TCP stands for Transmission Control Protocol and is one of the core protocols of the Internet Protocol Suite. TCP complements the Internet Protocol (IP), and therefore the entire suite is commonly referred to as TCP/IP.

learn more… | top users | synonyms

9
votes
2answers
39k views

How to troubleshoot connectivity when curl gets an *empty response*

I want to know how to proceed in troubleshooting why a curl request to a webserver doesn't work. I'm not looking for help that would be dependent upon my environment, I just want to know how to ...
9
votes
4answers
4k views

TCP monitoring on a server: comparing netstat vs lsof?

I'm monitoring the TCP stack on a server hoping to generically infer problems with application on the box. My first inclination is to measure the number of sockets in all reported states (LISTEN,...
9
votes
2answers
14k views

Many dropped packets of my NIC

I have a server running on CentOS 5.3 (a comet chat server, will have lots of tcp connections). Recently I found it was very slow (http service and ssh) so I use "ifconfig" command to figured out what ...
9
votes
1answer
252 views

Where can I embed proprietary information in a layer 2 or layer 3 packet?

The Citrix Netscaler has an interesting property that embeds information in the TCP packet that gets sent to the host. This property is echoed back to the Netscaler in such a way that the Netscaler ...
9
votes
3answers
3k views

Lower TCP throughput from 1Gbps server than 100Mbps server over large RTT

We've got infrastructure distributed in a few major locations around the world - Singapore, London and Los Angeles. The RTT between any two locations is over >150ms. We've recently upgraded all of ...
8
votes
2answers
1k views

How to configure iptables so an unwanted port is not reported as filtered

I'd like to stop others from seeing my ports as filtered in the nmap standard scan (unprivileged). Let's say that I have the following ports open: 22, 3306, 995 and a firewall configured like this: -...
8
votes
3answers
8k views

What are the ramifications of setting tcp_tw_recycle/reuse to 1?

I set both tcp_tw_recycle/reuse to 1 in my configuration file. What are the ramifications of doing this? If a tcp socket is re-used, does that pose a security risk? i.e. 2 different connections both ...
8
votes
5answers
3k views

In TCP/IP terms, how does a download speed limiter in an office work?

Assume an office of people, they want to limit HTTP downloads to a max of 40% bandwidth of their internet connection speed so that it doesn't block other traffic. We say "it's not supported in your ...
8
votes
4answers
723 views

Simulate slow connection between two ubuntu server machines

I want to simulate the following scenario: given that I have 4 ubuntu server machines A,B,C and D. I want to reduce the network bandwidth by 20% between machine A and machine C and 10% between A and B....
8
votes
2answers
8k views

Force forwarder DNS requests to TCP mode

I have set up a DNS-server on SLES10 (currently bind 9.6) on a multi-homed server. This server can be queried from all internal networks and delivers answers for all internal networks. We have two ...
8
votes
2answers
3k views

Finding short-lived TCP connections owner process

Running tcpdump on local connections to an apache server, I found TCP connections being established and closed immediately every 2 seconds. How do I find which process is responsible for these? ...
8
votes
1answer
2k views

How can I take advantage of IW10 in kernel 2.6.33?

I've read that 2.6.33+ allows setting custom cwnd. if the IW is 10 by default (for all distros? only some?) how does one view what the current IW is on a particular compiled kernel? references: ...
8
votes
2answers
3k views

More than 65536 TCP connections on Linux

I'm stuck trying to setup more than 65536 outgoing TCP connections from a Linux (RedHat5) box. I have already configured both outgoing and accepting boxes to allow enough file descriptors. I don't ...
8
votes
3answers
2k views

Can I make TCP/IP session to run less than 60 seconds?

Our server is overloaded with TCP/IP sessions, we have 1200 - 1500 of them. Most of them are hanging in TIME_OUT state. It turns out that a connection in TIME_OUT state occupies a socket until 60 ...
8
votes
2answers
6k views

Extreme UDP packet loss at 300Mbit (14%), but TCP > 800Mbit w/o retransmits

I have a linux box I use as the iperf3 client, testing 2 identically equipped Windows 2012 R2 server boxes with Broadcom BCM5721, 1Gb adapters (2 ports, but only 1 used for the test). All machines are ...
8
votes
1answer
1k views

TCP packet being retransmitted 7 times when sysctl tcp_retries1 is set to 3 - why?

Ubuntu 12.04 I am trying to better understand how many times TCP will attempt to retransmit a packet when it does not receive confirmation the destination received it. After reading the tcp man page ...
8
votes
4answers
9k views

How does TCP Ping or Traceroute Work?

