for specific addresses/messages. Normally, I just sort the info column and browse but it would be nice if I could just run a ...
6
votes
2answers
2k views

More than 65536 TCP connections on Linux

I'm stuck trying to setup more than 65536 outgoing TCP connections from a Linux (RedHat5) box. I have already configured both outgoing and accepting boxes to allow enough file descriptors. I don't ...
6
votes
2answers
2k views

Overhead of TLS/SSL on a TCP socket connection?

Is there any bandwidth overhead on using SSL on a TCP connection? I understand, of course, the processing/memory usage overhead in encrypting and decrypting packets, but as far as bandwidth is ...
6
votes
6answers
3k views

OpenVPN over TCP, terrible latency but only on Win7 x64

I know TCP encapsulated over TCP is a terrible idea in general, but I can deal with the occasional decreased performance and MTU issues, and the snowball effect TCP within TCP provides where error ...
6
votes
2answers
4k views

Fixing window scaling problems with Linux TCP

I'm trying to improve the throughput of one of my servers overseas and after monitoring a transfer between the server and my home computer with wireshark I'm pretty sure I have a problem with the ...
6
votes
1answer
136 views

How does Intel AMT (Active Management Technology) not interfere with the TCP/IP host stack?

The Intel dev kit I've been using includes a remote management feature (also see the Ubuntu man page here) which allows remote reboots in case the operating system hangs. It has the capability of ...
6
votes
1answer
2k views

How do I prevent TCP connection freezes over an OpenVPN network?

New details added at the end of this question; it's possible that I'm zeroing in on the cause. I have a UDP OpenVPN-based VPN set up in tap mode (I need tap because I need the VPN to pass multicast ...
6
votes
1answer
734 views

Varnish running out of open ports, lots of SYN_SENT connections

Recently we've been experiencing issues with our Varnish (3x) -> Apache (3x) setup, resulting in a huge spike in SYN_SENT connections. The spike itself is due to the amount of new traffic hitting the ...
6
votes
0answers
2k views

TCP RST right after FIN/ACK [closed]

I am having the weirdest issue: a web server which sometimes, only on very specific requests, will send a RST to the client after having sent the FIN datagram. First, a description of the setup: ...
5
votes
6answers
619 views

How can I find the total number of TCP connections for a given port and period of time by IP?

On a Linux system there are plenty of methods for listing the current TCP connections for a given port by connecting IP but: how can I count the total number of connections to a port per source IP for ...
5
votes
5answers
3k views

Many ISP's is block port 25, how do I choose an alternative port?

I am building an application that will be acting as a combined MUA/MTA on different networks. However, many of the networks are with ISP's that block port 25 for SMTP. Therefore I would also like to ...
5
votes
6answers
3k views

TCP connection handshake

Why is in TCP a 3-way handshake used during establishing a connection? Meaning, why it is not enough to use a 2-way handshake?
5
votes
3answers
2k views

How valuable is TCP Window Scaling?

On a busy† Debian Lenny server of mine I am considering disabling TCP Window Scaling. Why? I'd like to enable syn cookies, which disables TCP Window Scaling. This server is locally firewalled and ...
5
votes
1answer
921 views

How to expose a UNIX domain socket directly over TCP

I'd like to have a UNIX domain socket, say /var/program/program.cmd for example, exposed via TCP, lets say on port 12345. I'd also like this to be running full time in the background. What's the best ...
5
votes
2answers
2k views

Duplicate incoming TCP traffic on Debian Squeeze

I have to test a homebrew server that accepts a lot of incoming TCP traffic on a single port. The protocol is homebrew as well. For testing purposes, I'd like to send this traffic both : - to the ...
5
votes
4answers
2k views

How do I check how many connections are open currently on a specific TCP port?

I'm doing some comet benchmarks and would like to see how many open connections I have. Actually I use netstat: netstat -ant | grep 8080 | grep EST | wc -l But it needs around 4-6 minutes to list ...
5
votes
1answer
126 views

Odd TCP termination sequence

While troubleshooting another thing, I've noticed an odd pattern of TCP closes. Packets: http://www.cloudshark.org/captures/7590ec4e6bef What's happening is that the last few packets of the close ...
5
votes
2answers
1k views

How do I optimize TCP stack for HTTP server?

I have a HTTP server that serves only two kinds of page: about 10 KB and about 16 KB (both compressed, other files are from CDN). As the latency is quite high (ping takes more than 300 ms), I want to ...
5
votes
1answer
545 views

What is the meaning of “Treason Uncloaked” in Linux?

