TCP stands for Transmission Control Protocol and is one of the core protocols of the Internet Protocol Suite. TCP complements the Internet Protocol (IP), and therefore the entire suite is commonly referred to as TCP/IP.

learn more… | top users | synonyms

6
votes
2answers
10k views

How do I prevent TCP connection freezes over an OpenVPN network?

New details added at the end of this question; it's possible that I'm zeroing in on the cause. I have a UDP OpenVPN-based VPN set up in tap mode (I need tap because I need the VPN to pass multicast ...
1
vote
1answer
229 views

Wireshark shows “TCP Dup Ack” on SACK after each regular ACK

I have a TCP session captured via switch port mirroring and tcpdump. When viewing it (in Wireshark), I see the same pattern whenever I send a message; here's an excerpt of the outbound packets (I don'...
0
votes
1answer
851 views

Slow Upload to IIS Server

I have a Windows 2012 R2 Server running on an Amazon EC2 instance with IIS 8.5. It hosts a web application, and a custom WebDAV server that interacts with the same database as the web application. I ...
1
vote
0answers
51 views

TCP and UDP ports usually blocked [closed]

Which are TCP and UDP ports most likely to be blocked? I refer especially to the client edge of the network. To start I guess SMTP (25), SIP (5060) for TCP, Traceroute (33434) for UDP.
-1
votes
1answer
172 views

Server sends ACK in response to SYN causing a reset in TCP request from the client

We are getting 7% reset messages for our TCP layer messages. We have two sets of logs. The first of Wireshark logs shows a good request and response Here the client was replied with sync ...
1
vote
1answer
138 views

tcp retransmit via curl and netcat

I'm trying to setup iptables to cause realistic network failures between docker containers. On the server, I run both netcat -lk 1234 and an Erlang cowboy server. On the client I run clients: echo ...
2
votes
2answers
325 views

lsof doesn't show the established TCP connection

On my system, if I run the netstat for a port, it returns: $ netstat -nat | grep "60964" tcp 0 0 192.0.0.1:60964 0.0.0.0:* LISTEN tcp 59 0 192.0.0....
19
votes
4answers
15k views

What is the “in-the-wire” size of a ethernet frame? 1518 or 1542?

According to the table here, it says that MTU = 1500 bytes and that the payload part is 1500 - 42 bytes or 1458 bytes (<- this is actually wrong!). Now on top of that you have to add IPv4 and UDP ...
1
vote
2answers
88 views

Run ncat in background

from some time I'm trying to resolve very annoying issue: I need to have simple server which will listen on particular TCP port and throw all information which it recieve to trash. I'm doing it by ...
1
vote
2answers
911 views

Big IP orphaned connections

Let me state up-front that I know just enough about networking at this level to be dangerous, so if I say something stupid, please be kind. I am using a Big IP load balancer in front of 3 Apache ...
0
votes
1answer
65 views

Why is Apache2 serving as an iperf server?

My Question: Does anybody know why an apache2 server can act as an iperf server? I thought that an apache2 server does only answer HTTP requests. My Situation: I accidentally realized that an apache2 ...
2
votes
1answer
3k views

Dropped ACK FIN, ACK RST, RST packets on webserver with iptables

I run a webserver (Apache) on a Debian 7 machine, with iptables on the same machine. iptables rules are generated by the ConfigServer Firewall (CSF) script. The websites hosted there are fine on my ...
0
votes
0answers
74 views

TCP connections drop off after initial build up

A bizarre problem on a production setup. Scenario 1) A server listens on a particular port. 2) There are potentially thousands of TCP connection requests. 3) About 200-300 TCP connections reach ...
7
votes
4answers
2k views

Why is my web server dropping connections with a TCP reset at high load?

I have a small VPS setup with nginx. I want to squeeze as much performance as possible out of it, so I've been experimenting with optimization and load testing. I'm using Blitz.io to do load testing ...
1
vote
0answers
49 views

Can iptables log all type of tcp connection?

Can iptables log tcp Split-Handshake and Simultaneous-Open connections as well as tcp Three Way Handshake? Here is these two kind of tcp connection descriptions. Here I find how to log new tcp ...
1
vote
0answers
161 views

Apache timeouts and TCP retransmission

The documentation for the timeout directive in apache states that: When writing data to the client, the length of time to wait for an acknowledgement of a packet if the send buffer is full. But ...
2
votes
2answers
9k views

What is msrpc needed for on a Windows 7 workstation

I just ran an nmap scan against our network, and many Windows 7 machines have several high ports listening with Microsoft Windows RPC. Example: Port Serv Process name 49152, msrpc [wininit.exe] ...
1
vote
0answers
28 views

Why might a connection stay in TIME_WAIT for hours or even days?

