Inline...
----- Original Message -----
From: "Matthew Melbourne" <[email protected]>
To: <[email protected]>
Sent: Tuesday, December 29, 2009 8:34 AM
Subject: [c-nsp] Stale tcp connection on FWSM
We have a transparent firewall context on a FWSM (code revision: 3.1(16)).
Recently the number of tcp connections has been increasing to a point
where
it hits the limit defined in the static and new connections are denied.
What type of traffic is this?
However a "show conn | inc x.x.x.148" doesn't show nearly the number of
active connections the "show local-host" command might suggest.
These probably won't match.
A "clear local-host x.x.x.x" fixes the problem temporarily, but the
problem
resurfaces later (and on different hosts).
Is there any way to see any more
detail on these 11000+ connections?
What are you looking for? Typically "sh local host x.x.x.x detail" or "sh
conn det add x.x.x.x" will some you a little more info including the current
idle time and timeout.
xxx# sh local-host x.x.x.148 all
IPv4 local hosts:
Local host: <x.x.x.148>, tcp conn(s)/limit = 11806/20000,
embryonic(s)/limit = 4470/50 udp conn(s)/limit = 0/0
Xlate(s):
Global x.x.x.148 Local x.x.x.148
I am considering whether we should perhaps reduce the default TCP
connection
timeout to less than the default one hour.
What's this box/IP doing that you have 4500 half opens? Seems like you have
a broken app or someone is probing you.
For a box that has a static with 20000 conns 50 embryonic is very very low.
It always depends on the app but those numbers are way too far apart.
I would probably get a real good handle on what your traffic is before you
do that. There's shouldn't be 1000s of half opens. Also, IIRC, embryonics
are set to time out in 20 seconds. So, you definitely have some odd stuff
going on. If this is valid traffic I'm guessing you are DoSing yourself.
I am beginning to agree with
other contributors here, that firewalls placed in front of servers is of
limited benefit and just creates masses of state which needs to be
maintained, as well as opening up other potential DoS vectors. :-)
Heh. It's definitely an interesting conversation for a lot of
environements.
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
