TCP stands for Transmission Control Protocol and is one of the core protocols of the Internet Protocol Suite. TCP complements the Internet Protocol (IP), and therefore the entire suite is commonly referred to as TCP/IP.

learn more… | top users | synonyms

55
votes
6answers
66k views

How to forcibly close a socket in TIME_WAIT?

I run a particular program on linux which sometimes crashes. If you open it quickly after that, it listens on socket 49201 instead of 49200 as it did the first time. netstat reveals that 49200 is in ...
31
votes
11answers
22k views

What is the difference between UDP and TCP?

My router has two protocols (and a "both" option) that I can select when setting up port forwarding: UDP and TCP. What is the difference between these two protocols and when would you select one over ...
30
votes
3answers
605 views

Windows TCP Window Scaling Hitting plateau too early

Scenario: We have a number of Windows clients regularly uploading large files (FTP/SVN/HTTP PUT/SCP) to Linux servers that are ~100-160ms away. We have 1Gbit/s synchronous bandwidth at the office and ...
29
votes
3answers
4k views

Tuning iSCSI storage

This is a Canonical Question about iSCSI we can use as a reference. iSCSI is a protocol that puts SCSI commands as payload into TCP network packets. As such, it is subject to a different set of ...
28
votes
8answers
231k views

What does “TTL expired in transit” mean on a ping attempt?

We get the message “TTL expired in transit” when we try to ping to a server in a different network segment. When we run tracert, 4 ip addresses repeat themselves indefinitely: 14 60 ms 59 ms ...
23
votes
5answers
2k views

Can TCP and UDP packets be split into pieces?

Can TCP packets arrive to receiver by pieces? For example, if I send 20 bytes using TCP protocol, can I be 100% sure that I will receive exactly 20 bytes at once, not 10 bytes then another 10 bytes ...
22
votes
5answers
20k views

How passively monitor for tcp packet loss? (Linux)

How can I passively monitor the packet loss on TCP connections to/from my machine? Basically, I'd like a tool that sits in the background and watches TCP ack/nak/re-transmits to generate a report on ...
21
votes
5answers
26k views

What is the best way to transfer a single large file over a high-speed, high-latency WAN link?

This looks related to this one, but it's somewhat different. There is this WAN link between two company sites, and we need to transfer a single very large file (Oracle dump, ~160 GB). We've got full ...
19
votes
4answers
2k views

Slow Transfers over Distance

From our NY Datacenter, transfers to locations that are farther away are having poor performance. Using speed test to test various locations, we can saturate our 100 mbit uplink to Boston and ...
17
votes
2answers
6k views

What is the “in-the-wire” size of a ethernet frame? 1518 or 1542?

According to the table here, it says that MTU = 1500 bytes and that the payload part is 1500 - 42 bytes or 1458 bytes (<- this is actually wrong!). Now on top of that you have to add IPv4 and UDP ...
17
votes
6answers
13k views

Why would a server not send a SYN/ACK packet in response to a SYN packet

Lately, we've become aware of a TCP connection issue that is mostly limited to mac and Linux users who browse our websites. From the user perspective, it presents itself as a really long connection ...
16
votes
3answers
1k views

Troubleshooting Network Speeds — The Age Old Inquiry

I'm looking for help with what I'm sure is an age old question. I've found myself in a situation of yearning to understand network throughput more clearly, but I can't seem to find information that ...
14
votes
4answers
21k views

Does HTTPS use TCP or UDP?

Does HTTPS use TCP or UDP?
14
votes
3answers
54k views

“Possible SYN flooding” in log despite low number of SYN_RECV connections

Recently we had an apache server which was responding very slowly due to SYN flooding. The workaround for this was to enable tcp_syncookies (net.ipv4.tcp_syncookies=1 in /etc/sysctl.conf). I posted a ...
14
votes
2answers
733 views

Is my TCP connections sabotaged by my country's government?

I am suspicious that my country's government is destroying the received ACK packet on TCP connections, somehow. When I try to establish a TCP connection to an outside host on ports other than 80 the ...
13
votes
5answers
6k views

Understanding Ports: How do multiple browser tabs communicate at the same time? [closed]

I realized today that I fundamentally don't understand how port communication works. If I fire up an instance of a webserver listening on port 80, it can respond to many requests from many different ...
13
votes
4answers
3k views

What is the “slash” after the IP?

