[20200304]测试网路状态TIME_WAIT.txt

来源:这里教程网 时间:2026-03-03 15:15:14 作者:

[20200304]测试网路状态TIME_WAIT.txt --//前几天在做IPTABLE测试时,遇到的情况,看到网络TIME_WAIT状态。想起以前遇到的一次网路故障。 --//我当时执行如下: #  netstat -tnop 2>/dev/null  |grep TIME_WAIT|wc     392    3528   50506 --//看到状态是TIME_WAIT的连接数量很大,比上面的还要大,以为网路出了问题,实际上是DNS解析缓慢导致的问题。 --//今天测试看看网路状态是TIME_WAIT的情况要等多久消失。 https://benohead.com/blog/2013/07/21/tcp-about-fin_wait_2-time_wait-and-close_wait/#TIME_WAIT TIME_WAIT The TIME-WAIT state means that from the local end-point point of view, the connection is closed but we're still waiting before accepting a new connection in order to prevent delayed duplicate packets from the previous connection from being accepted by the new connection. In this state, TCP blocks any second connection between these address/port pairs until the TIME_WAIT state is exited after waiting for twice the maximum segment lifetime (MSL). In most cases, seeing many TIME_WAIT connection doesn't show any issue. You only have to start worrying when the number of TIME_WAIT connections cause performance problems or a memory overflow. --//还是看不懂...,我还是不理解我们内网的生产系统为什么出现大量的TIME_WAIT。 --//仅仅理解新的连接不是使用原来的IP:port直到timewait减少到0的状态结束. 1.环境: SYS@book> @ ver1 PORT_STRING                    VERSION        BANNER ------------------------------ -------------- -------------------------------------------------------------------------------- x86_64/Linux 2.4.xx            11.2.0.4.0     Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production $ grep -i expire sqlnet.ora #SQLNET.EXPIRE_TIME = 1 $ echo /proc/sys/net/ipv4/tcp_keepalive* | xargs   -n 1  strings -1 -f /proc/sys/net/ipv4/tcp_keepalive_intvl: 10 /proc/sys/net/ipv4/tcp_keepalive_probes: 4 /proc/sys/net/ipv4/tcp_keepalive_time: 33 $ echo /proc/sys/net/ipv4/tcp_syncookies  /proc/sys/net/ipv4/tcp_tw_* /proc/sys/net/ipv4/tcp_fin_timeout | xargs  -n 1 strings -1 -f /proc/sys/net/ipv4/tcp_syncookies: 1 /proc/sys/net/ipv4/tcp_tw_recycle: 0 /proc/sys/net/ipv4/tcp_tw_reuse: 0 /proc/sys/net/ipv4/tcp_fin_timeout: 60 $ cat /usr/local/bin/ts.awk # /bin/bash gawk '{ print strftime("[%Y-%m-%d %H:%M:%S]"), $0 }' $ alias zdate alias zdate='date +'\''%Y/%m/%d %T'\''' 2.测试: --//在服务端执行: $ seq 10000 | xargs -IQ bash -c " netstat -notp 2>/dev/null | egrep -i 'time_wait'| ts.awk ;sleep 1" --//正常我的测试服务器很干净,不会出现任何输出。 --//在客户端执行: $ echo @spid | sqlplus  -s -l scott/book@192.168.100.78:1521/book:DEDICATED        SID    SERIAL# PROCESS                  SERVER    SPID       PID  P_SERIAL# C50 ---------- ---------- ------------------------ --------- ------ ------- ---------- --------------------------------------------------         30        241 19134                    DEDICATED 46825       26        115 alter system kill session '30,241' immediate; --//在服务端观察,没有任何输出。也就是正常退出不会出现time_wait的情况。 --//我还在windows的客户端做了一个测试,就是登录连接服务器,然后直接ctrl+c或者点击X按钮,情况也一样,服务端没有任何输出。 --//在linux下的客户端还做了kill -9 PROCESS, 情况也一样,服务端没有任何输出。 --//也就是正常关闭或者客户端kill的情况下连接会断开,不会出现State=TIME_WAIT的情况。 --//在客户端执行: $ zdate ;tnsping 192.168.100.78 1 >/dev/null 2020/03/04 09:43:06 --//在服务端观察: $ seq 10000 | xargs -IQ bash -c " netstat -notp 2>/dev/null | egrep -i 'time_wait'| ts.awk ;sleep 1" [2020-03-04 09:43:07] tcp        0      0 192.168.100.78:1521         192.168.100.40:53052        TIME_WAIT   -                   timewait (59.85/0/0) [2020-03-04 09:43:08] tcp        0      0 192.168.100.78:1521         192.168.100.40:53052        TIME_WAIT   -                   timewait (58.83/0/0) [2020-03-04 09:43:09] tcp        0      0 192.168.100.78:1521         192.168.100.40:53052        TIME_WAIT   -                   timewait (57.81/0/0) [2020-03-04 09:43:10] tcp        0      0 192.168.100.78:1521         192.168.100.40:53052        TIME_WAIT   -                   timewait (56.79/0/0) [2020-03-04 09:43:11] tcp        0      0 192.168.100.78:1521         192.168.100.40:53052        TIME_WAIT   -                   timewait (55.77/0/0) [2020-03-04 09:43:12] tcp        0      0 192.168.100.78:1521         192.168.100.40:53052        TIME_WAIT   -                   timewait (54.75/0/0) --//时间基本对上,也可以看出TIME_WAIT从60秒开始递减到0后消失。 --//如果使用strace跟踪: $ strace -f  sqlplus scott/book@book <<<quit .. setsockopt(9, SOL_SOCKET, SO_SNDTIMEO, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 16) = 0 setsockopt(9, SOL_SOCKET, SO_RCVTIMEO, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 16) = 0 write(9, "\0\n\0\0\6\0\0\0\0@", 10)     = 10 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ close(9)                                = 0 --//在关闭socket句柄9槽前执行write。我估计这个向服务端发起关闭连接的信息。 $ strace -f   tnsping 192.168.100.78 1 ... getsockopt(4, SOL_SOCKET, SO_SNDBUF, [-4611755699976781824], [4]) = 0 getsockopt(4, SOL_SOCKET, SO_RCVBUF, [-4611755699976710828], [4]) = 0 setsockopt(4, SOL_TCP, TCP_NODELAY, [1], 4) = 0 fcntl(4, F_SETFD, FD_CLOEXEC)           = 0 rt_sigaction(SIGPIPE, {SIG_IGN}, {SIG_DFL}, 8) = 0 gettimeofday({1583286911, 730815}, NULL) = 0 write(4, "\0W\0\0\1\0\0\0\1:\1,\0\0 \0\377\377\177\10\0\0\1\0\0\35"..., 87) = 87 read(4, "\0A\0\0\4\0\0\0\"\0\0005(DESCRIPTION=(TMP=)("..., 8208) = 65 setsockopt(4, SOL_SOCKET, SO_SNDTIMEO, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 16) = 0 setsockopt(4, SOL_SOCKET, SO_RCVTIMEO, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 16) = 0 close(4)                                = 0 --//在close前没有wtite操作。" 3.看看能否缩短TIME_WAIT时间。 --//网上大量链接提示修改内核参数/proc/sys/net/ipv4/tcp_fin_timeout可以减少TIME_WAIT时间,我做了N多测试,根本没用。 --//实际上这个时间是写死在net/tcp.h头文件里面的,参考:/usr/src/kernels/2.6.39-300.26.1.el5uek/include/net/tcp.h可以发现如下: #define TCP_TIMEWAIT_LEN (60*HZ) /* how long to wait to destroy TIME-WAIT                   * state, about 60 seconds */ #define TCP_FIN_TIMEOUT TCP_TIMEWAIT_LEN                                  /* BSD style FIN_WAIT2 deadlock breaker.                   * It used to be 3min, new value is 60sec,                   * to combine FIN-WAIT-2 timeout with                   * TIME-WAIT timer.                   */ --//除非你修改头文件并且重新编译内核,否则都是无效的。 --//如果设置/proc/sys/net/ipv4/tcp_tw_recycle=1,很快回收。 $ echo /proc/sys/net/ipv4/tcp_syncookies  /proc/sys/net/ipv4/tcp_tw_* /proc/sys/net/ipv4/tcp_fin_timeout | xargs  -n 1 strings -1 -f /proc/sys/net/ipv4/tcp_syncookies: 1 /proc/sys/net/ipv4/tcp_tw_recycle: 1 /proc/sys/net/ipv4/tcp_tw_reuse: 0 /proc/sys/net/ipv4/tcp_fin_timeout: 60 --//在客户端执行: $ zdate ;tnsping 192.168.100.78 1 >/dev/null 2020/03/04 10:22:01 $ seq 10000 | xargs -IQ bash -c " netstat -notp 2>/dev/null | egrep -i 'time_wait'| ts.awk ;sleep 1" [2020-03-04 10:22:02] tcp        0      0 192.168.100.78:1521         192.168.100.40:53537        TIME_WAIT   -                   timewait (0.25/0/0) --//很快消失。 --//检查生产系统发现。 #  netstat -tnop 2>/dev/null |  grep "TIME_WAIT" | wc    1275    2475   35459 # netstat -tnop 2>/dev/null  |grep TIME_WAIT| awk '{print $5}' | cut -f1 -d":" | sort|uniq -c | sort -nr --//结果不在贴出. --//我发现对应IP执行的程序是httpd.exe或者文w3wp.exe程序。我感觉这些程序属于短连接查询,连上马上断开,感觉像这些应用没有发出断开的信息。 4.继续测试: $ seq 10000 | xargs -IQ bash -c " netstat -notp 2>/dev/null | egrep  -v -i 'time_wait|ESTABLISHED|Active Internet connection|Proto Rec'| ts.awk ;sleep 1" --//并行发起65000个连接.消耗完全部端口看看: $ seq 10 | xargs -IQ -P 10 bash -c "tnsping 127.0.0.1 6500 >/dev/null" --//仅仅偶尔能看到少量的输出。也许127.0.0.1 的lo接口很特殊. $ seq 10000 | xargs -IQ bash -c " netstat -notp 2>/dev/null | egrep  -v -i 'time_wait|ESTABLISHED|Active Internet connection|Proto Rec'| ts.awk ;sleep 1" ^[[A [2020-03-05 09:07:38] tcp        1      1 127.0.0.1:20005             127.0.0.1:1521              LAST_ACK    36320/tnsping       off (0.00/0/0) [2020-03-05 09:07:38] tcp        0      1 127.0.0.1:43473             127.0.0.1:1521              SYN_SENT    -                   off (0.00/0/0) ^C --//换成如下: $ seq 10 | xargs -IQ -P 10 bash -c "tnsping 192.168.100.78 6500 >/dev/null" --//可以发现。端口占用不会马上断开出现state=SYN_SENT。 $ seq 10000 | xargs -IQ bash -c " netstat -notp 2>/dev/null | egrep  -v -i 'time_wait|ESTABLISHED|Active Internet connection|Proto Rec'| ts.awk ;sleep 1" [2020-03-05 09:12:19] tcp        0      1 192.168.100.78:40820        192.168.100.78:1521         SYN_SENT    -                   on (2.99/0/0) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [2020-03-05 09:12:19] tcp        0      1 192.168.100.78:40828        192.168.100.78:1521         SYN_SENT    -                   on (2.99/0/0) [2020-03-05 09:12:19] tcp        0      1 192.168.100.78:40826        192.168.100.78:1521         SYN_SENT    -                   on (2.89/0/0) [2020-03-05 09:12:19] tcp        0      1 192.168.100.78:40821        192.168.100.78:1521         SYN_SENT    -                   on (2.88/0/0) [2020-03-05 09:12:19] tcp        0      1 192.168.100.78:40829        192.168.100.78:1521         SYN_SENT    -                   on (2.87/0/0) [2020-03-05 09:12:19] tcp        0      1 192.168.100.78:40825        192.168.100.78:1521         SYN_SENT    -                   on (2.86/0/0) [2020-03-05 09:12:19] tcp        0      1 192.168.100.78:40827        192.168.100.78:1521         SYN_SENT    -                   on (2.85/0/0) [2020-03-05 09:12:20] tcp        0      1 192.168.100.78:40824        192.168.100.78:1521         SYN_SENT    37361/tnsping       on (1.81/0/0) [2020-03-05 09:12:20] tcp        0      1 192.168.100.78:40823        192.168.100.78:1521         SYN_SENT    37366/tnsping       on (1.81/0/0) [2020-03-05 09:12:20] tcp        0      1 192.168.100.78:40822        192.168.100.78:1521         SYN_SENT    37368/tnsping       on (1.79/0/0) [2020-03-05 09:12:20] tcp        0      1 192.168.100.78:40820        192.168.100.78:1521         SYN_SENT    37367/tnsping       on (1.77/0/0) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [2020-03-05 09:12:20] tcp        0      1 192.168.100.78:40828        192.168.100.78:1521         SYN_SENT    37365/tnsping       on (1.77/0/0) [2020-03-05 09:12:20] tcp        0      1 192.168.100.78:40826        192.168.100.78:1521         SYN_SENT    37362/tnsping       on (1.65/0/0) [2020-03-05 09:12:20] tcp        0      1 192.168.100.78:40821        