30 tcp connections Established for a while and after a few minutes are close


 
Thread Tools Search this Thread
Top Forums UNIX for Advanced & Expert Users 30 tcp connections Established for a while and after a few minutes are close
# 1  
Old 02-07-2019
30 tcp connections Established for a while and after a few minutes are close

Good morning, I need your help please

After Restarting Aps or connection, these are connections


Code:
tcp        0      0  10.80.1.26.57597       10.81.248.79.53008      ESTABLISHED
tcp        0     47  10.80.1.26.57607       10.81.248.79.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57575       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57598       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57584       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57582       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57585       10.81.248.82.53008      ESTABLISHED
tcp        0     47  10.80.1.26.57588       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57590       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57591       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57619       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57580       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57582       10.81.248.82.53008      ESTABLISHED
tcp        3      0  10.80.1.26.57586       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57624       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57578       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57576       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57614       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57581       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57621       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57595       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57610       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57583       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57587       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57592       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57594       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57602       10.81.248.82.53008      ESTABLISHED
tcp        3      0  10.80.1.26.57593       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57617       10.81.248.82.53008      ESTABLISHED
tcp        0      0  10.80.1.26.57605       10.81.248.82.53008      ESTABLISHED


Code:
provisio:/export/home/provisio>netstat -an|grep -c 10.81.248.82
30

After 5 minutes now there are no more connections:

Code:
provisio:/export/home/provisio>netstat -an|grep -c 10.81.248.79
0

I dont know where to start do diagnose the root cause; Ive trying to google in the web and one theory i found is that the client side has not data to sent so the server close the conection thereafter.

I would appreciate your help in advanced

--- Post updated at 05:25 AM ---

Sorry, I correct the last Threat grepping 10.81.248.82

Code:
netstat -an|grep -c 10.81.248.82
0

# 2  
Old 02-07-2019
What is 10.80.1.26 ?
What is 10.81.248.79 ?
What is port 53008 ?
What service is this?
What happens when you try connecting to the server?
# 3  
Old 02-07-2019
OK, 10.80.1.26 is like a connection server with other platforms,this is the server i am connected to, wchich i use to restart the 30 connections to server 10.81.248.79 (Content provider) which by means those 30 connections read some data)

so client use those 30 connections 10.81.248.79 53008

by menas of these 30 connections any process connect to a Database table, then convert some records into frameworks which are after sent to the content provider

What ive got so far is this:
1 We escalata client (client prider) and the see no problem but the problem is my site because for some reason close the connetion: closed by client. Drop session, for instance

Code:
[2019-02-07 11:13:36]   msisdn: 573017928299  amount:       2000  dateTime: 2019-02-01 18:36:27 

[2019-02-07 11:13:36]   msisdn: 573176599559  amount:       3000  dateTime: 2019-02-01 06:59:59 

[2019-02-07 11:13:36]   msisdn: 573132365842  amount:      11000  dateTime: 2019-02-01 12:24:30 

[2019-02-07 11:13:36] Connection on socket: 24 closed by client. Drop session.

[2019-02-07 11:13:36] Connection on socket: 20 closed by client. Drop session.

[2019-02-07 11:13:36] Connection on socket: 23 closed by client. Drop session.

2 they and me tested connectivity by telnet:

Code:
telnet 10.81.248.79 53003
Trying 10.81.248.79...
Connected to 10.81.248.79.
Escape character is '^]'.

3 They boldly say the problem is in my side, the suggest check up firewalls issue, network so on.
4 I dont have the experience and knowlede about networking issue if it is the real problem

I appreciate your help in advanced to give me some lshed light what i should don next





What is 10.80.1.26 ?
What is 10.81.248.79 ?
What is port 53008 ?
What service is this?
What happens when you try connecting to the server?
# 4  
Old 02-07-2019
Quote:
Originally Posted by alexcol
OK, 10.80.1.26 is like a connection server with other platforms,this is the server i am connected to, wchich i use to restart the 30 connections to server 10.81.248.79 (Content provider) which by means those 30 connections read some data)
I see only two connections to 10.81.248.79, the others go to 10.81.248.82. What is this last system?

And, while you are at it: PLEASE describe the systems (all of them) in a bit more detail: OS? application? role? So far we have:

10.80.1.26: access/jump server, OS? application(s)?
10.81.248.79: content provider (to be honest, no idea what that is), OS? application?
10.81.248.82: ??

Quote:
Originally Posted by alexcol
so client use those 30 connections 10.81.248.79 53008
by menas of these 30 connections any process connect to a Database table, then convert some records into frameworks which are after sent to the content provider
So there is a DB server (which one?) and that sends data to this "content provider", yes?

Quote:
Originally Posted by alexcol
1 We escalata client (client prider) and the see no problem but the problem is my site because for some reason close the connetion: closed by client. Drop session,
Sorry, but i have no idea what you are talking about. Please explain again.

Quote:
Originally Posted by alexcol
for instance

Code:
[2019-02-07 11:13:36]   msisdn: 573017928299  amount:       2000  dateTime: 2019-02-01 18:36:27 

[2019-02-07 11:13:36]   msisdn: 573176599559  amount:       3000  dateTime: 2019-02-01 06:59:59 

[2019-02-07 11:13:36]   msisdn: 573132365842  amount:      11000  dateTime: 2019-02-01 12:24:30 

[2019-02-07 11:13:36] Connection on socket: 24 closed by client. Drop session.

[2019-02-07 11:13:36] Connection on socket: 20 closed by client. Drop session.

[2019-02-07 11:13:36] Connection on socket: 23 closed by client. Drop session.

2 they and me tested connectivity by telnet:

Code:
telnet 10.81.248.79 53003
Trying 10.81.248.79...
Connected to 10.81.248.79.
Escape character is '^]'.

