Thursday, July 12, 2007

warning, got bogus tcp line in RHEL AS3

I have been plagued with this error while I use netstat on my RedHat Enterprise Linux, Advanced Server 3.0 box for a couple years now and never had the time to track it down. So I finally decided to investigate. It looks to be a bug on some RedHat systems: http://kbase.redhat.com/faq/FAQ_45_6180.shtm

The messages mean that "there are two identical recorded TCP connections. This can happen if a connection is rapidly closing and re-connecting on the same address/port tuple."

This seems to fit the behaviour of my webserver, as it is typically serving hundreds of connections at a time. But RedHat points to two specific parameters in /etc/sysctl.conf that are set to 1 instead of zero:
sysctl net.ipv4.tcp_tw_recycle
sysctl net.ipv4.tcp_tw_reuse


Of course, this was not true in my case. I believe however, that RedHat's general statement above about connections rapidly closing and reconnecting seems to be the cause.

To help you identify you particular problem, here are some other useful discussions of the same problem:
http://www.morgan-systems.com/tools/Dev_Netstat.asp
http://track.sipfoundry.org/browse/XPB-371

No comments:

Feel free to drop me a line or ask me a question.