All of lore.kernel.org
 help / color / mirror / Atom feed
* Crazy TCP bug (keepalive flood?) in 2.6.32?
@ 2009-12-09 18:51 Denys Fedoryshchenko
  2009-12-10  8:24 ` Ilpo Järvinen
  0 siblings, 1 reply; 15+ messages in thread
From: Denys Fedoryshchenko @ 2009-12-09 18:51 UTC (permalink / raw)
  To: netdev

Hi

I did upgrade of my lusca(squid) proxies and notice that some users getting up 
to 8-15 Mbit/s flood (while they are shaped to 128Kbit/s). After tracing i end 
up on  one of proxies host and seems it is bug in kernel tcp stack.

I check packets inside - it is same repeating content (and even same tcp 
sequence, so it is almost sure tcp bug). Sender also ignoring ICMP unreachable 
packets and continue flooding destination

Here is some examples
ss output for corresponding entry

ESTAB      0      8267        194.146.153.114:8080         172.16.67.243:2512


20:32:08.491470 IP (tos 0x0, ttl 64, id 49493, offset 0, flags [DF], proto TCP 
(6), length 655)
    194.146.153.114.8080 > 172.16.67.243.2512: Flags [P.], cksum 0xce63 
(correct), seq 0:615, ack 1, win 7504, length 615
20:32:08.492487 IP (tos 0x0, ttl 64, id 49494, offset 0, flags [DF], proto TCP 
(6), length 655)
    194.146.153.114.8080 > 172.16.67.243.2512: Flags [P.], cksum 0xce63 
(correct), seq 0:615, ack 1, win 7504, length 615
20:32:08.493468 IP (tos 0x0, ttl 64, id 49495, offset 0, flags [DF], proto TCP 
(6), length 655)
    194.146.153.114.8080 > 172.16.67.243.2512: Flags [P.], cksum 0xce63 
(correct), seq 0:615, ack 1, win 7504, length 615
20:32:08.494463 IP (tos 0x0, ttl 64, id 49496, offset 0, flags [DF], proto TCP 
(6), length 655)
    194.146.153.114.8080 > 172.16.67.243.2512: Flags [P.], cksum 0xce63 
(correct), seq 0:615, ack 1, win 7504, length 615
20:32:08.495463 IP (tos 0x0, ttl 64, id 49497, offset 0, flags [DF], proto TCP 
(6), length 655)
    194.146.153.114.8080 > 172.16.67.243.2512: Flags [P.], cksum 0xce63 
(correct), seq 0:615, ack 1, win 7504, length 615
20:32:08.496467 IP (tos 0x0, ttl 64, id 49498, offset 0, flags [DF], proto TCP 
(6), length 655)


One more
20:36:13.310718 IP 194.146.153.114.8080 > 172.16.49.30.1319: Flags [.], ack 1, 
win 7469, length 1440
20:36:13.311725 IP 194.146.153.114.8080 > 172.16.49.30.1319: Flags [.], ack 1, 
win 7469, length 1440
20:36:13.312729 IP 194.146.153.114.8080 > 172.16.49.30.1319: Flags [.], ack 1, 
win 7469, length 1440
20:36:13.313717 IP 194.146.153.114.8080 > 172.16.49.30.1319: Flags [.], ack 1, 
win 7469, length 1440
20:36:13.314717 IP 194.146.153.114.8080 > 172.16.49.30.1319: Flags [.], ack 1, 
win 7469, length 1440
20:36:13.315718 IP 194.146.153.114.8080 > 172.16.49.30.1319: Flags [.], ack 1, 
win 7469, length 1440
20:36:13.316725 IP 194.146.153.114.8080 > 172.16.49.30.1319: Flags [.], ack 1, 
win 7469, length 1440

I run multiple times ss

ESTAB      0      7730        194.146.153.114:8080          172.16.49.30:1319   
timer:(on,,172) uid:101 ino:4772596 sk:c0ce84c0
ESTAB      0      7730        194.146.153.114:8080          172.16.49.30:1319   
timer:(on,,43) uid:101 ino:4772596 sk:c0ce84c0
ESTAB      0      7730        194.146.153.114:8080          172.16.49.30:1319   
timer:(on,,17) uid:101 ino:4772596 sk:c0ce84c0

After i kill squid it will  switch socket to FIN-WAIT state and flood will 
stop.

