I created a tcp server listening at [IP1:PORT1] and connect to it via a client using [IP2]. On both the client and server, SO_KEEPALIVE and TCP_USER_TIMEOUT are enabled with below config values.
TCP_KEEPIDLE = 1
TCP_KEEPINTVL = 1
TCP_KEEPCNT = 4
TCP_USER_TIMEOUT = 5000
In the TCPdump that I captured, I see the following:
- 3 way handshake happening between client and server in the beginning(syn-synack-ack).
- Keepalive packets being generated from both client and server after every 1 second, and the respective peer sending the ack in response.
Everything is happening as per my expectations. However now I deleted the server IP(IP1) using the below command:
/sbin/ip addr del IP1 dev DEV
After deleting the IP, this is what I observe in the trace:
Keepalive packets continue to be sent from both the entities(client and server). The server is surprisingly still sending keepalive packets, even when the underlying IP has been deleted!
The client is responding with acks for the keepalive packets sent by the server.
The server is not sending acks for any keepalive packets sent by the client.
After about 4 seconds, server IP(IP1) sends [RST,ACK] to the client after which no further packet exchange happens.
So 2 things I didn't understand from above:
- How come communication continued happening for some time even when the server IP was deleted?
- Why was the server able to send Keepalive packets to the client but not able to send keepalive acks to the client?
OS: Red Hat Enterprise Linux release 8.3