Tcp-flow-timeout on outgoing connections

Hello,
We have clients connecting to a server, through a CSS.
The server, on some specific cases, has to connect to the clients (different port).
Since IP adresses are the same, the connection has to go through the CSS, which in this case is acting as gateway.
We're facing issues, because of teared down flows at CSS level ; we'd like to change the inactivity timeout, but can't find an easy way.
So far, the only thing I found, is to set a permanent port, but it's not really the best solution, as connections which were not closed correctly would accumulate in the system.
Would there be an easy way (I'd prefer to avoid having to create contents) for the outgoing flows, on a specific port, to have a different inactivity timeout than the default one ?
Thanks in advance for your help.
Cheers
Mael

Hi Mael,
CSS will not break routed connections just going through it.
Here's what happens:
1) CSS gets a packet directed towards an IP which is not configured as VS. When it does, it creates a connection for that flow even if the packet is not the original SYN of the three way handshake.
2) If no data is received on this connection for 16 seconds, it is moved to the free-flows list. Once it is there, the CSS will continue to use the information located in it to forward traffic but the connection will be removed as soon as we need some room for new entries.
3) Once the connection is removed even from the free-flows list and that we get a new packet for the connection, you got back to point #1. Since the CSS doesn't check for stateful information (AKA doesn't check if the first packet is a SYN).
So even if the idle timeout of the connections going through it are 16 seconds, a routed TCP flow through the CSS *will never time out*.
For changing inctivity timeouts for loabbalanced connnections you can use the below command which needs to be applied to Content rule/source groups.
flow-timeout multiplier
Note: If you give number as 2, CSS will multiply it by 16 and actual timeout would be 32.
The permanent option is also good one but can be a problem if you have high traffic for that port. You can also use cmd-scheduler along with permanent port to clear the flows periodically.
Regards,
Kanwal

Similar Messages

Flow Timeouts & TCP FIN/RST

I've been reading for a few hours, both the docs and the web, and I can't seem to definitively answer if the CSS cleans flows internally or if it closes them to the server too. It seems to be a local cleanup process from what I've read. I also wonder if there's a way to have the CSS send FINs or RSTs to the server for old flows. Basically, I'm about to help on an issue where the servers are not having their connections closed properly and they end up out of ports. I don't know if it's the app or the lb but I am curious anyway if there's a way to have the CSS send FINs or RSTs to the server for old entries. If I understand properly, the CSS proxies requests between the client and server and there should be nothing to stop FINs or RSTs from being sent back and forth. Thanks!

the CSS does not send any RESET when deleting a flow.
The reset is sent to the client when a flow was deleted AND the client sends a packet that would have matched that flow.
I believe there is a feature request to reset client and server on flow deletion but not yet implemented.
You should look for a solution on the server side.
Reduce the tcp idle timeout or something equivalent.
Also, I know some server do not like the RESET sent by CSS keepalive when using tcp keepalive.
There is a command 'tcp-close-fin' to change the reset into a fin.
If you think the kal could be part of the problem, I would recommend to use this command.
Regards,
Gilles.

TCP Connections vs TCP Flows

Hello:
I'm trying to track activity on a CSS11800 and have been watching TCP Connections with "sh serv summary" and TCP Flows with "sh flows 0.0.0.0". However, there doesn't appear to be any obvious correlation btw these figures.
Can anyone tell me which command will provide the most accurate picture of current user connections?
Does "sh serv summary" display both inbound and outbound connections whereas "sh flows 0.0.0.0 xx.xx.xx.xx" displays inbound connections only??
We often see high numbers of TCP Connections during off hours when there is no activity occuring. Perhaps this is case of browsers being left open which maintains the TCP flow.
Thanks for the insight.
Best regards,
Dan

Hi Gilles:
We have 3 service balanced to a single VIP for one client. We have been using the TCp Conn's from "show service summary" to gauge the activity of the client.
However, this number seems to fluctuate, but never actually goes below roughly 40 per service, even when there are no active flows to the VIP. And it never correlates directly to the number of flows. Would it count 2 conn's for each flow (inbound and outbound)?
Our HTTP keepalives are running as persistant - could this affect the TCP Conn's number?? Or perhaps it's an IOS issue?
Our test environments on both old IOS and 6.10 seem to display the TCP Conn's correctly, as in the number goes up and down with the creation and teardown of TCP flows. But, it seems on a loaded production environment.
Are there any particular concerns relating to the 5.02 image?? We are planning an upgrade very soon.
Regards,
Dan

