I have a software that has an HTTP server listening on port 20001 and running on a Unix machine. The logfile of the HTTP server says it currently has 600+ active HTTP connections, however netstat -an | grep 20001 on the same machine where the server is running, shows that there are only 2 TCP connections currently open. The Server was provided by a different company and they are blaming our client for the big amount of HTTP sessions. I believe they are just not closing the sessions properly on their end.

As far as I know

number of active HTTP sessions = number of open TCP connections on the listening TCP port

Is this correct? If not, then when is this not the case?


Here's an example of the information that are available in the log file:

New Session F865432C-3enOjJetUTlIoBEtfYS9yNM0l+c
New Session F865432C-HJ71n4/nCda5o3WaxqlmKNUZH48
New Session F865432C-VOWUYv/wtr7QXvxGqWPFyr/JI1o
New Session F865432C-icsmvyEcsmhM0zbzPTAepfQWc4U
New Session F865432C-K+iPSJswA85YnAJNEzSa9VIdpAQ
New Session F865432C-6L5Rp+net1JEgZeX2QSiLLW9U2g
New Session F865432C-WnVQC/9ROqO50LacYDorNgB+PVk
New Session F865432C-X81QIytjaLCtLioVvqRTJYOHqtk
New Session F865432C-qIkjOoMbmr9FVWDZuZwdBA//rxs
New Session F865432C-N05q4gAjPJll6qRqxbFK09C6fNc
New Session F865432C-JC3B3mkuCnJTDFML2tTv7FPdpw8
New Session F865432C-UOGwlKaQmOawOFnBIIPRoU91GWI
New Session F865432C-Z5dWyXkfx7SsLKmujrl/3vfPYh8
New Session F865432C-w9iKm2QkDQeqZynM7hUtk/t/5Yg
New Session F865432C-uwYNGT7HcOLvuUv9F/KPCYnx3WU
New Session F865432C-b5wcRmaXMZhSPU0h6aDdPmiUdv8
New Session F865432C-I6uVQ914c7ZT+rnD5/LxA593pHg
New Session F865432C-HhUrc/IkIbM+kYXOW3sb9SqvYuo
End Session F865432C-n2VSOhW0ewjf2RnIyu2z5TkN+I8
End Session F865432C-dtvl9+4n7U+CBtS4oYAdKv4XSgM
New Session F865432C-0WCqPy9jx/ThzjoMk60wAtzRDeI
New Session F865432C-FUpkDVUqS8Zbj7CTy0Pak8/R5AE
New Session F865432C-/Nr/q60cezrsSCXaE/aJDHiAkGM
New Session F865432C-oie/wfNvpglo6UTOPNDpobkE5bI
New Session F865432C-FUO7GmbEm7gfRDmt1YRQFUgnQmg
End Session F865432C-d5jf2n9HlEheraUDu0bKR9FXb5w
End Session F865432C-d9ev8S+du/IcBr8GRyVyeWONdy4
End Session F865432C-s/d3x+vZKQ8Tnp1tHp0hfpmE6Is
End Session F865432C-xuOj1wPjVa/SFn5Sx3qvFZHW1Uo
End Session F865432C-pdZgBzd4aurZzj6it48AkA+kkbU
End Session F865432C-BW8/9/Nxp83drQh19AV96dH1SGE
New Session F865432C-2AOjAIe6lHTChy1uk2hqhM7WNRg
New Session F865432C-KkIUP6Fa0HNjyrfhfhlNvBq6Rv4
New Session F865432C-aSRpOiGNQxmW48QwanqzCQ+/ixU
New Session F865432C-KujVjcb0npH1ODXkGdLXKu70Qmo
New Session F865432C-GXB9itx4CmV9I4sUYi2y6V4qw+U

As you can no doubt notice, there are far more "New Sessions" than "End Sessions"!

  • Can you update your question and add an excerpt of your logfile showing where and how those 600+ sessions are indicated? Tell us also the name of your HTTP server. I believe there is an ambiguity on the word "session" (HTTP sessions? PHP sessions? Application-specific sessions?) – xhienne Jan 18 '17 at 14:22
  • @xhienne I've added the requested information to the question. What do you mean by the name of my HTTP server? It was developed by a different company specifically for our application. – H_squared Jan 18 '17 at 14:38
  • I meant Apache, nginx, lighttpd, etc. I doubt they developed an HTTP server from scratch, it's probably a derivative. My intent was to clarify what is a session. Different servers may have different definition. Same for applications. – xhienne Jan 18 '17 at 14:41
  • @xhienne I see. I doubt, I can get such information. It is very hard to reach someone with a somewhat of technical understanding on the other end :( – H_squared Jan 18 '17 at 14:44

According to this page, an HTTP session starts with an HTTP request to the server and ends with the server's answer. There may be several request-answer pairs in a TCP session, but sequentially, not at the same time. So, by this definition, you should have:

number of TCP sessions >= number of HTTP sessions

(it may be > because a TCP session may be kept open once the answer was received from the HTTP server)

That said, what your log file shows are no HTTP sessions. Those are application sessions. Since HTTP is a stateless protocol, your HTTP server sets a cookie in the user's browser so that when they come back, the application can continue from where it stopped. BTW, F865432C-b5wcRmaXMZhSPU0h6aDdPmiUdv8 is probably the content of the cookie set in the browser.

Each cookie corresponds to an open session. There are data associated to each cookie; they are stored on disk, on the server. To prevent the disk from filling, your HTTP server (more exactly your application) should periodically clean up its cookie jar to remove dead sessions (cookies that have not been received from a browser for a certain period of time).

So, when your application tells you there are 600+ active sessions, what it is telling you is that there are 600+ cookies and associated data on disk, not that there are 600+ simultaneous TCP connections.

If that figure grows continuously, that means that the cookies are not garbage collected: i.e. nothing is cleaning the obsolete session data on the server side.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.