I've got a SLES machine that accumulates TCP connections in a CLOSE_WAIT state for what appears to be forever. These descriptors eventually suck up all available memory. At the moment, I've got 3037 of them, but it was much higher before a hurry-up reboot recently.
What's interesting is that they're not from connections to local ports that I expect to have listening processes. They have no associated PIDs, and their timers seem to have expired.
# netstat -ton | grep CLOSE_WAIT tcp 176 0 10.0.0.60:54882 10.0.0.12:31663 CLOSE_WAIT off (0.00/0/0) tcp 54 0 10.0.0.60:60957 10.0.0.12:4503 CLOSE_WAIT off (0.00/0/0) tcp 89 0 10.0.0.60:50959 10.0.0.12:3518 CLOSE_WAIT off (0.00/0/0) # netstat -tonp | grep CLOSE_WAIT tcp 89 0 10.0.0.59:45598 10.0.0.12:1998 CLOSE_WAIT - tcp 15 0 10.0.0.59:60861 10.0.0.12:1938 CLOSE_WAIT - tcp 5 0 10.0.0.59:56173 10.0.0.12:1700 CLOSE_WAIT -
I'm not a black-belt when it comes to the TCP stack, or kernel networking, but the TCP config seems sane, since these values are default, per the man page:
# cat /proc/sys/net/ipv4/tcp_fin_timeout 60 # cat /proc/sys/net/ipv4/tcp_keepalive_time 7200
So what gives? If the timers have expired, shouldn't the stack automatically clear this stuff out? I'm effectively giving myself a long-term DoS as these things build up.