On a Linux Apache server, from time to time, there are messages saying TCP: Treason uncloaked!. There are previous questions on ServerFault explaining the fixes for this issue. However does anyone ...
5
votes
4answers
1k views

Automatically-reconnecting TCP tunnel

I have an unreliable network connection between two machines: sometimes active TCP connections get dropped for reasons beyond my control. I want to establish a reliable TCP connection between the two ...
5
votes
3answers
592 views

Is SYN flooding still a threat?

Well recently I've been reading about different Denial of Service methods. One method that kind of stuck out was SYN flooding. I'm a member of some not-so-nice forums, and someone was selling a python ...
5
votes
2answers
693 views

Network error with 65k of TIME_WAIT connections

We had some trouble with one of our image servers last week and need some help. See our munin monitoring graph: We are runing debian squeeze and we have lots of requests because this is one of our ...
5
votes
1answer
3k views

Too many TCP connections causes disconnections

I have a game server which runs with TCP connections. Server disconnects users randomly. I think its related with TCP settings of server. In local development environment written code can handle ...
5
votes
1answer
3k views

Increasing the number of outbound TCP connections

I am developing a small test client for websockets. I am using Ubuntu 11.04 . I have read http://stackoverflow.com/questions/410616/increasing-the-maximum-number-of-tcp-ip-connections-in-linux and I ...
5
votes
1answer
4k views

Forwarding linux terminal from serial port to TCP with socat

I'm working on embedded ARM platform, Slackware. I'm using G24 Java modem which is configured to forward data between ports /dev/ttyS1 and /dev/ttyACM0, so anything that goes onto any of these ports ...
5
votes
3answers
6k views

How to kill a TCP connection using tcpkill utility

I'm trying to kill an ESTABLISHED TCP connection using tcpkill. The connection is an open HTTPS connection. It appears on netstat as: tcp 0 0 X.X.X.X:55601 X.X.X.X:https ...
5
votes
2answers
2k views

apache webserver unresponsible with server-status showing all child processes waiting for connection

My setup: i have 3 nearly identical webserver machines serving the same high loaded dynamic website with simple load balancing over dns. The service has been working for over two ears with the same ...
4
votes
6answers
676 views

Effect of distance from server on page load speed

I measured the load speed of a static image file severed by nginx from my server (using pingdom service). The server should normally process this request within few seconds. My server is located in ...
4
votes
2answers
7k views

Should I use TCP or UDP to run a web server

I have just installed Apache web server on my computer. I have managed to use it locally (I can open index.php from my computer using my web browser). But I would like to make my web site available ...
4
votes
5answers
314 views

Which ports to use on a self-written tcp server

I am about to write tcp-server for a project my company is working on. The server will use several port for different tasks. During development we use just some portnumber we like: 1400, 1500, ...
4
votes
2answers
5k views

What are the ramifications of setting tcp_tw_recycle/reuse to 1?

I set both tcp_tw_recycle/reuse to 1 in my configuration file. What are the ramifications of doing this? If a tcp socket is re-used, does that pose a security risk? i.e. 2 different connections both ...
4
votes
1answer
700 views

HTTP, TCP, UDP and connectionless

I am a bit confused with HTTP lately. Some facts are that TCP can operate connection orientated or connectionless, this I understand. TCP though is connection-oriented while UDP is connectionless ...
4
votes
5answers
537 views

Share one IP address with a simple router

We have just moved into a new office and have been given our 'internet connection' in the following form: One Ethernet cable in the corner of the room An IP address with subnet mask 255.255.255.0 ...
4
votes
4answers
600 views

Why was the FTP protocol designed to use more than one port?

The question is in the title. The reason I wonder this is because I'm coding an tcp service and would like to explore some of the reasons as they may shed some light on my work.
4
votes
6answers
761 views

What causes a delay of 100 ms in initiating an HTTP connection?

Settings: this is a quad CPU machine, plenty strong, not loaded at all (neither CPU nor network), the client is a Windows Server 2008 64bit, the server is a linux box. I have four threads that are ...
4
votes
2answers
1k views

VMXNET3 performance on Linux on ESX 5.0

What kind of performance can I expect from VMXNET3 adapter when running two Linux guests on the same VMware ESX private network defined between those guests? I use VMXNET3 adapter for communicating ...