In Amazon EC2, where I set "security groups", It says: Source: 0.0.0.0/0 And then it gives an example of: 192.168.2.0/24 What is "/24"? I know what port and IP is.
13
votes
7answers
14k views

traceroute TCP equivalent for Windows [closed]

I'm trying to determine where connectivity to an external host using a specific TCP port is being blocked. Traceroute for Windows only uses ICMP, and telnet will only tell me that the port is blocked ...
13
votes
1answer
2k views

What am I misunderstanding about calculating MTU?

Okay, I just finished resolving a jumbo frames issue between a few Xserves, a Netgear GSM7224, and a Drobo B800i. It turned out that the Xserves (Mac OS X 10.6.8 Server) and the Drobo B800i accept the ...
12
votes
3answers
7k views

What's the difference between Unix socket and TCP/IP socket?

It's from this answer: http://stackoverflow.com/questions/2482411/is-this-pdo-bug-fixed-now/2482424#2482424
12
votes
5answers
5k views

I'm designing a system to handle 10000 TCP connections per second, what problems will I run into?

I have a relatively new 8-core box running CentOS. I would like to develop a stats server that uses TCP. It's very simple, it accepts a TCP connection, increments a counter and closes the connection. ...
12
votes
2answers
33k views

Which is the default TCP connect timeout in Windows?

Which is the default TCP connect timeout in Windows? There is a registry key to configure it or it's set dynamically?
11
votes
7answers
11k views

Apache Tomcat chokes after 300 connections

We have an apache webserver in front of Tomcat hosted on EC2, instance type is extra large with 34GB memory. Our application deals with lot of external webservices and we have a very lousy external ...
11
votes
6answers
20k views

Finding cause of TCP retransmission within a LAN

Hello denizens of Server Fault I have an irritating problem with a LAN of about 100 computers, 2 Windows domain servers, and 12 VoIP phones. Since their installation around a year ago, every week or ...
10
votes
6answers
19k views

How to capture ack or syn packets by Tcpdump?

I want to know the filter rule , thanks!
10
votes
9answers
24k views

ping alternative for tcp?

It's a common task to check network 'quality' - latency, number of dropped packets etc. But 'ping' has a number of drawbacks: - It uses ICMP. Many ISP has different shapers for ICMP and TCP traffic, ...
10
votes
3answers
2k views

Is it possible for a TCP connection to remain open when the client has disconnected?

We have a server application which is facing TCP exhaustion problems at around 4000 connections. This will occur every 3 or 4 weeks (approximately). The vendor, which has created this server ...
10
votes
2answers
245 views

How long are fragmented TCP fragments kept in the TCP server

Suppose that a given TCP fragment is fragmented into two IP datagrams, and that the first datagram arrives to the TCP server, but the second datagram never arrives. After a certain amount of time the ...
10
votes
3answers
8k views

Sockets found by lsof but not by netstat

I have an application which is running out of file descriptors, apparently by opening sockets, but I can't find out exactly what these sockets do. These appear in the lsof output as java 9689 ...
10
votes
3answers
24k views

What does LAST_ACK mean, as a State value in netstat?

If a Windows server has several thousand ports open in LAST_ACK state (as shown by netstat), what could this mean? Is it because one endpoint is waiting for the other to respond?
10
votes
1answer
535 views

TCP congestion control for low-latency 10GbE -> 1GbE network?

I have a server with a 10GbE connection to a switch, and 10 clients each with a 1GbE connection to the same switch. Running nuttcp in parallel on each of the clients, I can push 10 TCP streams of ...
9
votes
11answers
19k views

How to discover the mac address of machines in a network?

How to discover the mac address of machines in a network? I need to discover the machines that are available just with only BIOS installed (NO Operating System) And I need to find the mac address of ...
9
votes
4answers
50k views

What causes duplicate ACK records?

