Re: TIME_WAIT

Matthew wrote:

> when i do "netstat -a" i sometimes get about 20 lines of TIME_WAIT
> signals. most of them appear to be squidserver:3128->localnetwork:xxxx.
> and there are some to the web on port 80. is this normal?

Do not panic, TIME_WAIT is your friend (unless you are benchmarking),
see Stevens TCPIPv1. It is perfectly normal what you are seeing. Grab
a copy of

        http://www.kohala.com/start/pocketguide1.ps

The second page contains the TCP finite state automaton. Your Squid
server machine is reporting TIME_WAIT, because it closed the connection
after a (or more) request from client machines, and now, due to the
best effort transportation of TCP by IP, TCP has to wait for any late
segments before tearing down the socket quadruple.

RFC 1122 recommends a 2MSL setting of 240 seconds, but BSD uses a
value as low as 60 seconds, which is fine for a server/production
environment. Solaris, BSD and Linux can easily be tuned to your whim.

-- 
Le deagh dhùrachd,
Dipl.-Ing. Jens-S. Vöckler (voeckler@rvs.uni-hannover.de)
Institute for Computer Networks and Distributed Systems
University of Hanover, Germany; +49 511 762 4726