DragonFly BSD
DragonFly users List (threaded) for 2005-03
[Date Prev][Date Next]  [Thread Prev][Thread Next]  [Date Index][Thread Index]

Re: Flooding TCP connection

From: Matthew Dillon <dillon@xxxxxxxxxxxxxxxxxxxx>
Date: Mon, 21 Mar 2005 11:10:03 -0800 (PST)

:Every once in a while, when application crashes and leaves an open TCP
:connection, data starts flowing full speed back and forth the boxes.
:Here's tcpdump output from one occasion where Opera crashed:
:=06:56:33.123424 IP webserverip.80 > myboxip.1632: . ack 1 win 33580 <nop,nop,timestamp 859 139667162>
:06:56:33.123461 IP myboxip.1632 > webserverip.80: F 838440838:838440838(0) ack 3219133104 win 65535 <nop,nop,timest
:netstat says the connection is in CLOSE_WAIT state. 
:I have a Dell Precision 420 workstation (dual P3 800) with an integrated
:xl0: <3Com 3c905C-TX Fast Etherlink XL> port 0xdc80-0xdcff mem
:0xf8fffc00-0xf8fffc7f irq 16 at device 4.0 on pci2
:I'm using packet filter with a basic workstation ruleset.
:Any clues? Let me know if you need more information.
:Atte Peltomäki             

    Could you send more of the tcpdump so we can see the characteristics of
    the flooding?

					Matthew Dillon 

[Date Prev][Date Next]  [Thread Prev][Thread Next]  [Date Index][Thread Index]