SYN_RCVD

[Igaduma]

Hi all,

I'm running a samba server on a solaris machine, talking to several windows NT boxes.

From time to time the solaris machine drops out and stops responding to the network.

The network activity can go on for several hours without a problem and then all of a sudden all connections are dropped.

When checking the state of the sockets I see a few sockets in SYN_RCVD state.

When typing snoop (network snoop binary) the machine kicks off again.
Must be an issue with waiting for a packet.

Anyone any info about this ?

Thanks!

Iga-Duma

 

[jgercken]

Yep SYN_RCVD means a connection has been opened & the handshake is in process. It will hold the socket open for a period of time then reset. It's normal and shouldn't be a big deal unless there's a whole lot of ports in this state. In that case you may have a trogan/hacker performing a sync attack.

-Jeff ----------------------------------------
Wassabi Pop Tarts! Write Kellogs today!

 

Hi Jgercken,

Thats all I can find about it, on webservers it seems to be a plague from time to time.

But this is in a situation where you have an NT client accessing files on a solaris server.

The machine hangs for a couple of minutes and the port is in that state,

Isn't there some sort of setting in /dev/tcp that could change the behaviour of the wait state ?

Iga-Duma