blocked socket

[Andreas Bednarz]

Is it possible to free a blocked socket without rebooting the machine ?

[Steven Sim Kok Leong]

Hi,

The unorthodox method of using tcp_discon or tcp_discon_by_addr allows terminating of connections in the connections table without the need for a reboot. However, my advice is to use it only as a last resort.

To use the ndd -set /dev/tcp tcp_discon, you need the pointer to the TCP instance data. You can retrieve this via the ndd command tcp_status.

So, the scenario to find the TCP instance data and then use tcp_discon to remove the instance is as follows:

# ndd -get /dev/tcp tcp_status
TCP dest snxt suna swnd cwnd rnxt rack rwnd rto mss [lport,fport] state

0183b8b4 015.043.233.086 533cb8ce 533cb8ce 00008000 00003000 533bc583 533bc583 00000000 02812 04096 [c00a,cea9] TCP_CLOSE_WAIT

So, if you wanted to remove this connection:
# ndd -set /dev/tcp tcp_discon 0x0183b8b4

If you want to use the tcp_discon_by_addr, you use a 24 byte string that contains the hex representation of the quadruple.

For example, if the connection that I want to delete is:

Local IP: 192.1.2.3 (0xc0010203)
Local Port: 1024 (0x0400)
Remote IP : 192.4.5.6 (0xc0040506)
Remote Port: 2049 (0x0801)

The "hex" string you pass to tcp_discon_by_addr is:

# ndd -set /dev/tcp tcp_discon_by_addr "c00102030400c00405060801"

NOTE: the preceding 0x that typically indicates a Hex number is NOT part of the string passed.

Hope this helps. Regards.

Steven Sim Kok Leong

[Andreas Bednarz]

I can't find ndd command on my server. We're working with HP-UX 10.20.

[Stefan Farrelly]

For 10.20 you need to use adb to kill them instead of ndd. Theres all sorts of scripts to do this, including one from HP themselves. They are all in the answer;

http://www.dutchworks.nl/htbin/hpsysadmin?h=3&dn=25109&q=blocked%20socket&fh

[Ron Kinner]

If your blocked sockets are being caused by connections to a WinNT box then you can keep them from happening with the WinNT patch mentioned in Microsoft Knowledge Base article: Q254930. You have to call MS support and beg them for it or you can email me. (rkinner@att.net) Seems WinNT does a poor job of closing a connection especially if a packet gets lost. netstat -a on the WinNT will show lots of connections in Last ACK if this is your problem.

Ron