General query on CSM and CSS flow timeout values

Hi all,
i have a SLB Application Processor Complex module on my Cisco 6504 which basically does some load balancing work. I am pretty new to this device but the configurations and setup looks somewhat similar to the Cisco ACE but i only have some experience with the Cisco CSS.
What i would like to know is what the equivalent command to the CSS "flow timeout" is on the CSM. Would that be the "idle timeout" command? I understand that the "pending timeout" is more to governing how long it takes to setup a 3 way handshake from client to server and the "idle timeout" is what i am looking for. Please correct me if i am wrong...
On the CSS, a flow timeout is on 16secs for most standard ports and 8 secs for HTTP. I would like to know what the default setting is for the CSM idle timeout?? Thanks alot!!
Daniel

Hi Daniel,
For Idle Timeout the the default is 1 hour/ 3600 sec.
As you know for Cicso CSM thare are 2 timers per vserver.
Idle timeout
Pending timeout.
If a connection is timed out it's because of one of these timers.
Idle timeout per vserver - If there is no traffic neither from client nor server. Idle connection timer duration in seconds; the range is from 0 (connection remains open indefinitely) to 13500000. The default is 1 hour. If you do not specify a duration value, the default value is applied.
Examples
This example shows how to specify an idle timer duration of 4000:
Cat6k-2(config-slb-vserver)# idle 4000
Pending timeout per vserver - is the max time allowed to complete the 3-way handshake.The default is 30 sec.Range is from 1 to 65535. This is a SLB virtual server configuration submode command. The pending connection timeout sets the response time for terminating connections if a switch becomes flooded with traffic. If the 3-way handshake does not complete within this time, the connection is dropped.
The CSM expect to see 2-way traffic within the pending timeout. If no traffic is received from the server, the session is removed.
Examples
This example shows how to set the number to wait for a connection to be made to the server:
Cat6k-2(config-slb-vserver)# pending 300
These are not counted as failures.
A failure is when the server does not respond or respond with a reset.
The CSM can hold 1 million connections in memory at the max.
So, if you set the idle timeout to 10 hours, your max connection rate is 1 M / 10 * 3600 = ~250 conn/sec.
Assuming they would all be open and then idle.
When the number of pending connections exceeds a configurable threshold, the CSM begins using the SYN cookies feature, encrypting all of the connection state information in the sequence numbers that it generates. This action prevents the CSM from consuming any flow state for pending (not fully established) TCP connections. This behavior is fully implemented in hardware and provides a good protection against SYN attacks.
Generic TCP termination
Some connections may not require TCP termination for Layer 7 load balancing. You can configure any virtual server to terminate all incoming TCP connections before load balancing those connections to the real servers. This configuration allows you to take advantage of all the CSM DoS features located in Layer 4 load-balancing environments.
To select the traffic type and appropriate timeout value, use the unidirectional command in the SLB virtual server submode.
[no | default] unidirectional
some protocol automatically set the 'unidirectional' function.
For example : UDP.
You can see if a vserver is unidirectional or bidirectional by doing a 'sho mod csm X vser name detail'
When a virtual server is configured as unidirectional, it no longer uses the pending timer. Instead, the idle timer will determine when to close idle or errant flows. Because the idle timer has a much longer default duration than the pending timer, be sure to set the idle timer to an appropriate value.
Use the command "show module csm slot# stats" to get the details of connection.
The statistics counters are 32-bit. Totals are accumulated since the last time the counters were cleared.
Examples
This example shows how to display SLB statistics:
Cat6k-2# show module csm 4 stats
Connections Created:       180
Connections Destroyed:     180
Connections Current:       0
Connections Timed-Out:     0
Connections Failed:        0
Server initiated Connections:
      Created:0, Current:0, Failed:0
L4 Load-Balanced Decisions:180
L4 Rejected Connections:   0
L7 Load-Balanced Decisions:0
