TCP stands for Transmission Control Protocol and is one of the core protocols of the Internet Protocol Suite. TCP complements the Internet Protocol (IP), and therefore the entire suite is commonly referred to as TCP/IP.

learn more… | top users | synonyms

7
votes
2answers
3k views

tcp flags in iptables: What's the difference between RST SYN and RST and SYN RST ? When to use ALL?

I'm working on a firewall for a virtual dedicated server and one of the things I'm looking into is port scanners. TCP flags are used for protection. I have 2 questions. The rule: -p tcp ...
7
votes
2answers
711 views

Why are people trying to connect to my network on TCP port 445?

I was playing with my new syslog server and had my m0n0wall firewall logs forwarded as a test, I noticed a bunch of recent firewall log entries that say that it blocked other WAN IPs from my ISP (I ...
7
votes
1answer
1k views

What is theoretical maximum of TCP traffic over GigaEthernet?

What is theoretical maximum of TCP traffic over GigaEthernet ?
7
votes
3answers
5k views

tool for splitting pcap files by TCP connection?

Is there tool to split a packet capture file (in pcap format) into separate files for each TCP connection ? (other than a home grown shell script which probably needs to run twice over the ...
7
votes
2answers
10k views

How can I search the info column in WireShark?

WireShark | Windows I want to search a packet capture of SMTP traffic for specific addresses/messages. Normally, I just sort the info column and browse but it would be nice if I could just run a ...
7
votes
3answers
6k views

TIME_WAIT connections not being cleaned up after timeout period expires

I am stress testing one of my servers by hitting it with a constant stream of new network connections, the tcp_fin_timeout is set to 60, so if I send a constant stream of something like 100 requests ...
7
votes
2answers
376 views

How does Intel AMT (Active Management Technology) not interfere with the TCP/IP host stack?

The Intel dev kit I've been using includes a remote management feature (also see the Ubuntu man page here) which allows remote reboots in case the operating system hangs. It has the capability of ...
7
votes
2answers
893 views

Varnish running out of open ports, lots of SYN_SENT connections

Recently we've been experiencing issues with our Varnish (3x) -> Apache (3x) setup, resulting in a huge spike in SYN_SENT connections. The spike itself is due to the amount of new traffic hitting the ...
7
votes
2answers
2k views

tcpdump: snaplen set to 0 but still get “Packet size limited during capture”?

Due to this problem, I'm going to sniff some packets on the MySQL server backend to see what happens: # tcpdump -vv -s0 -c 100 -i bond0 tcp port 3306 and host 192.168.3.87 -w ...
7
votes
4answers
8k views

How does TCP Ping or Traceroute Work?

How does the tcp ping or traceroute work? Does it take in account just the time it takes to establis the TCP handshake? Also in ICMP ping you can specify the packet size, can this be achieved in TCP ...
7
votes
2answers
426 views

What are possible downsides to setting a (very) large initcwnd for high-bandwidth connections?

I have been experimenting with the TCP parameters in Linux (with a 3.5 kernel). Basically concerning this connection: Server: Gigabit uplink in datacenter, actual bandwidth (due to sharing uplinks) ...
6
votes
2answers
968 views

TCP Dump, cannot understand these 4 lines?

I need support understanding these 4 lines. looks like tcp dump but im actully not understanding what exactly is happening here. 13:13:22.407445 IP 192.168.246.128.54955 > 192.168.246.13.80: S ...
6
votes
2answers
6k views

Clarification about Linux TCP window size and delays

I have delays when sending data through a TCP channel I am not able to understand. The link is a 1Gb link with a end to end latency of roughly 40ms. In my current setup, latency (the time from one ...
6
votes
5answers
4k views

Does the TCP source port have to be unique per host?

I've learned that a TCP connection is identified by the tuple (source IP, source port, destination ip, destination port). Theoretically, it should thus be possible to have a client from host1:port1 ...
6
votes
2answers
5k views

Force forwarder DNS requests to TCP mode

I have set up a DNS-server on SLES10 (currently bind 9.6) on a multi-homed server. This server can be queried from all internal networks and delivers answers for all internal networks. We have two ...
6
votes
1answer
1k views

How to expose a UNIX domain socket directly over TCP

I'd like to have a UNIX domain socket, say /var/program/program.cmd for example, exposed via TCP, lets say on port 12345. I'd also like this to be running full time in the background. What's the best ...
6
votes
4answers
3k views

TCP monitoring on a server: comparing netstat vs lsof?