OK, so which server did drop the connections? Or, respectively, which server did you contact when your client did drop the connection? And which command did you execute to get this error message?

Quote:
Originally Posted by alexcol
4 I dont have the experience and knowlede about networking issue if it is the real problem
OK, (very short) introduction to the relevant things:

Every host (more precisely ever interface of a host) has one IP address. IP addresses are address information of the layer 3 of the OSI network model. This is the layer the IP protocol works on. But IP is just a means to transport data. It is basically used to create connections between hosts. These connections are done by two protocols, UDP and TCP. Most (perhaps more than 90%) are done with TCP but both these protocols operate at layer 4. Now picture an IP address like a house with many apartments. The owner of each apartment can be at home or not. These apartments are the "ports" and behind each port may wait a background process (a so-called "daemon") for incoming connections to serve. For instance, the telnet daemon usually waits at port 23 and if you connect to a system (and its telnet daemon is running) you would connect to this port 23 and the telnet daemon would answer. See it like this: you go into the house and ring the bell at door 23. If somebody is home (the telnetd) he will react to the bell. Ports have numbers 0-65535. 1-1024 are so-called "well-known ports" because some standard means of connecting to a system are located there: you already heard telnet uses port 23, ftp uses port 21, ssh uses 22, http uses 80 and so on. Above 1024 things are less fixed, and beyond 32768 the ports have no special meaning at all but are allocated on an ad-hoc basis.

A combination "IP address plus port" is called a "socket". If you have a connection (i.e. an established telnet connection) the client on your side (the telnet client program) allocates some free port and uses your IP with this port (the local "socket") to contact the remote IP at port 23. The telnetd daemon picks that up, establishes the connection (to some other port in order to free 23 for incoming connection requests again) so you have a socket connection yourIP+local-port <-> remoteIP+remote-port.

TCP works "connection oriented", that means that such connections are like telephone calls: once the connection is established you have a bidrectional channel over which you can exchange data. This exists until it is - by a standardised procedure - torn down.

I hope this helps.

bakunin
This User Gave Thanks to bakunin For This Post:
# 5  
Old 02-13-2019
Thanks you very much for your support and explanation, it is useful for me to grow. Unfortunately i dont have enough documentation at hand for every party (ip adresses,ports, services and so on) to provide and to keep the resolution . AS soon as i get this i will let you know. THanks once again for your support
This User Gave Thanks to alexcol For This Post:
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. IP Networking

Need to know reason for connections closed in netstat -p tcp

Hello netstat -p give below 6634176 connections as closed.How do we trace that which all connections are being closed on the server? 1366888371 data packet headers correctly predicted 1195906 connection requests 5227320 connection accepts 5992919... (6 Replies)
Discussion started by: Vishal_dba
6 Replies

2. Solaris

many tcp connection in close-wait

Hi, I use solaris Unix . I find there is some problem in application and it generate many "close-wait" tcp connect and stay in the server . it is generate by process id 7740 root@XX # netstat -an | grep CLOSE_WAIT | wc -l 285 root@XX # netstat -an | grep CLOSE_WAIT 10.158.35.4.34805 ... (2 Replies)
Discussion started by: abcdef
2 Replies

3. IP Networking

How to test max number of tcp connections

Hello, I wanna test max tcp connection value. Please suggest how to do that. Thanks. (2 Replies)
Discussion started by: gstoychev
2 Replies

4. Programming

TCP trashing data on application close

I am using c to send data to a socket with the following commands: socket = socket(AF_INET, SOCK_STREAM, ptrp->p_proto); ioctl(socket, FIONBIO, (char *)&on); connect(socket) send(socket,data) shutdown(socket, SHUT_WR); recv(socket) //ready last of data waiting on the port //note this is... (3 Replies)
Discussion started by: metrix
3 Replies

5. Solaris

Established connections causing lag?

I'm not to sure how to go about this questions, so I will just ask it and then get criticized. How many Established connections should a V440 be able to support? (4 Replies)
Discussion started by: adelsin
4 Replies

6. Solaris

How to kill the TCP ESTABLISHED connection in netstat

Hello, Actually there are some bugs in application which does not close the TCP connection to other server though CORBA. We need to kill that ESTABLISHED connections as new connection are not happeneing as the allocated ports were used and showing as ESTABLISHED Is there any... (4 Replies)
Discussion started by: GIC1986
4 Replies

7. Red Hat

How to kill all active tcp connections from an IP?

How to kill all active tcp connections from an IP? I am using CentOS (3 Replies)
Discussion started by: an00p
3 Replies

8. Programming

close existing tcp connection in C

Hello. I would like to know how to close an existing tcp socket. I have read some stuff and learned how to create a socket and then close it but have not found anything about how to close an existing tcp socket created by another application. The situation is this: I have an ODBC server running and... (6 Replies)
Discussion started by: raidzero
6 Replies

9. UNIX for Dummies Questions & Answers

close tcp port

Hello, I have a service running (ODBC) and every now and then it will hang and I will have to stop and restart the service. The problem is when I stop the service, it indeed stops the service, but netstat reports a tcp port still open with the fin_wait_2 status. Then I must close the client... (1 Reply)
Discussion started by: raidzero
1 Replies

10. Programming

C Prog to close a socket in established state

I have a SUN environment running an WebLogic that communicates w/a 3rd party running IIS. When the IIS site goes down (frequently), I am stuck with sockets in an ESTABLISHED state, and cannot seem to figure out how to avoid this. No exceptions are thrown as I can still open connections to the IIS... (1 Reply)
Discussion started by: teledelux
1 Replies
Login or Register to Ask a Question