TCP stands for Transmission Control Protocol and is one of the core protocols of the Internet Protocol Suite. TCP complements the Internet Protocol (IP), and therefore the entire suite is commonly referred to as TCP/IP.

learn more… | top users | synonyms

1
vote
5answers
182 views

Get number of TCP established connections

On a Linux server one can use netstat -tan | grep ESTABLISHED| wc -l but this will not work on a high load server with watch -n1. Such approach works fine if the server is not very busy or the ...
11
votes
13answers
23k views

How to discover the MAC address of machines in a network?

How do I discover the MAC address of machines in a network? I need to discover the machines that are available just with only BIOS installed (no operating system). And I need to find the MAC address ...
0
votes
1answer
117 views

TCP Load balancing

I need to implement an architecture that can serve 3 million GPS Devices sending Location Updates/Alerts (every 10 secs) to our system for processing. Features: 1) TCP communication. 1) Long lived ...
5
votes
2answers
3k views

Netstat -s showing (and growing) “packets pruned from receive queue” and “packets collapsed in receive queue”

we are seeing the following: [root@primary data]# netstat -s | grep buffer ; sleep 10 ; netstat -s | grep buffer 20560 packets pruned from receive queue because of socket buffer overrun ...
0
votes
1answer
78 views

How does an IP address goes down from an Application Layer to IP Layer? [closed]

Using the classical TCP/IP layers model, I am thinking about an application (for example a browser) acting as a client wanting to talk with a server (e.g. a web server). Of course it has to use the ...
2
votes
1answer
166 views

TCP piggybacking introduced by a man-in-the-middle network node beween the client and server?

When wireshark trace taken on the client side it appears to be: ---SYN---> <-SYN-ACK- ---ACK---> -HTTPGET-> But when wireshark trace taken for the same traffic on the server side it ...
7
votes
2answers
978 views

Varnish running out of open ports, lots of SYN_SENT connections

Recently we've been experiencing issues with our Varnish (3x) -> Apache (3x) setup, resulting in a huge spike in SYN_SENT connections. The spike itself is due to the amount of new traffic hitting the ...
3
votes
0answers
169 views

TCP Window Scaling Problem over MPLS

After extensive troubleshooting why the TCP speed over an MPLS circuit is slow in one direction, I figured out that by adjusting the TCP window size the situation improved a lot. Maybe you can tell me ...
1
vote
2answers
600 views

Proxying TCP by hostname

I've got multiple game servers TCP ports on my single host machine. The goal is to have users be able to connect to server1.domain.net and have their directed based on that subdomain. My first ...
0
votes
0answers
101 views

TCP ignores some packets for no reason

I have a weird problem which I can't understand. The actual network configuration is quite complex, because I am using Openstack and Docker to build a virtual network. However, the problem is not ...
32
votes
1answer
1k views

Random TCP RST's on certain websites, what's going on?

Short version: One Windows Server 2012 machine on my network is getting persistent but intermittent TCP RSTs when connecting to certain websites. Dunno where they're coming from. Check out the ...
-1
votes
2answers
107 views

TCP/UDP Small Package Size optimization [closed]

I currently have the problem, that when a LOT of RTP streams (>800) go to one server the max. speed is onlynabout 70-80 Mbit (on a Gigabit LAN - all Hardware components are Gigabit components) 130 ...
0
votes
0answers
44 views

Windows Server 2008 consuming a lot of bandwidth

My Windows Server 2008 has been consuming A LOT of bandwidth in the last days (990 GB). This is a development server so it should not consume more than 100mb aprox. We noticed this after the server ...
1
vote
2answers
58 views

Can't block spammy IP

I'm being attacked by 37.59.4.76. It's sending me a great amount of data, which is destroying my dataplan. I've added the iptables Chain num pkts bytes target prot opt in out ...
2
votes
1answer
271 views

Relationship between tcp state TIME_WAIT & HTTP keep-alive

What is the relationship between keep-alive on a HTTP request and a tcp socket in TIME_WAIT - should they be correlated? Furthermore, should system and web server settings be aligned e.g. ...
0
votes
0answers
46 views

Source ip based Anycast-BGP?

I'm just getting interested in networking so don't be too harsh on me :) Ideal: 2 servers with shared ip; ip X Client 1 pings ip X > always server A Client 2 pings ip X > always server B ...
-1
votes
1answer
53 views

Geo distributed ip [duplicate]

When i ping 8.8.8.8 from my home computer (europe) i get around 26 ms latency. When i ping 8.8.8.8 from a server(US) i get around 1 ms latency. When i ping my (US) server from home (europe) i have 130 ...
0
votes
1answer
322 views

How to trace dropped TCP connections?

