Date: Tue, 06 Apr 2004 12:09:11 -0400 From: Chuck Swiger <cswiger@mac.com> To: Brandon Erhart <berhart@ErhartGroup.COM> Cc: freebsd-net@freebsd.org Subject: Re: FIN_WAIT_[1,2] and LAST_ACK Message-ID: <4072D627.9060909@mac.com> In-Reply-To: <6.0.2.0.2.20040405180951.01c8d898@mx1.erhartgroup.com> References: <20040405171756.90E3BF8F2@gemini.nersc.gov> <6.0.2.0.2.20040405133109.01c755c8@mx1.erhartgroup.com> <4071D923.A7E0D93F@freebsd.org> <6.0.2.0.2.20040405180951.01c8d898@mx1.erhartgroup.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Brandon Erhart wrote: > They are not timing out after 2MSL. I set my MSL to the lowest possible > setting (10) as to make TIME_WAIT connections disappear. The > FIN_WAIT_[1,2] and LAST_ACK seem to be sticking around for a while. > However, not ALL of them stick around for a "long time"(more on this in > a sec) -- e.g., after I kill my program, and say I've got 6,000 > connections sitting in FIN_WAIT_[1,2] or LAST_ACK, about a minute > afterwards 90% of them have disappeared. There seem to be a few stick > around for as long as 30 minutes or more, and in fact, a few of them > stuck around until I rebooted the computer. People are starting to set up honeynets or tarpits which will "persist capture" TCP connections "forever" by responding with a zero window size. Such things slow down the spread of worms/virii effectively, but they also make nmap or other scanning tools (perhaps Brandon's) unhappy. It might be interesting to retest one of these stuck connections by hand and see whether the remote machine generates a normal response. -- -Chuck
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4072D627.9060909>