1

On the first host,

root@xxx:~# netstat -natup | grep xxx
tcp        0      0 10.2.5.3:40740      xxx:10051   ESTABLISHED 1482/zabbix_proxy:

we can see that a connection has been established with the remote host.

root@xxx:~# ps -eo uid,pid,etime | grep 1482
      106  1482 18-17:10:17

The connection has been established for what appears to be ~18 days. When I SSH to the remote host and run:

root@xxx:~# netstat -natup | grep 10.2.5.3

there are absolutely no entries at all!

How is this possible?

0

First, the etime field indicates when the process is started. This does not necessarily means that a connection is bound to it for that time.

Next, maybe that some network address translation is being used? If so, please grep for the portnumber on the remote host: netstat -natup|grep 40740 to see what that returns.

  • You were absolutely correct, it was going through NAT. Cheers. – user May 6 '15 at 5:15
2

If there is no traffic initiated by the first host, the connection will happily stay in "ESTABLISHED" state forever until either the local process closes the connection or the remote host closes the connection.

Now imagine there is a network interruption between the hosts; no packets from the remote host can reach the first host. During this outage the remote host tries to send something to the first host; this times out because no ACK packets are received from the first host. After some time the connection times out and the remote host closes the connection. However the first host is blissfully ignorant of what's happened on the other host, so there the connection is still in state "ESTABLISHED".

The same thing happens if the remote host experiences a power failure and is rebooted; there's no chance of first terminating the existing network connections.

To prevent this situation there's tcp keepalive which needs to be turned on at the socket level. This causes a periodic keepalive packet to be exchanged between the hosts so that network outages can be detected even if there's no normal traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.