Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations gkittelson on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Syn_ack

Status
Not open for further replies.

jason985

IS-IT--Management
Oct 16, 2002
66
US
When viewing netstat on a couple of our workstations I am noticing a lot of syn_ack and last_ack. How can I stop these floods?

TIA
 
You are seeing remnants of old TCP connections. If you have a lot of sockets stuck in LAST_ACK, it is likely that the system(s) talking to you aren't finishing the TCP hangup sequence.

Normally, one side of the connection closes a session by sending a TCP packet with the FIN flag set. The other side acknowledges the close request (by sending ACK), and sends FIN as well (sometimes in the same packet). The last step is one last ACK from the side that initiated the close:

Box A Box B
------- -------
FIN --->
<--- FIN/ACK
ACK --->

After Box B sends FIN/ACK, it shows the connection state as LAST_ACK until Box A completes the hangup. Some operating systems are pretty bad at reliably sending that last ack.

Box B will eventually time out the connection, freeing the socket.
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top