TCP stands for Transmission Control Protocol and is one of the core protocols of the Internet Protocol Suite. TCP complements the Internet Protocol (IP), and therefore the entire suite is commonly referred to as TCP/IP.

learn more… | top users | synonyms

8
votes
3answers
2k views

Can I make TCP/IP session to run less than 60 seconds?

Our server is overloaded with TCP/IP sessions, we have 1200 - 1500 of them. Most of them are hanging in TIME_OUT state. It turns out that a connection in TIME_OUT state occupies a socket until 60 ...
8
votes
2answers
257 views

Extreme UDP packet loss at 300Mbit (14%), but TCP > 800Mbit w/o retransmits

I have a linux box I use as the iperf3 client, testing 2 identically equipped Windows 2012 R2 server boxes with Broadcom BCM5721, 1Gb adapters (2 ports, but only 1 used for the test). All machines are ...
8
votes
2answers
664 views

How does Intel AMT (Active Management Technology) not interfere with the TCP/IP host stack?

The Intel dev kit I've been using includes a remote management feature (also see the Ubuntu man page here) which allows remote reboots in case the operating system hangs. It has the capability of ...
8
votes
1answer
743 views

TCP packet being retransmitted 7 times when sysctl tcp_retries1 is set to 3 - why?

Ubuntu 12.04 I am trying to better understand how many times TCP will attempt to retransmit a packet when it does not receive confirmation the destination received it. After reading the tcp man page ...
8
votes
4answers
9k views

How does TCP Ping or Traceroute Work?

How does the tcp ping or traceroute work? Does it take in account just the time it takes to establis the TCP handshake? Also in ICMP ping you can specify the packet size, can this be achieved in TCP ...
8
votes
0answers
91 views

How does server-side `TIME_WAIT` really work?

I know there are quite a few SE questions on this, and I believe I read as many of them as it matters before coming to this point. By "server-side TIME_WAIT" I mean the state of a server-side socket ...
7
votes
2answers
2k views

TCP Dump, cannot understand these 4 lines?

I need support understanding these 4 lines. looks like tcp dump but im actully not understanding what exactly is happening here. 13:13:22.407445 IP 192.168.246.128.54955 > 192.168.246.13.80: S ...
7
votes
5answers
1k views

Convey multicast (to another LAN) through WAN disabling multicast

My Server and Client softwares run both on Linux. The Server broadcasts multicast, the Client listens multicast. My Client has to migrate to another site, and unfortunately multicast is not allowed ...
7
votes
2answers
4k views

tcp flags in iptables: What's the difference between RST SYN and RST and SYN RST ? When to use ALL?

I'm working on a firewall for a virtual dedicated server and one of the things I'm looking into is port scanners. TCP flags are used for protection. I have 2 questions. The rule: -p tcp ...
7
votes
2answers
747 views

Why are people trying to connect to my network on TCP port 445?

I was playing with my new syslog server and had my m0n0wall firewall logs forwarded as a test, I noticed a bunch of recent firewall log entries that say that it blocked other WAN IPs from my ISP (I ...
7
votes
4answers
3k views

TCP monitoring on a server: comparing netstat vs lsof?

I'm monitoring the TCP stack on a server hoping to generically infer problems with application on the box. My first inclination is to measure the number of sockets in all reported states ...
7
votes
1answer
1k views

What is theoretical maximum of TCP traffic over GigaEthernet?

What is theoretical maximum of TCP traffic over GigaEthernet ?
7
votes
3answers
6k views

tool for splitting pcap files by TCP connection?

Is there tool to split a packet capture file (in pcap format) into separate files for each TCP connection ? (other than a home grown shell script which probably needs to run twice over the ...
7
votes
2answers
3k views

More than 65536 TCP connections on Linux

I'm stuck trying to setup more than 65536 outgoing TCP connections from a Linux (RedHat5) box. I have already configured both outgoing and accepting boxes to allow enough file descriptors. I don't ...
7
votes
3answers
6k views

TIME_WAIT connections not being cleaned up after timeout period expires

I am stress testing one of my servers by hitting it with a constant stream of new network connections, the tcp_fin_timeout is set to 60, so if I send a constant stream of something like 100 requests ...
7
votes
3answers
9k views

How to kill a TCP connection using tcpkill utility

I'm trying to kill an ESTABLISHED TCP connection using tcpkill. The connection is an open HTTPS connection. It appears on netstat as: tcp 0 0 X.X.X.X:55601 X.X.X.X:https ...
7
votes
4answers
2k views

