Ok, for now I have got pcap file with host 194.186.69.10 that generated almost simultaneously 4 "suspended" CLOSE_WAIT sockets on ports 1363, 1365, 1369, 1371 (all other traffic excluded). Hope it helps. This bug is very difficult to reproduce and we will try to get strace and unix socket info of problem.Yes, the show sess should help a lot with all the flags that are dumped.And clearly a pcap could help as well ! Sergey, this time we don't need the data in the pcap file, so if you can take one, you do not need to use -s0, you'll get a smaller file and won't disclose possibly sensitive information.
close_wait_ports.pcap
Description: application/vnd.tcpdump.pcap
