[gentoo-user] TCP listen overflows

[gentoo-user] TCP listen overflows

[Grant]

My site when down for about 10 minutes recently and the only
interesting thing I see in the munin graphs is a massive spike in "TCP
socket buffer errors", specifically "Listen overflows" at exactly the
same time.  Is that a clue or just a result of the downtime?  Nothing
in the logs.

- Grant

[gentoo-user] Re: TCP listen overflows

[James]

Grant <emailgrant <at> gmail.com> writes:


> My site when down for about 10 minutes recently and the only
> interesting thing I see in the munin graphs is a massive spike in "TCP
> socket buffer errors", specifically "Listen overflows" at exactly the
> same time.  Is that a clue or just a result of the downtime?  Nothing
> in the logs.


Hard to tell. What I have done in the past is install a hub/switch
outside your firewall/DMZ with several systems to perform 'mock tests'
via standard penetration tests, packet flooding, DoS, etc etc depending
on your suspicions, and pound on your net

Pentoo linux is also an excellent tool.


hth,
James

Re: [gentoo-user] Re: TCP listen overflows

[Adam Carter]

[-- Attachment #1: Type: text/plain, Size: 505 bytes --]

I dont know what that error means, but default webserver and TCP stack
options may not be helping. I investigated a Centos box with resources
issues a while back. It had many thousands of sockets in TIME_WAIT state.

IIRC i reduced /proc/sys/net/ipv4/tcp_fin_timeout from 60 to 15, and
enabled pipelining on the webserver, along with a few other webserver
tweaks.

First quick check if it happens again: netstat -an | grep -ci wait
If it returns a five figure number then the above would be worth a look.

[-- Attachment #2: Type: text/html, Size: 833 bytes --]