FIN_WAIT_2 in netstat -a

[Sachin Soni_1]

Hi all ,

i have some problem with one of my hp box.
same time i am getting few errors and i guess all are related to each other.
1-ndd starts running and it uses around 80-90% total cpu utilization.
2-ndd starts from identd in /etc/inetd.conf
3-i can see more than 2000 tcp connection in FIN_WAIT_2 stat, in my netstat -a output.
4-i stopped identd daemon , now ndd doesn't run but still i have all those open connections.

first of all , i am not clear what is this problem.
why ndd starts running, and why this open connections are there?

and i guess there is a patch for this tcp problem, i don't know what's the name.

thanks in advance.
Sachin

[Roger Baptiste]

<<1-ndd starts running and it uses around 80-90% total cpu utilization. >>

Ndd is used to display
or tune network parameters.
Are you running it for this
purpose?? or is it running
as a daemon? or is somebody
running it in the background mode?

<<2-ndd starts from identd in /etc/inetd.conf >>

identd is not needed. you can disable it in the inetd.conf file and
do inetd -c ;
ndd ""normally"" is not invoked by identd, but by
a startup script /sbin/init.d/net which
uses ndd -c to configure parameters as per the settings
in /etc/rc.config.d/nddconf. But it does not remain as a daemon.


<<3-i can see more than 2000 tcp connection in FIN_WAIT_2 stat, in my netstat -a output. >>

What application is running on your system? is this a web server? or a server which has plenty of clients connections?
2000 is a riduclously large number. How long is this system up??
You can clear the finwait2 connections by running:
ndd -set /dev/tcp tcp_fin_wait_2_timeout 60000

<<4-i stopped identd daemon , now ndd doesn't run but still i have all those open connections. >>

finwait2 connections are broken connections from the client end. you would need to clear them through the ndd command as mentioned above.

Is somebody running nettl
program? (network tracking and logging).

HTh
raj

[harry d brown jr]

Download "lsof" from:

http://hpux.tn.tudelft.nl/hppd/hpux/Sysadmin/lsof-4.55/

and use the "-i" option and grep -i wait and look for the process id's, that'll give you a good indication on what apps are causing the issue.

live free or die
harry

[Sanjay_6]

Hi Sachin,

Looks like you may need some patch, also take a look at the threads below,

http://us-support.external.hp.com/cki/bin/doc.pl/sid=15b562710c826eddf2/screen=ckiDisplayDocument?docId=200000048088545

http://us-support.external.hp.com/cki/bin/doc.pl/sid=15b562710c826eddf2/screen=ckiDisplayDocument?docId=200000048972606

Hope this helps.

Regds

[Manoj Kumar Sarangi]

Hi,

When the server closes a TCP connection, it sends a packet with the FIN bit sent to the client, which then responds with a packet with the ACK bit set. The client then sends a packet with the FIN bit set to the server, which responds with an ACK and the connection is closed. The state that the connection is in during the period between when the server gets the ACK from the client and the server gets the FIN from the client is known as FIN_WAIT_2. See the TCP RFC for the technical details of the state transitions.

you can get the value of FIN_WAIT_2 by using the following command:

ndd -get /dev/tcp tcp_fin_wait_2_timeout

and set it to a value let's say 11 minutes ..

by using
ndd -set /dev/tcp tcp_fin_wait_2_timeout 660000

OR modify
/etc/rc.config.d/nddconf

TRANSPORT_NAME[0]=tcp
NDD_NAME[0]=tcp_fin_wait_2_timeout
NDD_VALUE[0]=660000

This will force close them after 11 minutes..


I hope this helps ..

Manoj