192.168.100.78:1521         SYN_SENT    37364/tnsping       on (1.65/0/0) [2020-03-05 09:12:20] tcp        0      1 192.168.100.78:40829        192.168.100.78:1521         SYN_SENT    37369/tnsping       on (1.64/0/0) [2020-03-05 09:12:20] tcp        0      1 192.168.100.78:40825        192.168.100.78:1521         SYN_SENT    37370/tnsping       on (1.62/0/0) [2020-03-05 09:12:20] tcp        0      1 192.168.100.78:40827        192.168.100.78:1521         SYN_SENT    37363/tnsping       on (1.61/0/0) [2020-03-05 09:12:21] tcp        0      1 192.168.100.78:40824        192.168.100.78:1521         SYN_SENT    37361/tnsping       on (0.58/0/0) [2020-03-05 09:12:21] tcp        0      1 192.168.100.78:40823        192.168.100.78:1521         SYN_SENT    37366/tnsping       on (0.58/0/0) [2020-03-05 09:12:21] tcp        0      1 192.168.100.78:40822        192.168.100.78:1521         SYN_SENT    37368/tnsping       on (0.55/0/0) [2020-03-05 09:12:21] tcp        0      1 192.168.100.78:40820        192.168.100.78:1521         SYN_SENT    37367/tnsping       on (0.54/0/0) [2020-03-05 09:12:21] tcp        0      1 192.168.100.78:40828        192.168.100.78:1521         SYN_SENT    37365/tnsping       on (0.54/0/0) [2020-03-05 09:12:21] tcp        0      1 192.168.100.78:40826        192.168.100.78:1521         SYN_SENT    37362/tnsping       on (0.41/0/0) [2020-03-05 09:12:21] tcp        0      1 192.168.100.78:40821        192.168.100.78:1521         SYN_SENT    37364/tnsping       on (0.40/0/0) [2020-03-05 09:12:21] tcp        0      1 192.168.100.78:40829        192.168.100.78:1521         SYN_SENT    37369/tnsping       on (0.39/0/0) [2020-03-05 09:12:21] tcp        0      1 192.168.100.78:40825        192.168.100.78:1521         SYN_SENT    37370/tnsping       on (0.38/0/0) [2020-03-05 09:12:21] tcp        0      1 192.168.100.78:40827        192.168.100.78:1521         SYN_SENT    37363/tnsping       on (0.37/0/0) --//你可以发现大量发起连接马上断开,time_wait需要60秒断开。这样其它执行tnsping操作state=SYN_SENT.有点不能理解的是,如果第2次重复执行, --//就很少或者基本看不到上面的输出,而且非常快的执行完成。 $ seq 10000 | xargs -IQ bash -c " netstat -notp 2>/dev/null | egrep  -v -i 'time_wait|ESTABLISHED|Active Internet connection|Proto Rec'| ts.awk ;sleep 1" [2020-03-05 09:20:28] tcp        1      1 192.168.100.78:59575        192.168.100.78:1521         LAST_ACK    -                   off (0.00/0/0) [2020-03-05 09:21:39] tcp        0      1 192.168.100.78:52801        192.168.100.78:1521         SYN_SENT    -                   off (0.00/0/0) --//再换一个IP又大量出现: $ seq 10 | xargs -IQ -P 10 bash -c "tnsping 127.0.0.1 6500 >/dev/null" $ seq 10000 | xargs -IQ bash -c " netstat -notp 2>/dev/null | egrep  -v -i 'time_wait|ESTABLISHED|Active Internet connection|Proto Rec'| ts.awk ;sleep 1" [2020-03-05 09:20:28] tcp        1      1 192.168.100.78:59575        192.168.100.78:1521         LAST_ACK    -                   off (0.00/0/0) [2020-03-05 09:21:39] tcp        0      1 192.168.100.78:52801        192.168.100.78:1521         SYN_SENT    -                   off (0.00/0/0) [2020-03-05 09:22:42] tcp        0      1 127.0.0.1:57158             127.0.0.1:1521              SYN_SENT    -                   on (1.81/0/0) [2020-03-05 09:22:51] tcp        0      1 127.0.0.1:57153             127.0.0.1:1521              SYN_SENT    39110/tnsping       on (11.25/2/0) [2020-03-05 