Our environment is ubuntu 12.04 on EC2. I know TIME_WAIT is a good thing, and I know generally it's OK to see connections remain in TIME_WAIT for up to 2 minutes according to all the reading I've ...
0
votes
1answer
108 views

On-the-fly decoding HTTP bodies on Linux?

My wish is to monitor HTTP exchanges between my server and a browser. At present time, I use the localhost because I'm developping the app. I installed and used tcpflow and found it quite useful but ...
0
votes
0answers
39 views

Logging Simultaneous Open Connection Establishment With Iptables

Simultaneous Open Connection Establishment: TCP is also set up to handle the situation where both devices perform an active OPEN instead of one doing a passive OPEN. This may occur if two clients are ...
0
votes
2answers
56 views

Can a poor client VPN connection corrupt a database?

We have a small office with one server and one client that connects to the server’s database for the Sage 300 accounting software. The server is also being used as a workstation for the Sage 300 ...
1
vote
1answer
133 views

Ubuntu 14.04 TCP established hash table entries

A bit of background I am running two servers under high traffic one with ubuntu 12.04 (linux 3.2.0-69-generic) and one with ubuntu 14.04 (linux 3.13.0-52-generic). I am now trying to secure both. ...
0
votes
0answers
14 views

(Windows Media Encoder) TCP connection randomly fails/succeeds

We have a windows media server running and are pushing a stream using Windows Media Encoder 9 software on the client. Sometimes, it can't connect to the server and sometimes it can. I ran wireshark ...
0
votes
5answers
14k views

netstat shows many times deploy.akamaitechnologies.com connected to my server

Many times, after running netstat on my server, I find one of IP addresses belonging to deploy.akamaitechnologies.com connected to my server, do someone has an idea on what is happening on my server ? ...
1
vote
0answers
47 views

TCP Syn cookies is it always turned on when enabled?

For Linux kernel 2.6.32 if I set net.ipv4.tcp_syncookies = 1 will that be always used or only during a SYN flood attack? I found 2 sources which says the opposite. 1: "There are, however, two ...
0
votes
3answers
311 views

Strange limit of 65536 max tcp incoming connections

I have a Linux server with an Erlang application which shows an odd limit of exactly 65536 max tcp incoming connections. The Erlang application is written with the Cowboy framework. I have tuned the ...
0
votes
1answer
2k views

why 5 rx queues per NIC

On my office server, the output of cat /proc/interrupts displays one tx queue and 5 rx queues. Is this due to NIC hardware capabilities or can you configure multiple receive ring buffers in linux per ...
8
votes
2answers
3k views

Finding short-lived TCP connections owner process

Running tcpdump on local connections to an apache server, I found TCP connections being established and closed immediately every 2 seconds. How do I find which process is responsible for these? ...
-3
votes
1answer
70 views

Stopping exploits based on Reversing TCP [closed]

One of the most common exploits on msf, reverse tcp by buffer overflow i guess is my concern. Can i, by any means stop of manage my tcp ports to deny giving access to rhosts and become safe from this ...
0
votes
1answer
259 views

tcp_tw_reuse and tcp_tw_recycle not working in specific environment

We are running HAProxy to direct mysql traffic from PHP to a set of mysql servers. However, due to an issue with the way the mysql-client sends TCP packets, we get a ton of connections in TIME_WAIT ...
7
votes
1answer
1k views

Will tcpdump see packets that are being dropped by iptables?

I have a firewall with these simple rules: iptables -A INPUT -p tcp -s 127.0.0.1/32 --dport 6000 -j ACCEPT iptables -A INPUT -p tcp -s 192.168.16.20/32 --dport 6000 -j ACCEPT iptables -A INPUT -p tcp ...
0
votes
5answers
9k views

Cannot work out what is using port 8080

In Windows Server 2003 R2 64 Bit SP2 I have an app which will only use port 8080 but something is already using it. I would be happy to just kill whatever is using it but I can't work out what it is. ...
0
votes
0answers
120 views

TCP Established connection spike in AWS

We are using AWS ELB in HTTP mode and are observing a spike in TCP established connection on Tomcat server. We have Apache HTTP server with mod_proxy between ELB and Tomcat. Apache and Tomcat run on ...
0
votes
0answers
111 views

Network speed between Windows 7 machines sharing over samba/SMB not reaching 10Gb/s

I have two Windows 7 Machines that are connected via 10Gb/s Intel Server Cards on a 10Gb/s Switch an a subnetwork(Physically separate from the larger main domain network). I'm trying to copy files ...
-1
votes
1answer
140 views

random server timeout connections

I am searching for a solution for this issue for 2 days now. I have a centos server, and I get random timeout connections error, about 10-20% of the times. yesterday it happened to one of my users, ...
3
votes
1answer
277 views

Can I use HAProxy to load balance telnet connections?

