[hobbit] Large number of TIME_WAITs

[Galen Johnson]

Wouldn't it make sense if you had a Hobbit client running on the same
server as the Hobbit server?

 

=G=

 

From: Gary Baluha [mailto:gumby3203 at gmail.com] 
Sent: Tuesday, January 29, 2008 10:36 AM
To: hobbit at hswn.dk
Subject: Re: [hobbit] Large number of TIME_WAITs

 

Red Hat ES 4 Update 5.
That's what I normally would think, but it doesn't make any sense that
the source AND destination are both localhost or the local IP.  It's as
though the Hobbit server is trying to communicate with itself using
network sockets.  It would make more sense if either the source or
destination was a client IP, but that isn't the case.

On Jan 29, 2008 10:15 AM, Hubbard, Greg L <greg.hubbard at eds.com> wrote:

What OS?  Some operating systems allow network connections to hang
around a bit after disconnection.  On Solaris you can set a parameter to
reduce the timeout period.  Hobbit could trigger this because each
client connects to the server, sends a data blast, and then disconnects.

	 

________________________________

	From: Gary Baluha [mailto:gumby3203 at gmail.com] 
	Sent: Tuesday, January 29, 2008 8:58 AM
	To: hobbit at hswn.dk
	Subject: [hobbit] Large number of TIME_WAITs

	I noticed something strange on my Hobbit server, though I'm not
sure if it's a problem or not.  There are about 140 TIME_WAITs from the
local IP of the Hobbit server, and about 30 TIME_WAITs from localhost,
all using port 1984.  They look something like this:
	
	0      0 1.2.3.4:42389         1.2.3.4:1984          TIME_WAIT
	0      0 1.2.3.4:42394         1.2.3.4:1984          TIME_WAIT
	0      0 1.2.3.4:42399         1.2.3.4:1984          TIME_WAIT
	0      0 1.2.3.4:42396         1.2.3.4:1984          TIME_WAIT
	0      0 1.2.3.4:42397         1.2.3.4:1984          TIME_WAIT
	
	0      0 127.0.0.1:42310             127.0.0.1:1984
TIME_WAIT
	0      0 127.0.0.1:42309             127.0.0.1:1984
TIME_WAIT
	0      0 127.0.0.1:42315             127.0.0.1:1984
TIME_WAIT
	0      0 127.0.0.1:42322             127.0.0.1:1984
TIME_WAIT
	0      0 127.0.0.1:42320             127.0.0.1:1984
TIME_WAIT
	
	There are also a few on various other ports:
	0      0 127.0.0.1:42246             127.0.0.1:29021
TIME_WAIT
	0      0 127.0.0.1:42301             127.0.0.1:29023
TIME_WAIT
	0      0 127.0.0.1:42362             127.0.0.1:29017
TIME_WAIT
	0      0 127.0.0.1:29030             127.0.0.1:42380
TIME_WAIT
	0      0 127.0.0.1:42348             127.0.0.1:29019
TIME_WAIT
	
	
	Any idea why there should be so many of them, particularly on
the localhost address?  And any idea if this looks abnormal or not?

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20080129/0e226c9f/attachment.html>