Automatically-reconnecting TCP tunnel

I have an unreliable network connection between two machines: sometimes active TCP connections get dropped for reasons beyond my control. I want to establish a reliable TCP connection between the two ...
7
votes
2answers
1k views

Varnish running out of open ports, lots of SYN_SENT connections

Recently we've been experiencing issues with our Varnish (3x) -> Apache (3x) setup, resulting in a huge spike in SYN_SENT connections. The spike itself is due to the amount of new traffic hitting the ...
7
votes
2answers
3k views

tcpdump: snaplen set to 0 but still get “Packet size limited during capture”?

Due to this problem, I'm going to sniff some packets on the MySQL server backend to see what happens: # tcpdump -vv -s0 -c 100 -i bond0 tcp port 3306 and host 192.168.3.87 -w ...
7
votes
2answers
508 views

What are possible downsides to setting a (very) large initcwnd for high-bandwidth connections?

I have been experimenting with the TCP parameters in Linux (with a 3.5 kernel). Basically concerning this connection: Server: Gigabit uplink in datacenter, actual bandwidth (due to sharing uplinks) ...
6
votes
5answers
4k views

Does the TCP source port have to be unique per host?

I've learned that a TCP connection is identified by the tuple (source IP, source port, destination ip, destination port). Theoretically, it should thus be possible to have a client from host1:port1 ...
6
votes
2answers
7k views

Clarification about Linux TCP window size and delays

I have delays when sending data through a TCP channel I am not able to understand. The link is a 1Gb link with a end to end latency of roughly 40ms. In my current setup, latency (the time from one ...
6
votes
2answers
6k views

Force forwarder DNS requests to TCP mode

I have set up a DNS-server on SLES10 (currently bind 9.6) on a multi-homed server. This server can be queried from all internal networks and delivers answers for all internal networks. We have two ...
6
votes
1answer
2k views

How to expose a UNIX domain socket directly over TCP

I'd like to have a UNIX domain socket, say /var/program/program.cmd for example, exposed via TCP, lets say on port 12345. I'd also like this to be running full time in the background. What's the best ...
6
votes
1answer
20k views

Why does WireShark think this frame is a TCP segment of a reassembled PDU

Please find a small pcap file here illustrating my problem. I have a three-way TCP handshake, followed by two FIX logons. (FIX is a protocol used in trading.) The first FIX logon (frame 4) is ...
6
votes
2answers
18k views

How to troubleshoot connectivity when curl gets an *empty response*

I want to know how to proceed in troubleshooting why a curl request to a webserver doesn't work. I'm not looking for help that would be dependent upon my environment, I just want to know how to ...
6
votes
1answer
5k views

Proxy with netcat forever

I am proxying a VNC TCP server port with netcat. The proxy machine runs linux. This is the comand I use: mkfifo backpipe nc -l 5902 0<backpipe | nc 10.1.1.116 5902 1>backpipe 10.1.1.116 is ...
6
votes
4answers
4k views

How do I check how many connections are open currently on a specific TCP port?

I'm doing some comet benchmarks and would like to see how many open connections I have. Actually I use netstat: netstat -ant | grep 8080 | grep EST | wc -l But it needs around 4-6 minutes to list ...
6
votes
2answers
1k views

TCP SYN Flooding Detection Method in the Linux Kernel

When the Linux kernel detects SYN Flooding it logs a message like: possible SYN flooding on port 80. Sending cookies Does anyone know the exact method that the kernel uses to detect this?
6
votes
1answer
2k views

tcpdump filter for tcp zero window messages

Is there a pcap filter for TCPDump that will allow be to filter zero window messages? I know how to filter these in a wireshark display filter (tcp.analysis.zero_window) but the amount of data I ...
6
votes
2answers
2k views

Overhead of TLS/SSL on a TCP socket connection?

