linux-kernel - Re: After many hours all outbound connections get stuck in SYN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <47682D74.9010509@redhat.com>
Date:	Tue, 18 Dec 2007 15:28:36 -0500
From:	Chuck Ebbert <cebbert@...hat.com>
To:	James Nichols <jamesnichols3@...il.com>
CC:	Eric Dumazet <dada1@...mosbay.com>,
	Jan Engelhardt <jengelh@...putergmbh.de>,
	linux-kernel@...r.kernel.org
Subject: Re: After many hours all outbound connections get stuck in SYN_SENT

On 12/18/2007 02:45 PM, James Nichols wrote:
> 
> I've run tcpdump for all IPs during this problem.  I haven't tried
> doing it for a single explicit IP address- due to the nature of the
> workload it's very difficult to know which IPs will be hit at any
> given moment.   What I did see in the full IP captures is that the
> returning ACKs don't show up in the packet capture.  Unfortunately,
> tcpdump reported that some packets were dropped during the capture.
> Is it possible that the kernel was dropping the packets before they
> could be captured by tcpdump?
> 

The only way to get a reliable trace is to run a capture from a port
mirror on the switch the server is connected to. Capturing from inside
the server at the same time and comparing the traces could be useful.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/