Telnet times out after 60 minutes only for remote intranet users

[Cassie Xin]

We have 3 N class and one L class in service. OS is 11.00 and 11.11

A user in the remote site can start a telnet session and after one hour exactly the service is disconnected. Packet capturing shows a "reset connection" was received at the client. As well, this occurs for win-sequel, sql+ or Oracle's OEM, again only for remote users.

If additional information is needed please let me know

[Robert-Jan Goossens]

Hi,

Look for

# echo $TMOUT

it is a shell variable to auto logout after a grace periode.

Hope it helps,

Robert-Jan.

[A. Clay Stephenson]

Because this is only occurring for remote users, TMOUT does not seem to fit.

I would suspect a timeout that is occurring for idle connections through a router. Without knowing your network equipment, it's difficult to know.

One thing that might work, is to have a daemon that pings remote hosts on a regular basis to kep the connections active but this may or may not suffice depending upon whether the router considers pings "interesting" traffic.

If for example, you are using a Cisco PIX VPN, your network guys might need to look at this parameter.

TIMEOUT XLATE HH:MM:SS CONN HH:MM:SS
(Timeout for translate and idle connections).

[Jeff Schussele]

I agree with Clay.
This has all the earmarks of a Firewall/Router timeout.
And it probably is not idle-related. The sessions appear to have an absolute timeout value. Concentrate your efforts on the FWs involved in this remote access, then proceed to the next downstream router, etc.

Rgds,
Jeff

[Cassie Xin]

Here's a reply from our networks group:

The connection from the data center to the remote site in question does not run through any firewalls or VPNs and is a T1 link that normally runs with a load of about 512kbps. (lack of "interesting traffic" to keep the link up is certainly not the issue) The network between the server and the user looks like this: HP server->Cisco 4006 switch->Cisco 3662 router->Cisco 2621 router->Cisco 4006 switch->user PC. There isn't any kind of proxying going on. We have done extensive packet analysis on this. The server sends a packet with the TCP Reset flag set at 1 hour plus or minus a few milliseconds. This problem applies to telnet, ftp, oracle apps on TCP1521. Also, it does NOT occur when using WRQ, Inc's Reflection s/w for VT100 (and we've verified by pkt capture that Reflection is not sending any keepalive packets).

[A. Clay Stephenson]

While I don't think this is related to the HPUX hosts, you could probe the tcp data using ndd and look for anything near 60 minutes. All timing values in ndd are output in ms's.

Off the top of my head, this should work:

#!/usr/bin/sh

ndd -get /dev/tcp "?" | grep "read" | while read X
do
Y=$(echo "${X}" | awk '{print $1}')
if [[ -n "${Y}" && "${Y}" != "?" ]]
then
echo "${Y}: \c"
ndd -get /dev/tcp ${Y}
fi
done

The idea is that we get a list of all ndd tcp paramters that are read or read and write and output each one.

[Cassie Xin]

Here is the attachment with the results. Thanks for your assistance with this =)

[Cassie Xin]

This was a case where a firewall had a configuration issue that ended sessions at 60 minutes. The network group did not think this firewall would affect the internal network, only connections to the internet.

Thanks again for all help on this problem.