Is there any bandwidth overhead on using SSL on a TCP connection? I understand, of course, the processing/memory usage overhead in encrypting and decrypting packets, but as far as bandwidth is ...
6
votes
6answers
4k views

OpenVPN over TCP, terrible latency but only on Win7 x64

I know TCP encapsulated over TCP is a terrible idea in general, but I can deal with the occasional decreased performance and MTU issues, and the snowball effect TCP within TCP provides where error ...
6
votes
2answers
6k views

Fixing window scaling problems with Linux TCP

I'm trying to improve the throughput of one of my servers overseas and after monitoring a transfer between the server and my home computer with wireshark I'm pretty sure I have a problem with the ...
6
votes
2answers
881 views

Haproxy using 10GB Memory and 100% CPU with 50k connections

On a Ubuntu 14.04 x64 server, Haproxy uses 3.3 GB of memory and 6.8 GB of swap, while handling 52k connections. The CPU usage also keeps spiking to 100% before most of the traffic was redirected to ...
6
votes
4answers
3k views

apache webserver unresponsive with server-status showing all child processes waiting for connection

My setup: i have 3 nearly identical webserver machines serving the same high loaded dynamic website with simple load balancing over dns. The service has been working for over two years with the same ...
6
votes
2answers
170 views

TCP acks are paused, then resumed, then paused again. Why?

I would like some help finding the reason for the reduced data transfer rate in my application. I have 12 embedded systems and a Linux server. The embedded systems send data to the server over TCP on ...
6
votes
1answer
5k views

How do I prevent TCP connection freezes over an OpenVPN network?

New details added at the end of this question; it's possible that I'm zeroing in on the cause. I have a UDP OpenVPN-based VPN set up in tap mode (I need tap because I need the VPN to pass multicast ...
6
votes
1answer
4k views

Increasing the number of outbound TCP connections

I am developing a small test client for websockets. I am using Ubuntu 11.04 . I have read http://stackoverflow.com/questions/410616/increasing-the-maximum-number-of-tcp-ip-connections-in-linux and I ...
6
votes
3answers
322 views

Why is my web server dropping connections with a TCP reset at high load?

I have a small VPS setup with nginx. I want to squeeze as much performance as possible out of it, so I've been experimenting with optimization and load testing. I'm using Blitz.io to do load testing ...
6
votes
0answers
3k views

TCP RST right after FIN/ACK [closed]

I am having the weirdest issue: a web server which sometimes, only on very specific requests, will send a RST to the client after having sent the FIN datagram. First, a description of the setup: ...
5
votes
6answers
1k views

How can I find the total number of TCP connections for a given port and period of time by IP?

On a Linux system there are plenty of methods for listing the current TCP connections for a given port by connecting IP but: how can I count the total number of connections to a port per source IP for ...
5
votes
5answers
4k views

Many ISP's is block port 25, how do I choose an alternative port?

I am building an application that will be acting as a combined MUA/MTA on different networks. However, many of the networks are with ISP's that block port 25 for SMTP. Therefore I would also like to ...
5
votes
6answers
4k views

TCP connection handshake

Why is in TCP a 3-way handshake used during establishing a connection? Meaning, why it is not enough to use a 2-way handshake?
5
votes
1answer
1k views

HTTP, TCP, UDP and connectionless

I am a bit confused with HTTP lately. Some facts are that TCP can operate connection orientated or connectionless, this I understand. TCP though is connection-oriented while UDP is connectionless ...
5
votes
4answers
755 views

Why was the FTP protocol designed to use more than one port?

The question is in the title. The reason I wonder this is because I'm coding an tcp service and would like to explore some of the reasons as they may shed some light on my work.
5
votes
1answer
5k views

Unexpectedly shrunk window

I run a major media upload/download site and I noticed these: Is this serious or background noise due to the big file sizes and is there any tweaks I can add to /etc/sysctl.conf to improve and ...
5
votes
3answers
3k views

How valuable is TCP Window Scaling?

On a busy† Debian Lenny server of mine I am considering disabling TCP Window Scaling. Why? I'd like to enable syn cookies, which disables TCP Window Scaling. This server is locally firewalled and ...
5
votes
2answers
2k views

Duplicate incoming TCP traffic on Debian Squeeze

I have to test a homebrew server that accepts a lot of incoming TCP traffic on a single port. The protocol is homebrew as well. For testing purposes, I'd like to send this traffic both : - to the ...
5
votes
1answer
2k views

Determining at what time a currently open TCP connection was created?

How can I find out at what time a currently open TCP connection was established on Linux?
5
votes
1answer
173 views

Odd TCP termination sequence

While troubleshooting another thing, I've noticed an odd pattern of TCP closes. Packets: http://www.cloudshark.org/captures/7590ec4e6bef What's happening is that the last few packets of the close ...