[hobbit] Large number of TIME_WAITs

[Gary Baluha]

Red Hat ES 4 Update 5.
That's what I normally would think, but it doesn't make any sense that the
source AND destination are both localhost or the local IP.  It's as though
the Hobbit server is trying to communicate with itself using network
sockets.  It would make more sense if either the source or destination was a
client IP, but that isn't the case.

On Jan 29, 2008 10:15 AM, Hubbard, Greg L <greg.hubbard at eds.com> wrote:

>  What OS?  Some operating systems allow network connections to hang around
> a bit after disconnection.  On Solaris you can set a parameter to reduce the
> timeout period.  Hobbit could trigger this because each client connects to
> the server, sends a data blast, and then disconnects.
>
>  ------------------------------
> *From:* Gary Baluha [mailto:gumby3203 at gmail.com]
> *Sent:* Tuesday, January 29, 2008 8:58 AM
> *To:* hobbit at hswn.dk
> *Subject:* [hobbit] Large number of TIME_WAITs
>
> I noticed something strange on my Hobbit server, though I'm not sure if
> it's a problem or not.  There are about 140 TIME_WAITs from the local IP of
> the Hobbit server, and about 30 TIME_WAITs from localhost, all using port
> 1984.  They look something like this:
>
> 0      0 1.2.3.4:42389         1.2.3.4:1984          TIME_WAIT
> 0      0 1.2.3.4:42394         1.2.3.4:1984          TIME_WAIT
> 0      0 1.2.3.4:42399         1.2.3.4:1984          TIME_WAIT
> 0      0 1.2.3.4:42396         1.2.3.4:1984          TIME_WAIT
> 0      0 1.2.3.4:42397         1.2.3.4:1984          TIME_WAIT
>
> 0      0 127.0.0.1:42310             127.0.0.1:1984              TIME_WAIT
> 0      0 127.0.0.1:42309             127.0.0.1:1984              TIME_WAIT
> 0      0 127.0.0.1:42315             127.0.0.1:1984              TIME_WAIT
> 0      0 127.0.0.1:42322             127.0.0.1:1984              TIME_WAIT
> 0      0 127.0.0.1:42320             127.0.0.1:1984              TIME_WAIT
>
> There are also a few on various other ports:
> 0      0 127.0.0.1:42246             127.0.0.1:29021             TIME_WAIT
> 0      0 127.0.0.1:42301             127.0.0.1:29023             TIME_WAIT
> 0      0 127.0.0.1:42362             127.0.0.1:29017             TIME_WAIT
> 0      0 127.0.0.1:29030             127.0.0.1:42380             TIME_WAIT
> 0      0 127.0.0.1:42348             127.0.0.1:29019             TIME_WAIT
>
>
> Any idea why there should be so many of them, particularly on the
> localhost address?  And any idea if this looks abnormal or not?
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20080129/d5df2322/attachment.html>