Trying to help someone with a situation where TCP connections get mysteriously dropped after a few minutes for no apparent reason (this happens even with non idle connections). Both client and server ...
0
votes
0answers
220 views

HAProxy RTMP (TCP) load balancing

I am using HAProxy as load balancer for the RTMP protocol. For now it's working very very good but I have one small problem. I want to send the client's IP on the RTMP request after the load balancer. ...
0
votes
0answers
54 views

apache bench handshake failure server sending TCP FIN

I am trying to verify handshake performance by sending number of requests with out setting concurrency with below command. ab -k -n 18750 -c 1 -Z AES128-SHA -f TLS1.3 ...
0
votes
4answers
1k views

Cannot work out what is using port 8080

In Windows Server 2003 R2 64 Bit SP2 I have an app which will only use port 8080 but something is already using it. I would be happy to just kill whatever is using it but I can't work out what it is. ...
4
votes
2answers
6k views

Reduce firewall rules by half - one iptables rule for tcp and udp

I have a number of iptables rules on my firewall that look like this: iptables -A zone_lan_forward -p tcp -d 1.2.3.0/24 -j ACCEPT iptables -A zone_lan_forward -p udp -d 1.2.3.0/24 -j ACCEPT Is ...
0
votes
1answer
229 views

Existing TCP Relay Solutions [closed]

I have a scenario which requires the use of a TCP Relay. Before I set out to write something custom, I wanted to see if anyone knows of existing software that can do this for me. I have 2 devices on ...
-2
votes
1answer
48 views

TCP ports duplication [closed]

I need to communicate server1 to server2. Server1 should have to fetch some records from Server2 when we execute program.exe will make server1 to fetch server2 When I gave netstat -an | find ...
0
votes
2answers
619 views

Wireshark “length” column - what does it include?

Can anyone tell me what the "Length" column in WireShark refers to? I'm pretty sure it's the "size" of the entire frame on the wire. I did some calculations, but I didn't get the number that ...
0
votes
0answers
65 views

Cannot connect to TCP service from remote host

I have two servers running RHEL 5.8. SRV1 (10.58.192.36) has a service running on port 9002 and I need to connect to this service from SRV2 (10.58.192.42). [root@SRV1 ~]# netstat -anp | grep 9002 tcp ...
14
votes
1answer
597 views

Under what circumstances is TCP-over-TCP performing significantly worse than TCP alone (2014)?

Many admins keep perpetuating - on ServerFault and elsewhere - how bad of an idea TCP-over-TCP is, e.g. in VPNs. That even the slightest packet loss will make one suffer from at least severe ...
3
votes
1answer
9k views

Root cause of “curl: (56) SSL read: errno -5961” errors

I was evaluating some SSL failures, and noticed that when I use curl to one of the failing sites, I got curl: (56) SSL read: errno -5961; however, my google queries for that error didn't show the ...
2
votes
2answers
3k views

Difference between tcp recv buffer and tcp receive window size?

The command shows the tcp receive buffer size in bytes. $ cat /proc/sys/net/ipv4/tcp_rmem 4096 87380 4001344 where the three values signifies the min, default and max values respectively. ...
0
votes
0answers
162 views

TCP [RST,ACK] ignored

I have a Windows 2008 server and an application that connects over Internet to it. From time to time I see that I receive a TCP [RST, ACK] that is ignored by my application. Using TCPViewer I still ...
2
votes
1answer
194 views

iptables: match only the first packet of established TCP-connection

In my Apache-logfiles I find a lot of entries that contain "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 or similar crap. They come from non-RFC2616-connections (HTTP/1.1 without hostname). I ...
3
votes
3answers
2k views

OpenBSD has open ports in default installation

I have been considering replacing Ubuntu with OpenBSD to improve the security on my local server. I need to have ssh access to it, and I also need it to serve static web content - so the only ports I ...
0
votes
1answer
84 views

High number of TCP RST packets

Whilst looking into some transient network issues, I have noticed what seems to be a high number of RST packets received: Tcp: 40091950 active connections openings 44754733 passive connection ...
0
votes
0answers
105 views

Networking issue in IBM x3650 after install Ubuntu 14.04

I have a problem making TCP connections after a fresh Ubuntu 14.04 installation. First of all, after booting the interface is always off. In my case the interface is manually configured and named em2. ...
2
votes
2answers
2k views

Why do I see an IP packet with size 2960, way above the MTU setting of 1500 on the interface and it gets through?