Some sysctl tuning done during boot (maybe related)
sysctl -w net.ipv4.tcp_frto=2
sysctl -w net.ipv4.tcp_frto_response=2

And most probably it is related to keepalive. I have it set on this socket:
http_port 8080 transparent tcpkeepalive=30,30,60 http11                                                                                                                                                   

>From manual
#<----->   tcpkeepalive[=idle,interval,timeout]
#<-----><------><------>Enable TCP keepalive probes of idle connections
#<-----><------><------>idle is the initial time before TCP starts probing
#<-----><------><------>the connection, interval how often to probe, and
#<-----><------><------>timeout the time before giving up.

I am not able to reproduce reliably bug, but it is appearing on different 
cluster pc's randomly for single connection each 5-10 minutes (around 8000 
established connections to each at moment, 8 pc's in cluster) and dissapearing 
after 10-50 seconds of flood.


^ permalink raw reply	[flat|nested] 15+ messages in thread
* Re: Crazy TCP bug (keepalive flood?) in 2.6.32?
@ 2009-12-26 15:03 Denys Fedoryshchenko
  2009-12-26 19:24 ` Ilpo Järvinen
  2010-01-11 13:02 ` Ilpo Järvinen
  0 siblings, 2 replies; 15+ messages in thread
From: Denys Fedoryshchenko @ 2009-12-26 15:03 UTC (permalink / raw)
  To: Ilpo Järvinen, netdev

Few more dumps. I notice:
1)Ack always equal 1
2)It is usually first segment of data sent (?)

Maybe some value not initialised properly?


17:03:50.406118 IP (tos 0x0, ttl 64, id 57958, offset 0, flags [DF], proto TCP 
(6), length 1492)
    194.146.153.114.8080 > 172.16.199.39.1472: Flags [.], seq 0:1452, ack 1, 
win 7479, length 1452
17:03:50.407413 IP (tos 0x0, ttl 64, id 57959, offset 0, flags [DF], proto TCP 
(6), length 1492)
    194.146.153.114.8080 > 172.16.199.39.1472: Flags [.], seq 0:1452, ack 1, 
win 7479, length 1452
17:03:50.408516 IP (tos 0x0, ttl 64, id 57960, offset 0, flags [DF], proto TCP 
(6), length 1492)
    194.146.153.114.8080 > 172.16.199.39.1472: Flags [.], seq 0:1452, ack 1, 
win 7479, length 1452
17:03:50.409553 IP (tos 0x0, ttl 64, id 57961, offset 0, flags [DF], proto TCP 
(6), length 1492)
    194.146.153.114.8080 > 172.16.199.39.1472: Flags [.], seq 0:1452, ack 1, 
win 7479, length 1452
17:03:50.410424 IP (tos 0x0, ttl 64, id 57962, offset 0, flags [DF], proto TCP 
(6), length 1492)
    194.146.153.114.8080 > 172.16.199.39.1472: Flags [.], seq 0:1452, ack 1, 
win 7479, length 1452



17:04:39.801149 IP (tos 0x0, ttl 64, id 19431, offset 0, flags [DF], proto TCP 
(6), length 517)
    194.146.153.114.8080 > 172.16.107.14.1405: Flags [P.], cksum 0x51c6 
(correct), seq 0:477, ack 1, win 8730, length 477
17:04:39.802538 IP (tos 0x0, ttl 64, id 19432, offset 0, flags [DF], proto TCP 
(6), length 517)
    194.146.153.114.8080 > 172.16.107.14.1405: Flags [P.], cksum 0x51c6 
(correct), seq 0:477, ack 1, win 8730, length 477
17:04:39.803438 IP (tos 0x0, ttl 64, id 19433, offset 0, flags [DF], proto TCP 
(6), length 517)
    194.146.153.114.8080 > 172.16.107.14.1405: Flags [P.], cksum 0x51c6 
(correct), seq 0:477, ack 1, win 8730, length 477
17:04:39.804251 IP (tos 0x0, ttl 64, id 19434, offset 0, flags [DF], proto TCP 
(6), length 517)
    194.146.153.114.8080 > 172.16.107.14.1405: Flags [P.], cksum 0x51c6 
(correct), seq 0:477, ack 1, win 8730, length 477
17:04:39.805050 IP (tos 0x0, ttl 64, id 19435, offset 0, flags [DF], proto TCP 
(6), length 517)
    194.146.153.114.8080 > 172.16.107.14.1405: Flags [P.], cksum 0x51c6 
(correct), seq 0:477, ack 1, win 8730, length 477

