I have a number of CLOSE_WAITs from a node.
$ netstat -tn | grep CLOSE_WAIT | grep 69.120.111.63 | wc
15 90 1215
The are also in the "ip_conntrack" table. The particular node has
been leaving these CLOSE_WAITS all day...
$../src/guppy-1.0/src/guppy 69.120.111.63 25002
D ping.c(113): Host "69.120.111.63" resolved to: "69.120.111.63"
D udp.c(140): Ping GUID: 46 d0 94 67 4b 5b de 0c - 5b 09 e1 0a ea 33 89 b3
D udp.c(543): recvfrom()=61 (from=69.120.111.63:25002)
D udp.c(202): GUID: 46 d0 94 67 4b 5b de 0c - 5b 09 e1 0a ea 33 89 b3
function: 01, ttl: 1, hops: 0, size: 38
D udp.c(251): Got pong (ip=69.120.111.63, port=25002, files=41, kbs=800049)
D udp.c(396): Daily Uptime: 2615 seconds
D udp.c(446): Vendor: "LIME" char=4a
D udp.c(479): Extracted:
RTT: 0s
Peer: 69.120.111.63:25002
I grepped for the IP in ~/.gkt-gnutella to determine the port.
I ran tcpdump and I have the following,
tcpdump -i ppp0 host 69.120.111.63 | tee lime_wire.trace
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ppp0, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
21:07:45.025951 IP xxx.yyy.xxx.zzz.58191 > ool-45786f3f.dyn.optonline.net.1733:
. ack 2824314174 win 6431
21:07:45.252866 IP xxx.yyy.xxx.zzz.58191 > ool-45786f3f.dyn.optonline.net.1734:
. ack 2824377111 win 6431
21:07:50.975014 IP xxx.yyy.xxx.zzz.58191 > ool-45786f3f.dyn.optonline.net.1728:
. ack 2806816794 win 6431
...
It appears that GTKG is trying to initiate contact with this host. I
have purused the GUI looking for this particular IP, but I can not
find it in the download, upload or GNET panes. I am a leaf node; it
is not the ultras I am connected to. I have some weirdness with the
DNS entries in some download panes (queue). However, none of the DNS
entries have a client type or location that seem to match this host.
Is there any debug in GTKG that I can use to determine why I might be
trying to talk to this host? I guess I will leave the tcpdump running
to see what type of communication takes place that these the
CLOSE_WAIT state.
nmap says the host is running FreeBSD or Windows XP. I guess I could
run as an ultra-node and try connecting to this node, but I think that
would not necessarily say why the CLOSE_WAITS happen.
tia,
Bill Pringlemeir.
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
_______________________________________________
Gtk-gnutella-devel mailing list
Gtk-gnutella-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/gtk-gnutella-devel
