Telnet connection shown in output of w command not in netstat

[Ninad_1]

Hi,

I am facing a problem where telnet login to my system shows high usage in JCPU and PCPU in output of w command, if the same ip address is searched in output of netstat command it shows in CLOSE_WAIT for a long time after which that entry is not there in output of netstat command also but still the entry is shown in output of w command.
I have attached the output of w command , then grep of the ip address in netstat output and also the ps output for that tty.Please look for the ttyp5 line in w output.
If I dont kill the processes related to that tty then the CPU load ( shown in the first line in output of w command ) goes on increasing.
What could be the problem ?

[Ravi_8]

Hi,

PCPU:The system unit time used by the current process
JCPU: The system unit time used by all the processes and their children that are associated with the user's tty.

if the user still using telnet netstat show "ESTABLISHED"

if the m/c is in DNS it shows "TIME_WAIT"
if the user logs out connection will break and you can't see user's IP in the netstat.

[Ralf Puchner]

what version of tru64?
In case of WAIT-State: is "inet: tcp_keepalive_default = 1" set?
If not the port will be open forever in case of unproper unconnect (e.g. crash etc.)

Btw. netstat -a is the correct syntax if you need ALL ports.

[Ninad_1]

Thanks for your replies.
The tru64 version is 4.0F.
and inet:tcp_keepalive_default = 0
Shall I change it to 1 ?
Do I need to rebuild kernel after this change? or just restarting inetd will do ?
Some clarifications :
The problem comes when user is already disconnected, may be due to any reason other than proper disconnection, probably the session waits for closure for a long time and then session is disconnected ( as per netstat -a output ) but user login is still shown in w output as well as ps -t ttyp5 output.
Shall I change the tcp_keepalive_default value to 1 ?

[Ninad_1]

Hello

Please tell me if I set tcp_keepalive to 1 will it affect my system in any other way , i mean non-desirable results ? or is it safe to change the parameter.Moreover where can I get more info on such parameters.

Thanks
Ninad

[Ralf Puchner · Accepted solution]

a disconnect request is based on several steps. If one of the steps are incorrect the connection will be left open until a timeout occures (if the given parameters is set to 0).

So in your case a network problem could be the reason why the ports are still in CLOSE_WAIT state. If setting the given parameter to 1 (use dxkerneltuner to set it and you will see it is a parameter which is active for the next connection) will enable the tcp timeout mechanism which closes the connection after 2 hours (can be set via tcp_keepidle, tcp_keepintvl)

The behaviour of the parameters is well explained within the admin guide (section kernel tuning). Please have a look at it for further questions. The TCP timeout mechanisms are explained on several web pages.