L7 Rejected Connections:
      Total:0, Parser:0,
      Reached max parse len:0, Cookie out of mem:0,
      Cfg version mismatch:0, Bad SSL2 format:0
L4/L7 Rejected Connections:
      No policy:0, No policy match 0,
      No real:0, ACL denied 0,
      Server initiated:0
Checksum Failures: IP:0, TCP:0
Redirect Connections:0, Redirect Dropped:0
FTP Connections:           0
MAC Frames:
      Tx:Unicast:1506, Multicast:0, Broadcast:50898,
          Underflow Errors:0
      Rx:Unicast:2385, Multicast:6148349, Broadcast:53916,
          Overflow Errors:0, CRC Errors:0
Table mentioned below describes the fields in the display.
Table for "show module csm stats" Command Field Information
Field
Description
Connections Created
Number of connections that have been created on the CSM.
Connections Destroyed
Number of connections that have been destroyed on the CSM.
Connections Current
Number of current connections at the time the command was issued.
Connections Timed-Out
Number of connections that have timed out, which can occur for the following reasons:
•connection has been idle (in one or both directions) for longer than the configured idle timeout.
•TCP connection setup not completed successfully.
Connections Failed
Number of connections failed because the server did not respond within the timeout period, or the server replied with a reset.
Server initiated Connections
Number of connections created by real servers, the number of current connections, and the number of connections that failed (because the destination is unreachable).
L4 Load-Balanced Decisions
Number of Layer 4 load-balancing decisions attempted.
L4 Rejected Connections
Number of Layer 4 connections rejected because no real server was available
L7 Load-Balanced Decisions
Number of Layer 7 load-balancing decisions attempted.
L7 Rejected Connections: Total
Number of Layer 7 connections rejected.
L7 Rejected Connections: Parser
Number of Layer 7 connections rejected because the Layer 7 processor in the CSM ran out of session buffers to save the parsing state for multi-packet HTTP headers. The show module csm tech-support proc 3 command will show detailed buffer usage.
L7 Rejected Connections: Reached max parse len
Number of Layer 7 connections rejected because the HTTP header in the packet is longer than max-parse-len. When a virtual server is configured with HTTP persistent rebalancing or cookie matching/sticky, the CSM must parse to the end of HTTP header. The default max-parse-len value is 2000 bytes.
L7 Rejected Connections: Cookie out of mem:
Number of Layer 7 connections rejected because of no memory to store cookies. When a virtual server is configured with cookie matching, the CSM must save the cookie contents in memory.
L7 Rejected Connections: Cfg version mismatch
Number of Layer 7 connections rejected because part of the request was processed with an older version of the configuration. This counter should only increase after configuration changes.
L7 Rejected Connections: Bad SSL2 format:
Number of Layer 7 connections rejected because the request is using an unsupported SSL format or the format is not valid SSL.
L4/L7 Rejected Connections
Number of Layer 4 and Layer 7 connections rejected for policy related reasons:
No policy: connection rejected because the request matched a virtual server, but this virtual server did not have a policy configured.
No policy match: connection rejected because the request matched a virtual server, but the request did not match any policy configured on the virtual server.
No real: connection rejected because no real server was available to service the request
ACL denied: connection rejected because a request matched a policy with a client-access-list entry and the entry is configured to deny the request.
Server Initiated: connection initiated by a real server is rejected.
Checksum Failures
Number of checksum failures detected (there are separate counters for IP and TCP failures).
Redirect Connections
Number of connections redirected, and the number of redirect connections dropped.
FTP Connections
Number of FTP connections opened.
MAC Frames
Number of MAC frames received and transmitted on the CSM backplane connection.
For getting details on all of these commands kindy refer Catalyst 6500 Series Switch Content Switching Module Command Reference, 4.2 URL mentioned below:
http://cisco.biz/en/US/docs/interfaces_modules/services_modules/csm/4.2.x/command/reference/cmdrfIX.html
Kindly Rate.
HTH
Sachin Garg

