From owner-freebsd-net@FreeBSD.ORG Thu Jun 26 02:31:35 2008 Return-Path: Delivered-To: net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id D8932106566C; Thu, 26 Jun 2008 02:31:35 +0000 (UTC) (envelope-from lstewart@room52.net) Received: from outbound.icp-qv1-irony-out1.iinet.net.au (outbound.icp-qv1-irony-out1.iinet.net.au [203.59.1.108]) by mx1.freebsd.org (Postfix) with ESMTP id 1FEC98FC1D; Thu, 26 Jun 2008 02:31:34 +0000 (UTC) (envelope-from lstewart@room52.net) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: ApoEAOuZYkh8qAaW/2dsb2JhbACycw X-IronPort-AV: E=Sophos;i="4.27,706,1204470000"; d="scan'208";a="347714656" Received: from unknown (HELO lawrence1.loshell.home) ([124.168.6.150]) by outbound.icp-qv1-irony-out1.iinet.net.au with ESMTP; 26 Jun 2008 10:19:28 +0800 Message-ID: <4862FCBD.3090906@room52.net> Date: Thu, 26 Jun 2008 12:19:41 +1000 From: Lawrence Stewart User-Agent: Thunderbird 2.0.0.14 (X11/20080530) MIME-Version: 1.0 To: Ali Niknam References: <486283B0.3060805@transip.nl> <20080625195523.N29013@fledge.watson.org> <4862BCF5.4070900@transip.nl> In-Reply-To: <4862BCF5.4070900@transip.nl> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: Robert Watson , net@freebsd.org Subject: Re: FreeBSD 7.0: sockets stuck in CLOSED state... X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jun 2008 02:31:35 -0000 Ali Niknam wrote: > Hi Robert, [snip] > > I will double check this once more, but honestly, i strongly doubt it... > > Also one other thing that I've noticed, is that it's always the input > buffer that has bytes left; never the output buffer... > > Moreover, i've seen that close() reports EBADF, but due to the insane > amount of connections I can not say for certain that that's when the > connection goes into CLOSED state. The ip's do match, but it's very > common for the same ip's to make numerous connections too. > To get a bit more detail about the state of the tcb and socket buffers at the time the connection is shut down, you can use my SIFTR tool, available from: http://caia.swin.edu.au/urp/newtcp/tools.html The readme should explain how to use it. Please keep the "ppl" sysctl at 1. Once you have some data collected for tcbs you know end up in the unexpected CLOSED state, have a look at the relevant fields in the SIFTR log file and let us know what you find. Might be useful if you send the log file through as well for me to have a quick look. Cheers, Lawrence