17:06:22.123862 IP (tos 0x0, ttl 64, id 25912, offset 0, flags [DF], proto TCP 
(6), length 1492)
    194.146.153.114.8080 > 172.16.180.148.50101: Flags [.], seq 0:1452, ack 1, 
win 108, length 1452
17:06:22.124440 IP (tos 0x0, ttl 64, id 25913, offset 0, flags [DF], proto TCP 
(6), length 1492)
    194.146.153.114.8080 > 172.16.180.148.50101: Flags [.], seq 0:1452, ack 1, 
win 108, length 1452
17:06:22.125600 IP (tos 0x0, ttl 64, id 25914, offset 0, flags [DF], proto TCP 
(6), length 1492)
    194.146.153.114.8080 > 172.16.180.148.50101: Flags [.], seq 0:1452, ack 1, 
win 108, length 1452
^C17:06:22.126243 IP (tos 0x0, ttl 64, id 25915, offset 0, flags [DF], proto 
TCP (6), length 1492)
    194.146.153.114.8080 > 172.16.180.148.50101: Flags [.], seq 0:1452, ack 1, 
win 108, length 1452



17:06:43.404279 IP (tos 0x0, ttl 64, id 10279, offset 0, flags [DF], proto TCP 
(6), length 768)
    194.146.153.114.8080 > 172.16.199.151.49404: Flags [FP.], cksum 0x4ac3 
(correct), seq 0:728, ack 1, win 9816, length 728
17:06:43.405819 IP (tos 0x0, ttl 64, id 10281, offset 0, flags [DF], proto TCP 
(6), length 768)
    194.146.153.114.8080 > 172.16.199.151.49404: Flags [FP.], cksum 0x4ac3 
(correct), seq 0:728, ack 1, win 9816, length 728
17:06:43.406670 IP (tos 0x0, ttl 64, id 10282, offset 0, flags [DF], proto TCP 
(6), length 768)
    194.146.153.114.8080 > 172.16.199.151.49404: Flags [FP.], cksum 0x4ac3 
(correct), seq 0:728, ack 1, win 9816, length 728
17:06:43.407821 IP (tos 0x0, ttl 64, id 10283, offset 0, flags [DF], proto TCP 
(6), length 768)
    194.146.153.114.8080 > 172.16.199.151.49404: Flags [FP.], cksum 0x4ac3 
(correct), seq 0:728, ack 1, win 9816, length 728


17:07:09.933303 IP (tos 0x0, ttl 64, id 41731, offset 0, flags [DF], proto TCP 
(6), length 555)
    194.146.153.114.8080 > 172.16.175.130.1692: Flags [P.], cksum 0x7d98 
(correct), seq 0:515, ack 1, win 6432, length 515
17:07:09.934305 IP (tos 0x0, ttl 64, id 41732, offset 0, flags [DF], proto TCP 
(6), length 555)
    194.146.153.114.8080 > 172.16.175.130.1692: Flags [P.], cksum 0x7d98 
(correct), seq 0:515, ack 1, win 6432, length 515
17:07:09.935076 IP (tos 0x0, ttl 64, id 41733, offset 0, flags [DF], proto TCP 
(6), length 555)
    194.146.153.114.8080 > 172.16.175.130.1692: Flags [P.], cksum 0x7d98 
(correct), seq 0:515, ack 1, win 6432, length 515
17:07:09.935887 IP (tos 0x0, ttl 64, id 41734, offset 0, flags [DF], proto TCP 
(6), length 555)
    194.146.153.114.8080 > 172.16.175.130.1692: Flags [P.], cksum 0x7d98 
(correct), seq 0:515, ack 1, win 6432, length 515
17:07:09.937096 IP (tos 0x0, ttl 64, id 41735, offset 0, flags [DF], proto TCP 
(6), length 555)
    194.146.153.114.8080 > 172.16.175.130.1692: Flags [P.], cksum 0x7d98 
(correct), seq 0:515, ack 1, win 6432, length 515
17:07:09.938083 IP (tos 0x0, ttl 64, id 41736, offset 0, flags [DF], proto TCP 
(6), length 555)
    194.146.153.114.8080 > 172.16.175.130.1692: Flags [P.], cksum 0x7d98 
(correct), seq 0:515, ack 1, win 6432, length 515