CSS11506 - flow-timeout-multiplier

Hello,
I have a pair of Sun Directory Proxy servers behind our CSS with the following config...
<<< START CONFIG >>>
!************************** SERVICE **************************
service DirProxy_mmcdif22_636
keepalive type tcp
keepalive tcp-close fin
keepalive port 636
ip address 172.16.30.72
active
service DirProxy_mmcdif62_636
keepalive type tcp
keepalive tcp-close fin
keepalive port 636
ip address 172.16.30.76
active
!*************************** OWNER ***************************
owner Security
content DirProxy_pdd4_636
add service DirProxy_mmcdif22_636
add service DirProxy_mmcdif62_636
protocol tcp
port 636
vip address 123.123.102.201
balance aca
flow-timeout-multiplier 200
active
!*************************** GROUP ***************************
group v4DirProxy_group
add destination service DirProxy_mmcdif22_636
add destination service DirProxy_mmcdif62_636
vip address 172.16.30.12
active
<<< END CONFIG >>>
During a recent outage of mmcdif62, all existing connections appear to have been 'orphaned' on the CSS for approximately 53 minutes... which correlates with the 'flow-timeout-multiplier 200' config on this content rule.
Is there any way to overcome these 'orphaned' connections during a failure scenario as shown above?
Also, is it possible to configure the CSS to act upon source IP address info? If so, perhaps this would be a solution to our problem.
Thanks,
-Adam

Adam,
we consider the application should recover from this by itself.
If the client keeps retransmitting and the server does not respond, the application should reset the connection and open a new one which would then be loadbalanced to a working server.
The ACE module has a feature to automatically kill connections linked to a dead server.
Unfortunately this feature does not exist on the CSS.
Regarding the client ip address, you have configured a group to do client nat.
The server will therefore lose the client info.
This is however not related to the connection hang issue.
Gilles.

Issue on Service Ports for outgoing connection

Hi,
My question is regarding to my desktop Mac making outgoing connection to an external IP address 184.84.124.244 using TCP protocol destination port 443 but using 40 Service Ports between 49170 through 49217. This is an automatic outgoing connection by OS X 10.7.3 (I assumed as I did not make that connection). Why such connection required 40 ports to be opened at the same time? Anyone have any idea what might have caused that? Thanks.

There could be lots of outgoing connections when you fire up Safari, as an example, because by default it has many favourites that are RSS feeder. You could have added some new yourself.
How do I find out if those connections stay up indefinitely?
By the way just curious, how did you look up the IP address as who they are?
If you are "Terminal aware" there are some commands that can help you in this direction
host
host is a simple utility for performing DNS lookups. It is normally used to convert names to IP addresses and vice versa. When no arguments or options are given, host prints a short summary of its command line arguments and options.
netstat
show network status
whois
The whois utility looks up records in the databases maintained by several Network Information Centers (NICs).
nslookup
query Internet name servers interactively
dig
dig (domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and displays the answers that are returned from the name server(s) that were queried. Most DNS administrators use dig to troubleshoot DNS problems because of its flexibility, ease of use and clarity of output. Other lookup tools tend to have less functionality than dig.
just to name a few.
netstat in particular let you know which connections and their relative status are going on between your computer and the rest of the world

Shorting the timeout for socket connection

Hi everyone, i've got a client who owns a handle to a remote object. When the remote object quits, accesing it through a method invocation throws a java.net.SocketTimeoutException: Read timed out. That's fair, what's up is that it lasts about six seconds in sending it, and i would like to shorten the time it waits until it realises it can't connect. I've tried with sun.rmi.transport.connectionTimeout and sun.rmi.transport.tcp.readTimeout, and no success. Any idea?
Thanks in advance.

The "sun.rmi.transport.proxy.connectTimeout" parameter works only when HTTP is used.
We do it manually by utilizing RMI client and server socket factories and setting socket options as appropriate. For the connect timeout, there is connect(SocketAddress endpoint, int timeout) method of the Socket class. With this approach, the application has a full control over sockets used by the RMI engine.

Set timeout for URL connection in java1.4

hi
I want to set timeout for URL connection in java 1.4..
java 5.0 provides with a setTimeout(int ) method but how should it be done in 1.4 environment
Thanks in advance
sneha

sun.net.client.defaultConnectTimeout (default: -1)
sun.net.client.defaultReadTimeout (default: -1)
See the [Networking Properties|http://java.sun.com/j2se/1.4.2/docs/guide/net/properties.html].

