Re: Flooding TCP connection

[Matthew Dillon <dillon@xxxxxxxxxxxxxxxxxxxx>]

:
:Every once in a while, when application crashes and leaves an open TCP
:connection, data starts flowing full speed back and forth the boxes.
:Here's tcpdump output from one occasion where Opera crashed:
:
:=06:56:33.123424 IP webserverip.80 > myboxip.1632: . ack 1 win 33580 <nop,nop,timestamp 859 139667162>
:06:56:33.123461 IP myboxip.1632 > webserverip.80: F 838440838:838440838(0) ack 3219133104 win 65535 <nop,nop,timest
:
:netstat says the connection is in CLOSE_WAIT state. 
:
:I have a Dell Precision 420 workstation (dual P3 800) with an integrated
:NIC:
:
:xl0: <3Com 3c905C-TX Fast Etherlink XL> port 0xdc80-0xdcff mem
:0xf8fffc00-0xf8fffc7f irq 16 at device 4.0 on pci2
:
:I'm using packet filter with a basic workstation ruleset.
:
:Any clues? Let me know if you need more information.
:
:-- 
:Atte Peltomäki             
:http://kameli.org

    Could you send more of the tcpdump so we can see the characteristics of
    the flooding?

					-Matt
					Matthew Dillon 
					<dillon@xxxxxxxxxxxxx>