New answers tagged

0

Unfortunately routers will do their best to connect the endpoints. That being said, a router doesn't care if there's someone listening or not. They will just do NAT-PAT from the WAN to your LAN. Now on the other hand, there's tolerances to a lower layer to "retry" connection. Say you want your webserver to be redirected if your main server is down... then ...


0

I finally found the cause of the problem. I had some flask webapp, which uses redis to stream events to the user. When the user disconnected, the app kept the redis pubsub connection alive, without reading data anymore. This leads to a long Send-Q/Recv-Q, which apparently cause the tcp stack to slow down and produce kernel warnings: "TCP: out of memory -- ...


0

yes, wireshark both sides, tcpdump, network traces taken at the switch level (rather high-end Arista 10G switches), traces taken on the firewall (Fortinet), etc. etc. The problem is not why the client is not receiving the reply. This is a busy network with bursty traffic, so losing one packet in 10,000 is not unexpected. But I need to provide an SLA even ...


3

No iptables rule will ever close an existing TCP connection as that involves actively transmitting a message with the FIN bit. That is done by the application and not by a packet filter. On the other hand iptables can, at any moment, block your application from receiving or transmitting new packets over any existing connection and it can also deny any new ...


3

is UDP more like a broadcast protocol and therefor my pc is only listening to that port for incoming information? Not likely. UDP can be used that way, but it doesn't work very well over the Internet. if not, is there a way to identify the ip addresses to which those UDP ports are connected to? UDP ports aren't connected to anything. UDP is ...


1

Dropping the [RST,ACK] and [FIN,ACK] will not work. There are many application like ftp upload that will simply fail to ack the completion of the FTP transfer. The comments by gscott are the correct method, but one additional requirement is needed. You must make them strict by applying the policy iptables -P OUTPUT DROP iptables -P FORWARD DROP iptables -...


0

AFAIK, syslog-ng will automatically close the connections after a period of inactivity, unless the so_keepalive() option is enabled in the source (the server) or the destination (the client). If you still see activity in the connections, try to set the mark_freq() option to 0.


0

That message would indicate that your TCP SYN queue is overflowing during the reload - does the reload take a while to complete? I notice that you have set net.core.netdev_max_backlog, net.ipv4.tcp_max_syn_backlog and net.core.somaxconn to high values which is good. You will also need to ensure that you have told your nginx server to use a large SYN backlog ...


3

Having read all the analysis in the answers, this problem very much sounds like you might be running Windows7/2008R2 aka Windows 6.1 The networking stack (TCP/IP & Winsock) in Windows 6.1 was horribly flawed and had a whole host of bugs and performance problems which Microsoft eventually addressed over many years of hotfixing since the initial release ...


0

CONNECT is only used by HTTP clients to an HTTP proxy to establish a tunnel through the proxy. There's no scheme in HTTP for an encrypted connection to an HTTP proxy either. I suspect an HTTP proxy is not what you're looking for here. I don't know if Squid supports TCP plugs with TLS and client certificates but WinGate does. Disclaimer: I work for Qbik ...


4

Maybe your admin dislikes NGINX Plusbecause it isn't open source and would accept another well maintained open source product. Then ask him to look at stunnel. It is designed for exactly your needs. Quoting an stunnel example at wikipedia (for SMTP, but this would fit alos for your needs): For example, one could use stunnel to provide a secure SSL ...


0

You cannot craft packets in user space outside of the native TCP/IP stack and expect the Kernel to accept unsolicited SYN/ACK packets in response. The Kernel is right to RST the packets as per RFC standard. I'm doubtful that hping3 will be able to achieve what you are looking for. If you are comfortable with Python, you can look into Scapy which will allow ...



Top 50 recent answers are included