17:09:21.672761 IP (tos 0x0, ttl 64, id 48515, offset 0, flags [DF], proto TCP 
(6), length 412)
    194.146.153.114.8080 > 172.16.163.219.47653: Flags [P.], cksum 0x584c 
(correct), seq 0:372, ack 1, win 181, length 372
17:09:21.673756 IP (tos 0x0, ttl 64, id 48516, offset 0, flags [DF], proto TCP 
(6), length 412)
    194.146.153.114.8080 > 172.16.163.219.47653: Flags [P.], cksum 0x584c 
(correct), seq 0:372, ack 1, win 181, length 372
17:09:21.674574 IP (tos 0x0, ttl 64, id 48517, offset 0, flags [DF], proto TCP 
(6), length 412)
    194.146.153.114.8080 > 172.16.163.219.47653: Flags [P.], cksum 0x584c 
(correct), seq 0:372, ack 1, win 181, length 372
17:09:21.675440 IP (tos 0x0, ttl 64, id 48518, offset 0, flags [DF], proto TCP 
(6), length 412)
    194.146.153.114.8080 > 172.16.163.219.47653: Flags [P.], cksum 0x584c 
(correct), seq 0:372, ack 1, win 181, length 372
17:09:21.676625 IP (tos 0x0, ttl 64, id 48519, offset 0, flags [DF], proto TCP 
(6), length 412)
    194.146.153.114.8080 > 172.16.163.219.47653: Flags [P.], cksum 0x584c 
(correct), seq 0:372, ack 1, win 181, length 372
17:09:21.678963 IP (tos 0x0, ttl 64, id 48521, offset 0, flags [DF], proto TCP 
(6), length 412)
    194.146.153.114.8080 > 172.16.163.219.47653: Flags [P.], cksum 0x584c 
(correct), seq 0:372, ack 1, win 181, length 372

17:11:12.032679 IP (tos 0x0, ttl 64, id 39699, offset 0, flags [DF], proto TCP 
(6), length 552)
    194.146.153.114.8080 > 172.16.15.13.63145: Flags [P.], cksum 0x1559 
(correct), seq 0:512, ack 1, win 6432, length 512
17:11:12.033882 IP (tos 0x0, ttl 64, id 39700, offset 0, flags [DF], proto TCP 
(6), length 552)
    194.146.153.114.8080 > 172.16.15.13.63145: Flags [P.], cksum 0x1559 
(correct), seq 0:512, ack 1, win 6432, length 512
17:11:12.034835 IP (tos 0x0, ttl 64, id 39701, offset 0, flags [DF], proto TCP 
(6), length 552)
    194.146.153.114.8080 > 172.16.15.13.63145: Flags [P.], cksum 0x1559 
(correct), seq 0:512, ack 1, win 6432, length 512
17:11:12.035720 IP (tos 0x0, ttl 64, id 39702, offset 0, flags [DF], proto TCP 
(6), length 552)
    194.146.153.114.8080 > 172.16.15.13.63145: Flags [P.], cksum 0x1559 
(correct), seq 0:512, ack 1, win 6432, length 512

^ permalink raw reply	[flat|nested] 15+ messages in thread

end of thread, other threads:[~2010-01-23 21:35 UTC | newest]

Thread overview: 15+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2009-12-09 18:51 Crazy TCP bug (keepalive flood?) in 2.6.32? Denys Fedoryshchenko
2009-12-10  8:24 ` Ilpo Järvinen
2009-12-10  8:28   ` Ilpo Järvinen
2009-12-10  8:50     ` Ilpo Järvinen
2009-12-10 10:05       ` Damian Lukowski
2009-12-10 10:24         ` Ilpo Järvinen
2009-12-26 14:54           ` Denys Fedoryshchenko
2009-12-26 15:03 Denys Fedoryshchenko
2009-12-26 19:24 ` Ilpo Järvinen
2010-01-11 13:02 ` Ilpo Järvinen
2010-01-16 14:12   ` Denys Fedoryshchenko
2010-01-19  9:10     ` Damian Lukowski
2010-01-19 11:09       ` Denys Fedoryshchenko
2010-01-19 11:17         ` Ilpo Järvinen
2010-01-23 21:37           ` Denys Fedoryshchenko

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.