How does the tcp ping or traceroute work? Does it take in account just the time it takes to establis the TCP handshake? Also in ICMP ping you can specify the packet size, can this be achieved in TCP ...
8
votes
2answers
1k views

Where are my TIME_WAITs on Mac OS X?

No TIME_WAITs on Mac OS X Normally, when a TCP connection is closed, the socket on the side where close() is called first is left in the TIME_WAIT state. When one of the peers is a Mac OS X (Lion) ...
7
votes
3answers
3k views

How do high traffic sites service more than 65535 TCP connections?

If there is a limit on the number of ports one machine can have and a socket can only bind to an unused port number, how do servers experiencing extremely high amounts (more than the max port number) ...
7
votes
2answers
6k views

TCP Dump, cannot understand these 4 lines?

I need support understanding these 4 lines. looks like tcp dump but im actully not understanding what exactly is happening here. 13:13:22.407445 IP 192.168.246.128.54955 > 192.168.246.13.80: S ...
7
votes
5answers
3k views

Netcat fails to start in listening mode

I'm using CentOS 6.7 (Final) system, and when I try to run nc in listening mode it prints the following: # nc -l 1234 nc: Protocol not available The port is not bound. I tried other port numbers ...
7
votes
5answers
1k views

Convey multicast (to another LAN) through WAN disabling multicast

My Server and Client softwares run both on Linux. The Server broadcasts multicast, the Client listens multicast. My Client has to migrate to another site, and unfortunately multicast is not allowed ...
7
votes
2answers
8k views

tcp flags in iptables: What's the difference between RST SYN and RST and SYN RST ? When to use ALL?

I'm working on a firewall for a virtual dedicated server and one of the things I'm looking into is port scanners. TCP flags are used for protection. I have 2 questions. The rule: -p tcp --tcp-...
7
votes
2answers
12k views

Reduce firewall rules by half - one iptables rule for tcp and udp

I have a number of iptables rules on my firewall that look like this: iptables -A zone_lan_forward -p tcp -d 1.2.3.0/24 -j ACCEPT iptables -A zone_lan_forward -p udp -d 1.2.3.0/24 -j ACCEPT Is ...
7
votes
1answer
2k views

HTTP, TCP, UDP and connectionless

I am a bit confused with HTTP lately. Some facts are that TCP can operate connection orientated or connectionless, this I understand. TCP though is connection-oriented while UDP is connectionless ...
7
votes
1answer
3k views

How to expose a UNIX domain socket directly over TCP

I'd like to have a UNIX domain socket, say /var/program/program.cmd for example, exposed via TCP, lets say on port 12345. I'd also like this to be running full time in the background. What's the best ...
7
votes
2answers
795 views

Why are people trying to connect to my network on TCP port 445?

I was playing with my new syslog server and had my m0n0wall firewall logs forwarded as a test, I noticed a bunch of recent firewall log entries that say that it blocked other WAN IPs from my ISP (I ...
7
votes
1answer
28k views

Why does WireShark think this frame is a TCP segment of a reassembled PDU

Please find a small pcap file here illustrating my problem. I have a three-way TCP handshake, followed by two FIX logons. (FIX is a protocol used in trading.) The first FIX logon (frame 4) is ...
7
votes
4answers
7k views

How do I check how many connections are open currently on a specific TCP port?

I'm doing some comet benchmarks and would like to see how many open connections I have. Actually I use netstat: netstat -ant | grep 8080 | grep EST | wc -l But it needs around 4-6 minutes to list ...
7
votes
1answer
1k views

Will tcpdump see packets that are being dropped by iptables?

I have a firewall with these simple rules: iptables -A INPUT -p tcp -s 127.0.0.1/32 --dport 6000 -j ACCEPT iptables -A INPUT -p tcp -s 192.168.16.20/32 --dport 6000 -j ACCEPT iptables -A INPUT -p tcp ...
7
votes
1answer
2k views

What is theoretical maximum of TCP traffic over GigaEthernet?

What is theoretical maximum of TCP traffic over GigaEthernet ?
7
votes
3answers
8k views

tool for splitting pcap files by TCP connection?