We're reviewing Wireshark captures from a few client machines that are showing multiple duplicate ACK records which then triggers retransmit and out-of-sequence packets. These are shown in the ...
9
votes
2answers
2k views

Linux Slow Start: Changing ip route does not have any effect on initial window

I changed the tcp initial window in my machine to 10 as shown below [user@site etc]$ sudo ip route change default via 17.255.209.1 dev eth0 proto static initcwnd 10 And changed ...
9
votes
2answers
1k views

How to find process which uses most bandwidth

How can I find the process which uses most bandwidth on a Linux PC? With iftop it's possible to find which connections produce most bandwidth, but how to find the process?
9
votes
2answers
10k views

Many dropped packets of my NIC

I have a server running on CentOS 5.3 (a comet chat server, will have lots of tcp connections). Recently I found it was very slow (http service and ssh) so I use "ifconfig" command to figured out what ...
9
votes
1answer
231 views

Where can I embed proprietary information in a layer 2 or layer 3 packet?

The Citrix Netscaler has an interesting property that embeds information in the TCP packet that gets sent to the host. This property is echoed back to the Netscaler in such a way that the Netscaler ...
9
votes
3answers
1k views

Lower TCP throughput from 1Gbps server than 100Mbps server over large RTT

We've got infrastructure distributed in a few major locations around the world - Singapore, London and Los Angeles. The RTT between any two locations is over >150ms. We've recently upgraded all of ...
8
votes
5answers
578 views

dump tcp connections without tcpdump

On a centos box, I like to dump tcp connections - I would like to see if a server tries to send requests to a certain IP. Usually tcpdump would do the trick - but tcpdump is not installed, and ...
8
votes
5answers
1k views

In TCP/IP terms, how does a download speed limiter in an office work?

Assume an office of people, they want to limit HTTP downloads to a max of 40% bandwidth of their internet connection speed so that it doesn't block other traffic. We say "it's not supported in your ...
8
votes
4answers
5k views

haproxy + stunnel + keep-alive?

I'd like to put stunnel in front of haproxy 1.4 to handle HTTPS traffic. I also need stunnel to add the X-Forwarded-For header. This can be achieved by the "stunnel-4.xx-xforwarded-for.diff" patches ...
8
votes
4answers
21k views

How do I make cURL use keepalive from the command line?

I'm trying to verify that HTTP persistent connections are being used during communication with a Tomcat webserver I've got running. Currently, I can retrieve a resource on my server from a browser ...
8
votes
2answers
6k views

How can I tune the initial TCP retransmit timeout?

The initial TCP RTO value of 3s is too long for most LAN-based applications. How can I tune it lower? Is there a sysctl?
8
votes
1answer
26k views

What does “net_ratelimit: 44 callbacks suppressed” mean on a linux based router?

I'm trying to tune Snort performance on a Debian based router. I was seeing stuff like: snort packet recv contents failure: No buffer space available So I upped the buffers to 8M and when that ...
8
votes
3answers
2k views

Can I make TCP/IP session to run less than 60 seconds?

Our server is overloaded with TCP/IP sessions, we have 1200 - 1500 of them. Most of them are hanging in TIME_OUT state. It turns out that a connection in TIME_OUT state occupies a socket until 60 ...
7
votes
5answers
755 views

Convey multicast (to another LAN) through WAN disabling multicast

My Server and Client softwares run both on Linux. The Server broadcasts multicast, the Client listens multicast. My Client has to migrate to another site, and unfortunately multicast is not allowed ...
7
votes
2answers
2k views

tcp flags in iptables: What's the difference between RST SYN and RST and SYN RST ? When to use ALL?

I'm working on a firewall for a virtual dedicated server and one of the things I'm looking into is port scanners. TCP flags are used for protection. I have 2 questions. The rule: -p tcp ...
7
votes
2answers
673 views

Why are people trying to connect to my network on TCP port 445?

I was playing with my new syslog server and had my m0n0wall firewall logs forwarded as a test, I noticed a bunch of recent firewall log entries that say that it blocked other WAN IPs from my ISP (I ...
7
votes
2answers
2k views

How can I take advantage of IW10 in kernel 2.6.33?

I've read that 2.6.33+ allows setting custom cwnd. if the IW is 10 by default (for all distros? only some?) how does one view what the current IW is on a particular compiled kernel? references: ...
7
votes
1answer
791 views

What is theoretical maximum of TCP traffic over GigaEthernet?

What is theoretical maximum of TCP traffic over GigaEthernet ?