I'm monitoring the TCP stack on a server hoping to generically infer problems with application on the box. My first inclination is to measure the number of sockets in all reported states ...
6
votes
2answers
1k views

TCP SYN Flooding Detection Method in the Linux Kernel

When the Linux kernel detects SYN Flooding it logs a message like: possible SYN flooding on port 80. Sending cookies Does anyone know the exact method that the kernel uses to detect this?
6
votes
1answer
2k views

tcpdump filter for tcp zero window messages

Is there a pcap filter for TCPDump that will allow be to filter zero window messages? I know how to filter these in a wireshark display filter (tcp.analysis.zero_window) but the amount of data I ...
6
votes
4answers
3k views

How do I check how many connections are open currently on a specific TCP port?

I'm doing some comet benchmarks and would like to see how many open connections I have. Actually I use netstat: netstat -ant | grep 8080 | grep EST | wc -l But it needs around 4-6 minutes to list ...
6
votes
2answers
2k views

More than 65536 TCP connections on Linux

I'm stuck trying to setup more than 65536 outgoing TCP connections from a Linux (RedHat5) box. I have already configured both outgoing and accepting boxes to allow enough file descriptors. I don't ...
6
votes
2answers
2k views

Overhead of TLS/SSL on a TCP socket connection?

Is there any bandwidth overhead on using SSL on a TCP connection? I understand, of course, the processing/memory usage overhead in encrypting and decrypting packets, but as far as bandwidth is ...
6
votes
6answers
3k views

OpenVPN over TCP, terrible latency but only on Win7 x64

I know TCP encapsulated over TCP is a terrible idea in general, but I can deal with the occasional decreased performance and MTU issues, and the snowball effect TCP within TCP provides where error ...
6
votes
2answers
5k views

Fixing window scaling problems with Linux TCP

I'm trying to improve the throughput of one of my servers overseas and after monitoring a transfer between the server and my home computer with wireshark I'm pretty sure I have a problem with the ...
6
votes
4answers
2k views

Automatically-reconnecting TCP tunnel

I have an unreliable network connection between two machines: sometimes active TCP connections get dropped for reasons beyond my control. I want to establish a reliable TCP connection between the two ...
6
votes
3answers
7k views

How to kill a TCP connection using tcpkill utility

I'm trying to kill an ESTABLISHED TCP connection using tcpkill. The connection is an open HTTPS connection. It appears on netstat as: tcp 0 0 X.X.X.X:55601 X.X.X.X:https ...
6
votes
2answers
619 views

Haproxy using 10GB Memory and 100% CPU with 50k connections

On a Ubuntu 14.04 x64 server, Haproxy uses 3.3 GB of memory and 6.8 GB of swap, while handling 52k connections. The CPU usage also keeps spiking to 100% before most of the traffic was redirected to ...
6
votes
1answer
4k views

How do I prevent TCP connection freezes over an OpenVPN network?

New details added at the end of this question; it's possible that I'm zeroing in on the cause. I have a UDP OpenVPN-based VPN set up in tap mode (I need tap because I need the VPN to pass multicast ...
6
votes
0answers
2k views

TCP RST right after FIN/ACK [closed]

I am having the weirdest issue: a web server which sometimes, only on very specific requests, will send a RST to the client after having sent the FIN datagram. First, a description of the setup: ...
6
votes
3answers
2k views

apache webserver unresponsive with server-status showing all child processes waiting for connection

My setup: i have 3 nearly identical webserver machines serving the same high loaded dynamic website with simple load balancing over dns. The service has been working for over two years with the same ...
5
votes
6answers
992 views

How can I find the total number of TCP connections for a given port and period of time by IP?

On a Linux system there are plenty of methods for listing the current TCP connections for a given port by connecting IP but: how can I count the total number of connections to a port per source IP for ...
5
votes
5answers
3k views

Many ISP's is block port 25, how do I choose an alternative port?

I am building an application that will be acting as a combined MUA/MTA on different networks. However, many of the networks are with ISP's that block port 25 for SMTP. Therefore I would also like to ...
5
votes
6answers
4k views

TCP connection handshake

Why is in TCP a 3-way handshake used during establishing a connection? Meaning, why it is not enough to use a 2-way handshake?
5
votes
4answers
655 views

Why was the FTP protocol designed to use more than one port?