Is there tool to split a packet capture file (in pcap format) into separate files for each TCP connection ? (other than a home grown shell script which probably needs to run twice over the capture...)...
7
votes
1answer
362 views

Difference between net.core.rmem_max and net.ipv4.tcp_rmem

What's the difference between net.core.rmem_max and the third value of net.ipv4.tcp_rmem? Which has the higher priority for tcp connections? For below two examples, what's the max buffer for tcp ...
7
votes
3answers
13k views

How to kill a TCP connection using tcpkill utility

I'm trying to kill an ESTABLISHED TCP connection using tcpkill. The connection is an open HTTPS connection. It appears on netstat as: tcp 0 0 X.X.X.X:55601 X.X.X.X:https ...
7
votes
3answers
7k views

TIME_WAIT connections not being cleaned up after timeout period expires

I am stress testing one of my servers by hitting it with a constant stream of new network connections, the tcp_fin_timeout is set to 60, so if I send a constant stream of something like 100 requests ...
7
votes
2answers
9k views

Fixing window scaling problems with Linux TCP

I'm trying to improve the throughput of one of my servers overseas and after monitoring a transfer between the server and my home computer with wireshark I'm pretty sure I have a problem with the ...
7
votes
4answers
3k views

better TCP performance over a “high delay network”

I’m trying to improve my TCP throughput over a “high delay network” between Linux machines. I set tcp_mem, tcp_wmem and tcp_rmem to “8192 7061504 7061504”. I set rmem_max, wmem_max, rmem_default and ...
7
votes
4answers
3k views

Automatically-reconnecting TCP tunnel

I have an unreliable network connection between two machines: sometimes active TCP connections get dropped for reasons beyond my control. I want to establish a reliable TCP connection between the two ...
7
votes
2answers
1k views

Varnish running out of open ports, lots of SYN_SENT connections

Recently we've been experiencing issues with our Varnish (3x) -> Apache (3x) setup, resulting in a huge spike in SYN_SENT connections. The spike itself is due to the amount of new traffic hitting the ...
7
votes
2answers
4k views

tcpdump: snaplen set to 0 but still get “Packet size limited during capture”?

Due to this problem, I'm going to sniff some packets on the MySQL server backend to see what happens: # tcpdump -vv -s0 -c 100 -i bond0 tcp port 3306 and host 192.168.3.87 -w /home/quanta/3....
7
votes
4answers
2k views

Why is my web server dropping connections with a TCP reset at high load?

I have a small VPS setup with nginx. I want to squeeze as much performance as possible out of it, so I've been experimenting with optimization and load testing. I'm using Blitz.io to do load testing ...
7
votes
2answers
771 views

What are possible downsides to setting a (very) large initcwnd for high-bandwidth connections?

I have been experimenting with the TCP parameters in Linux (with a 3.5 kernel). Basically concerning this connection: Server: Gigabit uplink in datacenter, actual bandwidth (due to sharing uplinks) ...
6
votes
2answers
18k views

What is [PSH, ACK] doing during my connection to a global catalog server?

A linux server of mine is trying to establish a LDAPS connection to a global catalog server and the connection is getting dropped (presumably by the GC side). For the purpose of discussion, let's ...
6
votes
4answers
660 views

ran out of tcp udp ports [closed]

How to resolve a Windows or Linux system that runs out of the tcp/udp ports on a single server? I have over around 65000 tcp/udp ports being used on a single server as a result of SQL connections, ...
6
votes
2answers
9k views

Clarification about Linux TCP window size and delays

I have delays when sending data through a TCP channel I am not able to understand. The link is a 1Gb link with a end to end latency of roughly 40ms. In my current setup, latency (the time from one ...
6
votes
2answers
3k views

Duplicate incoming TCP traffic on Debian Squeeze

I have to test a homebrew server that accepts a lot of incoming TCP traffic on a single port. The protocol is homebrew as well. For testing purposes, I'd like to send this traffic both : - to the ...
6
votes
1answer
4k views

Determining at what time a currently open TCP connection was created?

How can I find out at what time a currently open TCP connection was established on Linux?
6
votes
2answers
2k views

TCP SYN Flooding Detection Method in the Linux Kernel

When the Linux kernel detects SYN Flooding it logs a message like: possible SYN flooding on port 80. Sending cookies Does anyone know the exact method that the kernel uses to detect this?
6
votes
3answers
4k views

What does tcp_orphan_retries set to 0 mean?

Does setting tcp_orphan_retries to 0 mean there is no limit to retries, or does it mean that it won't retry at all?
6
votes
1answer
3k views

tcpdump filter for tcp zero window messages

Is there a pcap filter for TCPDump that will allow be to filter zero window messages? I know how to filter these in a wireshark display filter (tcp.analysis.zero_window) but the amount of data I ...