09:22:51] tcp        0      1 127.0.0.1:57148             127.0.0.1:1521              SYN_SENT    39116/tnsping       on (10.72/2/0) [2020-03-05 09:22:51] tcp        0      1 127.0.0.1:57149             127.0.0.1:1521              SYN_SENT    39118/tnsping       on (10.64/2/0) [2020-03-05 09:22:51] tcp        0      1 127.0.0.1:57154             127.0.0.1:1521              SYN_SENT    39114/tnsping       on (9.95/2/0) [2020-03-05 09:22:51] tcp        0      1 127.0.0.1:57152             127.0.0.1:1521              SYN_SENT    39112/tnsping       on (9.89/2/0) [2020-03-05 09:22:51] tcp        0      1 127.0.0.1:57147             127.0.0.1:1521              SYN_SENT    39108/tnsping       on (8.89/2/0) [2020-03-05 09:22:51] tcp        0      1 127.0.0.1:57151             127.0.0.1:1521              SYN_SENT    39111/tnsping       on (5.98/2/0) --//对于网络的许多知识很匮乏,不懂。 5.停止监听看看: $ seq 10000 | xargs -IQ bash -c " netstat -notp 2>/dev/null | egrep  -v -i 'time_wait' ;sleep 1" Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name    Timer tcp        0      0 192.168.100.78:63637        192.168.100.40:1521         ESTABLISHED 23221/ora_arc1_book off (0.00/0/0) tcp        0      0 192.168.100.78:1521         192.168.100.78:5684         ESTABLISHED 17528/tnslsnr       keepalive (19.06/0/0) tcp        0      0 192.168.100.78:1521         192.168.98.6:51794          ESTABLISHED 23209/ora_d000_book keepalive (0.25/0/0) tcp        0      0 192.168.100.78:22           192.168.98.6:53993          ESTABLISHED -                   keepalive (5.05/0/0) tcp        0      0 192.168.100.78:63636        192.168.100.40:1521         ESTABLISHED 41372/ora_nsa2_book off (0.00/0/0) tcp        0     76 192.168.100.78:22           192.168.98.6:51134          ESTABLISHED -                   on (0.44/0/0) tcp        0      0 192.168.100.78:5684         192.168.100.78:1521         ESTABLISHED 23173/ora_pmon_book off (0.00/0/0) $ lsnrctl stop LSNRCTL for Linux: Version 11.2.0.4.0 - Production on 05-MAR-2020 09:27:32 Copyright (c) 1991, 2013, Oracle.  All rights reserved. Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=0.0.0.0)(PORT=1521))) The command completed successfully $ seq 10000 | xargs -IQ bash -c " netstat -notp 2>/dev/null | egrep   -i 'time_wait' ;sleep 1" tcp        0      0 127.0.0.1:1521              127.0.0.1:56737             TIME_WAIT   -                   timewait (59.94/0/0) tcp        0      0 127.0.0.1:1521              127.0.0.1:56737             TIME_WAIT   -                   timewait (58.92/0/0) tcp        0      0 127.0.0.1:1521              127.0.0.1:56737             TIME_WAIT   -                   timewait (57.90/0/0) tcp        0      0 127.0.0.1:1521              127.0.0.1:56737             TIME_WAIT   -                   timewait (56.88/0/0) tcp        0      0 192.168.100.78:1521         192.168.100.78:5684         TIME_WAIT   -                   timewait (59.15/0/0) tcp        0      0 127.0.0.1:1521              127.0.0.1:56737             TIME_WAIT   -                   timewait (55.86/0/0) tcp        0      0 192.168.100.78:1521         192.168.100.78:5684         TIME_WAIT   -                   timewait (58.13/0/0) tcp        0      0 127.0.0.1:1521              127.0.0.1:56737             TIME_WAIT   -                   timewait (54.84/0/0) tcp        0      0 192.168.100.78:1521         