I am analyzing traffic between a client and a Linux webserver running on a HP blade server, the client sometimes gets stuck waiting for more data when the webserver has closed the connection. The ...
0
votes
0answers
43 views

Duplicated TCP SYN Messages: second one is ACKed, but the connection is finally FINed

While wring a TCP server program, I found a very interesting symptoms. clients sends a first SYN packet. (server does not show any reactions.) clients sends another SYN packet after one second. ...
0
votes
1answer
777 views

Memory Pressure Protection Feature for TCP Stack - Provided by Microsoft Security Update KB967723

We've been having a lot of funky issues with some of our web based applications that allow clients to submit lot of image files to our servers. Lots of ports are used in the process. ...
-1
votes
1answer
37 views

Application protocol-based port forwarding/redirection [closed]

I need to split traffic on port 80 between HTTP and non-HTTP, and internally forward HTTP traffic to a port nginx will listen to, and non-HTTP traffic to port 22. Does anyone know of a piece of ...
1
vote
2answers
687 views

Send Text String to a Socket In Windows

I have a server that has an open socket that listens for a particular text string on it in order to perform an action. Our linux machines send this data via: echo "text_string" | nc -w 2 ...
5
votes
1answer
5k views

Forwarding linux terminal from serial port to TCP with socat

I'm working on embedded ARM platform, Slackware. I'm using G24 Java modem which is configured to forward data between ports /dev/ttyS1 and /dev/ttyACM0, so anything that goes onto any of these ports ...
1
vote
0answers
42 views

Why do some outgoing IP traffic not contain UID information?

I am doing egress logging on my server using IPTABLES with the following line which is supposed to provide UID information on all traffic that is logged: -A OUTPUT -j LOG --log-prefix "IPTABLES(O): " ...
0
votes
2answers
181 views

tcp ack delay almost 600ms, is this all right?

As far as I konw, tcp delay ack always 200ms, but now in my production environment it delay almost 600ms, my environment is below: ubuntu 11.04 48G memory 16 core, load not heavy; I catch packet in ...
1
vote
0answers
99 views

TCP Window Size Allocation, TCP Window Zero Errors and Network Latency

My mind is about to explode as everyone is always blaming the network guys for disconnections and slowness in the networks, but Solarwinds Reports that all utilization in the network devices and links ...
2
votes
2answers
3k views

What does TCP: too many orphaned sockets mean?

When I use dmesg to look at linux kernel messages, I see a flood of.... TCP: too many orphaned sockets messages. My guess is this is sockets that are hanging around in TIME_WAIT after being closed ...
0
votes
0answers
255 views

Connection Timeout Issues - Solaris 11 SPARC

We're currently running some performance tests using Solaris 11 (SPARC) on some large hardware. The tests, which consist of sending SOAP requests (50kb per request), are running well up until we get ...
2
votes
2answers
440 views

Server 2012: SYN, no ACKs, on TCP ports higher than 6000

Seems ridiculous to read it back out loud, but I'm at a loss here. Server 2012 Standard. Runs a daemon for an accounting package on TCP 12502; at some point, the server stopped accepting connections ...
3
votes
2answers
2k views

TCP under OpenVPN is very slow (tsg attached)

I have a very weird problem with OpenVPN. Most VPNs work fine, except this one. Here I get very low performance from TCP connections, but the CPU load is low (so, not a CPU issue). OpenVPN is ...
0
votes
0answers
64 views

Single TCP-CLOSE_WAIT connection brings down application till restart

Recently found a behaviour where my application had a connection in TCP Close_wait state till the app was restarted (after about 5 hours). But during this period the SUnreclaim space was also ...
6
votes
1answer
5k views

How do I prevent TCP connection freezes over an OpenVPN network?

New details added at the end of this question; it's possible that I'm zeroing in on the cause. I have a UDP OpenVPN-based VPN set up in tap mode (I need tap because I need the VPN to pass multicast ...
0
votes
1answer
55 views

cannot send emails to other Web servers

I'm trying to limit my server's open ports in CSF. The IPv4 port settings include: # Allow incoming TCP ports TCP_IN = "22,25,53,80,110,143,443,587,3654,53343” # Allow outgoing TCP ports TCP_OUT = ...