The question is in the title. The reason I wonder this is because I'm coding an tcp service and would like to explore some of the reasons as they may shed some light on my work.
5
votes
3answers
2k views

How valuable is TCP Window Scaling?

On a busy† Debian Lenny server of mine I am considering disabling TCP Window Scaling. Why? I'd like to enable syn cookies, which disables TCP Window Scaling. This server is locally firewalled and ...
5
votes
1answer
16k views

Why does WireShark think this frame is a TCP segment of a reassembled PDU

Please find a small pcap file here illustrating my problem. I have a three-way TCP handshake, followed by two FIX logons. (FIX is a protocol used in trading.) The first FIX logon (frame 4) is ...
5
votes
1answer
4k views

Proxy with netcat forever

I am proxying a VNC TCP server port with netcat. The proxy machine runs linux. This is the comand I use: mkfifo backpipe nc -l 5902 0<backpipe | nc 10.1.1.116 5902 1>backpipe 10.1.1.116 is ...
5
votes
2answers
2k views

Duplicate incoming TCP traffic on Debian Squeeze

I have to test a homebrew server that accepts a lot of incoming TCP traffic on a single port. The protocol is homebrew as well. For testing purposes, I'd like to send this traffic both : - to the ...
5
votes
1answer
2k views

Determining at what time a currently open TCP connection was created?

How can I find out at what time a currently open TCP connection was established on Linux?
5
votes
5answers
1k views

Forwarding Windows log event using TCP

I'm looking for a way to safely centralize all my Windows and Linux logs on one location. Since I'm in a mixed environment, with both Linux and Windows, I started using Syslog-ng on the Linux boxes ...
5
votes
1answer
151 views

Odd TCP termination sequence

While troubleshooting another thing, I've noticed an odd pattern of TCP closes. Packets: http://www.cloudshark.org/captures/7590ec4e6bef What's happening is that the last few packets of the close ...
5
votes
2answers
1k views

How do I optimize TCP stack for HTTP server?

I have a HTTP server that serves only two kinds of page: about 10 KB and about 16 KB (both compressed, other files are from CDN). As the latency is quite high (ping takes more than 300 ms), I want to ...
5
votes
1answer
2k views

Finding short-lived TCP connections owner process

Running tcpdump on local connections to an apache server, I found TCP connections being established and closed immediately every 2 seconds. How do I find which process is responsible for these? ...
5
votes
1answer
556 views

What is the meaning of “Treason Uncloaked” in Linux?

On a Linux Apache server, from time to time, there are messages saying TCP: Treason uncloaked!. There are previous questions on ServerFault explaining the fixes for this issue. However does anyone ...
5
votes
3answers
613 views

Is SYN flooding still a threat?

Well recently I've been reading about different Denial of Service methods. One method that kind of stuck out was SYN flooding. I'm a member of some not-so-nice forums, and someone was selling a python ...
5
votes
2answers
753 views

Network error with 65k of TIME_WAIT connections

We had some trouble with one of our image servers last week and need some help. See our munin monitoring graph: We are runing debian squeeze and we have lots of requests because this is one of our ...
5
votes
1answer
5k views

Too many TCP connections causes disconnections

I have a game server which runs with TCP connections. Server disconnects users randomly. I think its related with TCP settings of server. In local development environment written code can handle ...
5
votes
1answer
4k views

Increasing the number of outbound TCP connections

I am developing a small test client for websockets. I am using Ubuntu 11.04 . I have read http://stackoverflow.com/questions/410616/increasing-the-maximum-number-of-tcp-ip-connections-in-linux and I ...
5
votes
1answer
5k views

Forwarding linux terminal from serial port to TCP with socat

I'm working on embedded ARM platform, Slackware. I'm using G24 Java modem which is configured to forward data between ports /dev/ttyS1 and /dev/ttyACM0, so anything that goes onto any of these ports ...
5
votes
1answer
138 views

POST of MTU + ~798 bytes gets lost

I have a very weird issue with certain packets not arriving on the destination host. It happens when we transmit a POST that is somewhat larger than the MTU. We can reproduce it with this script: ...