192.168.100.78:5684         TIME_WAIT   -                   timewait (57.11/0/0) tcp        0      0 127.0.0.1:1521              127.0.0.1:56737             TIME_WAIT   -                   timewait (53.82/0/0) tcp        0      0 192.168.100.78:1521         192.168.100.78:5684         TIME_WAIT   -                   timewait (56.09/0/0) tcp        0      0 127.0.0.1:1521              127.0.0.1:56737             TIME_WAIT   -                   timewait (52.80/0/0) tcp        0      0 192.168.100.78:1521         192.168.100.78:5684         TIME_WAIT   -                   timewait (55.07/0/0) tcp        0      0 127.0.0.1:1521              127.0.0.1:56737             TIME_WAIT   -                   timewait (51.78/0/0) tcp        0      0 192.168.100.78:1521         192.168.100.78:5684         TIME_WAIT   -                   timewait (54.05/0/0) tcp        0      0 127.0.0.1:1521              127.0.0.1:56737             TIME_WAIT   -                   timewait (50.76/0/0) tcp        0      0 192.168.100.78:1521         192.168.100.78:5684         TIME_WAIT   -                   timewait (53.03/0/0) tcp        0      0 127.0.0.1:1521              127.0.0.1:56737             TIME_WAIT   -                   timewait (49.74/0/0) ^C 6.修改内核参数: $ echo /proc/sys/net/ipv4/tcp_syncookies  /proc/sys/net/ipv4/tcp_tw_* /proc/sys/net/ipv4/tcp_fin_timeout | xargs  -n 1 strings -1 -f /proc/sys/net/ipv4/tcp_syncookies: 1 /proc/sys/net/ipv4/tcp_tw_recycle: 1 /proc/sys/net/ipv4/tcp_tw_reuse: 0 /proc/sys/net/ipv4/tcp_fin_timeout: 60 $ seq 10 | xargs -IQ -P 10 bash -c "tnsping 192.168.100.78 6500 >/dev/null" $ seq 10000 | xargs -IQ bash -c " netstat -notp 2>/dev/null | egrep  -v -i 'time_wait|ESTABLISHED|Active Internet connection|Proto Rec'| ts.awk ;sleep 1" [2020-03-05 09:45:06] tcp        1      0 192.168.100.78:36972        192.168.100.78:1521         CLOSE_WAIT  -                   off (0.00/0/0) [2020-03-05 09:45:06] tcp        1      0 192.168.100.78:39849        192.168.100.78:1521         CLOSE_WAIT  -                   off (0.00/0/0) [2020-03-05 09:45:07] tcp        0      1 192.168.100.78:46608        192.168.100.78:1521         SYN_SENT    -                   off (0.00/0/0) [2020-03-05 09:45:09] tcp        1      0 192.168.100.78:52063        192.168.100.78:1521         CLOSE_WAIT  -                   off (0.00/0/0) [2020-03-05 09:45:09] tcp        0      1 192.168.100.78:52134        192.168.100.78:1521         SYN_SENT    -                   off (0.00/0/0) [2020-03-05 09:45:12] tcp        1      1 192.168.100.78:7511         192.168.100.78:1521         LAST_ACK    -                   off (0.00/0/0) 总结: --//我仅仅得出结论出现TIME_WAIT要等60秒消失。而且写死在内核里面,修改参数/proc/sys/net/ipv4/tcp_fin_timeout无效。 --//至于生产系统出现大量的情况,我自己还是无法探究。而且还有一些情况我无法解析: #  netstat -tnop 2>/dev/null  |grep probe|wc      62     558    7819 --//而且我查询进程发现STIME竟然是Jan14,2019年的。 #  ps -eLf | egrep "6681[1]|UI[D]|7415[0]" UID         PID   PPID    LWP  C NLWP STIME TTY          TIME CMD oracle    66811      1  66811  0    1 Jan14 ?        00:00:01 oraclexxxx1 (LOCAL=NO) oracle    74150      1  74150  0    1  2019 ?        00:00:00 oraclexxxx1 (LOCAL=NO) #  netstat -tnop 2>/dev/null  | grep "probe" |grep 74150 tcp        0  32120 192.168.xxx.xxx:1521        192.168.yyy.yyy:55868        ESTABLISHED 74150/oraclexxxx1   probe (89.44/0/0)

相关推荐