Some RST are seen during TCP disconnection when using SSL connection

Some RST are seen during TCP disconnection when using SSL connection
It is expected that the disconnection sequence for a secure connection to be as follow:
client ************************* server
--- alert (warning, close notify) --->
<--- alert (warning, close notify) ---
in any order;
and then:-
--------------- FIN, ACK ------------>
<----------- FIN, ACK ---------------
------------------ ACK ----------------->
Instead of the sequence described above, the TCP connection for a secure connection is closed with an RST.
For instance, Wireshark capture shows that an SSL+SASL TCP connection is closed in the following manner:
client ************************** server
--- alert (warning, close notify) ---->
---------------- FIN, ACK ------------>
<--- alert (warning, close notify) ---
<----------- FIN, ACK ---------------------
------------ RST -----------------> *(This RST message should be investigated, an ACK message was expected)*
Server: OpenLDAP: slapd 2.4.23
Client: (java version "1.6.0_16")
import javax.naming.*;
import javax.naming.directory.*;
import javax.naming.ldap.InitialLdapContext;
import java.util.Hashtable;
import javax.naming.ldap.InitialLdapContext;
import javax.naming.ldap.StartTlsRequest;
import javax.naming.ldap.StartTlsResponse;
class Client {
private static final String DEFAULT_INITIAL_CONTEXT_FACTORY = "com.sun.jndi.ldap.LdapCtxFactory";
public static void main(String[] args) {
//SSL
try {
System.setProperty("javax.net.ssl.keyStore", "c:\\\keystore");
System.setProperty("javax.net.ssl.keyStorePassword", "adminadmin");
System.setProperty("javax.net.ssl.trustStore","c:\\\keystore");
System.setProperty("javax.net.ssl.trustStorePassword","adminadmin");
// Set up environment for creating initial context
Hashtable env = new Hashtable(11);
env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
// Must use the name of the server that is found in its certificate
env.put(Context.PROVIDER_URL, "ldap://1.2.4.4:16415");
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.SECURITY_PRINCIPAL, "cn=manager,dc=operator,dc=com");
env.put(Context.SECURITY_CREDENTIALS, "password");
env.put(Context.SECURITY_PROTOCOL, "ssl");
// Create initial context
InitialLdapContext ctx = new InitialLdapContext(env, null);
// Close the context when we're done
ctx.close();
catch(Exception e)
e.printStackTrace();
Is it a bug ? Can I expect to have a patch for this issue?
Regards,
Olivier
Edited by: 975464 on 6-Dec-2012 11:21 AM

I agree it should be an ACK not an RST but it doesn't really matter. The connection is closed, and as neither the client nor the server has any pending data it is benign. Worth investigating in a later JRE.

Need help ASAP with Data Flow Task Flat File Connection

Hey there,
I have a Data Flow Task within a ForEach loop container. The source of the flow is ADO.NET connection and the destination is a Flat File Connection. I loop through a collection of strings in the ForEach loop. Based on the string content,
I write some data to the same destination file in each iteration overwriting the previous version.
I am running into following Errors:
[Flat File Destination [38]] Warning: The process cannot access the file because it is being used by another process.
[Flat File Destination [38]] Error: Cannot open the datafile "Example.csv".
[SSIS.Pipeline] Error: Flat File Destination failed the pre-execute phase and returned error code 0xC020200E.
I know what's happening but I don't know how to fix it. The first time through the ForEach loop, the destination file is updated. The second time is when this error pops up. I think it's because the first iteration is not closing the destination
file. How do I force a close of the file within Data Flow task or through a subsequent Script Task.
This works within a SQL 2008 package on one server but not within SQL 2012 package on a different server.
Any help is greatly appreciated.
Thanks!

Thanks for the response Narsimha. What do you mean by FELC?
First time poster - what is the best way to show the package here?

Deamon program for TCP/IP kind of RFC connection

Hi Guru's ,
To create a TCP/IP kind of RFC connection we need a deamon program to run on the third party tool which will help the SAP system to recognise it and make a connection with it . What i have come to know is that this deamon program can be in the form of an exe which can be executed on the third party tool and this is provided by the third party vendors . We need to have the right knowledge of RFC libraries , C programming , SAP development env . Can you tell me if any one has done this kind of development and how much time and effort is needed for this purpose . Any pointers will be highly appreciated .
Thanks in advance
Ankush

Try using FTP to get at the root.
I never heard of telnet being supported on RT.
The TCP/IP functionality is all there.
I hope this helps,
Ben
Ben Rayner
I am currently active on.. MainStream Preppers
Rayner's Ridge is under construction

Outgoing connections take long

Hi. I've the feeling, that outgoing connections take long / very long. When I connect via ssh to a server it takes 30-60 seconds until the server answers. Connect with ICQ, the same problem. I think it's a local problem, because it works very fast on tiger. Are the any firewall properties to set it.
Thank you.

