Tag Info

New answers tagged

0

First: Check your Max open files limit on the process. An active socket connection counts as an open file. cat /proc/###/limits is a good way to check the effective value for another process. You can get a list of open files with lsof -p ### where ### is your web server's process id. You can compare lsof -p ### | wc -l to see how close you are getting to the ...


1

Yes, there is. Using a tap device causes context switches between the client process and the process that holds the tap device. It also causes additional copies, as data needs to be copied from the client process into the kernel, and then from the kernel into the tap holder. However, Linux is pretty good at context switching, and in-cache copies are ...


0

If the root of your issue is the fact that the backend servers expect traffic to be HTTPS rather than HTTP, try encrypting the HTTP and do your regular Layer7 load balancing. listen https_handler bind 1.2.3.4:443 ssl crt /etc/ssl/certs/certs.pem mode http balance leastconn # any stick rules you need server s1 1.1.1.1:443 ssl server ...


1

I'm posting this as an answer due to insufficient commenting permissions. From my experience VPN over tcp - tap was abysmal at best over wireless connections due to the the nature of TCP. When switching to UDP no more connection timeouts occurred - even better with tun device. I would suggest you test under poor network connections both TCP and UDP and ...


1

The easiest solution is to use balance source, but if many clients come from the same IP, it may not be very fair on your backend servers. See http://blog.haproxy.com/2013/04/22/client-ip-persistence-or-source-ip-hash-load-balancing/ for more discussion on methods to accomplish this.


1

So, my question is - how do I put http://www.baidu.com instead of / (SLASH) in GET request? The request you want to have is not a bad one, but just a proxy request. To create it just specify your target host as a proxy. Apart from that curl might be not the right tool to generate real bad requests.


0

The code which captures these statistics is called in the various related TCP/UDP/IP codepaths and increments SNMP MIBs. There is no information stored about interface or any connection properties like port or IP, it's only a basic counter of the times that codepath has been entered. netstat -s just reads those counters.


1

Netstat -s is a more intuitive display of /proc/net/netstat. Counters in it are global and not per interface. To get that kind of information you will need to use/write a monitoring tool using libpcap.


2

There are two methods that can be used to handle ARP traffic when NAT is not used. The traffic can be bridged, and the VM will receive and respond to the ARP request on it own. The traffic can be routed, and the VM's host responds with a ProxyARP response. It is also common to us NAT for a VM. In this case the source address (and possibly port) are ...


3

If you're looking for the short answer, it (the router/firewall) already knows all it needs to for the TCP "response" from the session table and routing table. A generic example would look like: If it needs to, the router can run an ARP request same as it would anytime it needs to do a MAC address lookup. But it would typically be for local devices, ...


12

ARP Connection oriented or connectionless? Connectionless - it's just a request and a response (or a broadcast just letting everyone know about something). It uses TCP It doesn't use TCP - TCP is a layer 4 protocol, whereas ARP is glue between layers 2 and 3.


0

According to RFC 6335, the maximum length for a service name is 15 characters: http://tools.ietf.org/html/rfc6335#section-5.1


0

Please see there; http://unix.stackexchange.com/questions/139285/limit-max-connections-per-ip-address-and-new-connections-per-second-with-iptable Your line seem to limit to 25 the number per IP.


0

Couple of links that may be helpful in your situation: http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Q_28353794.html http://support.microsoft.com/kb/170359 This article is actually the opposite problem (he's trying to use a big pipe) but doing the inverse of some of the settings might help: ...


-1

TCP/IP stack on linux is already very optimized and typically nothing is needed. For instance, setting local port range to get a few extra ports is almost certainly not needed. In terms of time/wait being bad, it is just part of using tcp. If you really want to have less ports in that state, change tcp_fin_timeout or tcp_keepalive values. Although you ...


0

Windows does not report on the TcpExt properties. The reason is because Windows does not TOE by default. You can verify this by running netstat -nt and the offload column will likely be InHost. In contrast, Linux uses TOE (TCP Offload Engine) by default and tools are built to query the TcpExt properties. The data you're wanting is completely dependent on ...


2

No for built-in tool. Only way I can think of is to use the winpcap/npf library to build your own tool to make up stat that you need. In windows the network stack is stripped compared to the Linux/BSD's side. Thus the need for winpcap&npf driver. I would add that even the windows firewall is a pseudo-stateless firewall (layer 4 and it just check tcp ...


2

Since the answer body has to be at least 30 symbols, I need to write some stuff here, even the totally dull one, though netstat -aun or even man netstat would be enough.


1

netsh interfaces ipv4 show {tcp,ip,udp}stats gives you some additional information over netstat, but it might not be enough. MS Technet article on netsh ipv4



Top 50 recent answers are included