We use HAProxy as load balancer for regular HTTP requests. I see no reference to telnet connections in the HAProxy configuration guide: HAProxy config guide. I was hoping to reuse HAProxy (or spin up ...
0
votes
0answers
115 views

TCP Out-of-order packets over GRE causing disconnect

I'm experiencing an issue with a small percentage of TCP connections over a GRE tunnel between two servers. The topology is basically Internet <-> GRE Tunnel <-> Backend The GRE tunnel and the ...
1
vote
0answers
90 views

Wireshark RST against TCP Zero Window

During application sharing with Microsoft Lync Client (Mac OS X), TCP ACK with RST flag is sent from my application end to Lync end against TCP Zero Window packets and call gets dropped. Image Link. ...
0
votes
2answers
56 views

SMB / CIFS / Samba Connectionless or Not whilst transfering files?

I have been researching this for a bit, but I have been getting conflicting answers, does samba, from my gatherings, SMB runs on ports TCP & UDP 137-139 & 445. But I have no idea therefore ...
0
votes
1answer
165 views

slapd running fine and listening on port 389, but still can't contact

Here is my ldapsearch command with debug (I've masked my real IP address): $ sudo /usr/local/bin/ldapsearch -H ldap://99.99.99.99 -b dc=my-domain,dc=com -x -d -1 ldap_url_parse_ext(ldap://99.99.99.99)...
0
votes
2answers
149 views

how to get parameters of Linux module when it is compiled NOT as a module

when a part of Linux Kernel is compiled as a module on could read available parameters with modinfo and set them when loading with modprobe. Is it possible to get the values of paramters of ...
0
votes
0answers
28 views

Is there an option that influences the RTO time in TCP?

I'm just trying to understand how retransmission feature works in the case of TCP on my linux box, but on the internet you can find really different information most of which is outdated or wrong, so ...
9
votes
3answers
3k views

Lower TCP throughput from 1Gbps server than 100Mbps server over large RTT

We've got infrastructure distributed in a few major locations around the world - Singapore, London and Los Angeles. The RTT between any two locations is over >150ms. We've recently upgraded all of ...
1
vote
2answers
51 views

What is the cause for TCP flow control misinterpretation?

The client cannot connect to our web server. I sniffed the client and web server only to found out that the client sees the TCP connection to be successful while the server see it as a failure. What ...
0
votes
0answers
354 views

Sometimes unable to tune Linux TCP stack for improved high-latency performance

I have been unsuccessfully trying to apply the TCP Tuning techniques discussed at http://fasterdata.es.net/host-tuning/ As you'll see when you read through the entire question, sometimes the es.net ...
0
votes
3answers
1k views

What port does OpenLink ODBC Driver use?

I use Avaya Reporting Services and OpenLink ODBC Drivers for db connection. I know that it uses port 5000 for handshaking but after that I believe it uses an random port for communication. I want to ...
1
vote
0answers
31 views

CentOS appliance becomes unresponsive with lot of outgoing http connections [closed]

I have an ESXi VM running CentOS-7. My application is deployed inside a tomcat instance running on this server. The application periodically makes 1200 "outgoing" http connections every 15secs. I am ...
-5
votes
1answer
43 views

Why is the same socket in TIME_WAIT many times?

I have read other threads regarding sockets in TIME_WAIT, but I am clearly still missing something. Below is a few lines from a "netstat -an". How could it get into this situation? If I understood ...
3
votes
3answers
1k views

Linux: Invalid TCP Flags

It is often recommended in tutorials and books to filter invalid TCP flags with iptables. I wonder if those aren't already filtered by the kernel itself or the iptables state module. Does anyone have ...
3
votes
1answer
86 views

notify when a TCP port start listening

I need to be notified exactly when an application start LISTENING on any/specified TCP port. is there anything like configuring an application to log this event using a library in any programming ...