Yeah, I get the same thing. Adium won't even connect to msn. SSH takes anywhere from 30-60seconds to connect.
I've still got a g4 iBook running 10.4 with no problems at all.
I've set my firewall to be off as far as I know.
Did you get a solution for it?
Thanks

Cisco 7921 Wireless DCHP Timeout after loosing connection

Running 7921
AP 1200 Software Version 12.3(4)JA
I'm having a problem that after I set the phone up. Everything comes up fine and works great but whenever I hit a deadzone or if it looses connection, the phone will try to configure the IP and then it gives me a DHCP timeout and never connects again. If I reset my TFTP settings it then works again. How can I prevent this?

Yes per my 7921G Deployment Guide @ http://www.cisco.com/en/US/docs/voice_ip_comm/cuipph/7921g/6_0/english/deployment/guide/7921dply.pdf, you need 12.3(8)JEA or later to run the 7921G phone successfully.
12.3(8)JEC is ok for the 1230, but would suggest 12.4(3g)JA1 or later for the 1240.
For static WEP, need to ensure the keys on the AP and the client match. If you have 2 keys where one is tx on key 1 and the other is on key 2, then the other side needs to have the same key to be able to decrypt the packets.

Blocked outgoing connection /Firewall?

So I have application that I blocked before from incoming and outgoing connections. Today when I allow it to communicate by turning on "allow connections" in firewall pref pane it doesnt want to connect to update server, I turned off firewall and the same problem persists. It feels like it stored some files and doesnt let me communicate to its server no matter what.
- I ersed from preferences com.apple.alf.plist
- I reinstalled the program
Im not using any 3rd part firewall blocking apps and it feel like something is blocking connection out of my computer.
Thanks in advanace for your help.

Hi Milan,
You are correct - Cloud Database Service users cannot manage the Oracle Wallet themselves. The Cloud APEX instance is configured with the Oracle Wallet that includes 76 common root Certificate Authority certificates. The "GeoTrust Global CA" certificate is among them (StartSSL is not).
It seems that you are using the "GeoTrust(R) SSL Trial" certificate, which cannot be validated using the provided Oracle Wallet (perhaps the trial certificate is limited in some way). As an example, I compared the certificate chain used by [https://jquery.org/] and it matches yours exactly (same root CA, same intermediate CA). However, they have "QuickSSL(R)" certificate and it can be successfully validated using the provided Oracle Wallet.
So, it seems that if you upgrade your trial certificate to the full certificate, you should be able to consume your web service from the Cloud Database Service.
Thanks,
Vlad

Provider: TCP Provider, error: 0 - No connection could be made because the target machine actively refused it.

hi all,
i want to connect to server side from client , i am using sql server 2008 sp1 and os winn 7 64 bit, but it give me an error as above.
also i tried this link:
http://social.msdn.microsoft.com/Forums/sqlserver/es-ES/c0481462-fedf-4f3b-b984-ae3fef64a3b1/provider-tcp-provider-error-0-no-connection-could-be-made-because-the-target-machine-actively?forum=sqldatabaseengine
and i configured two things as follow:
windows firewall --> port --> spacial local (1433) --> allow the connection -->public (checked) and sql server network configuration manager -->protocols for mssqlserver TCP/IP(enabled).
note: my client and server windows firewalls is disabled.
but i can not solve this issue.
pls help me.
thanks & best regards.
pls help me

hi Sathish,
thank you,
this is my connection string>>
"Data Source=192.168.1.106.1433;Network Library=DBMSSOCN;" +
"Initial Catalog=rasol;Integrated Security=sspi;"
And I tried into command prompt, it replied for 192.168.1.106.
best regards.

Tcp-flow-timeout on outgoing connections

Similar Messages

Maybe you are looking for