addressalign-toparrow-leftarrow-rightbackbellblockcalendarcameraccwcheckchevron-downchevron-leftchevron-rightchevron-small-downchevron-small-leftchevron-small-rightchevron-small-upchevron-upcircle-with-checkcircle-with-crosscircle-with-pluscontroller-playcrossdots-three-verticaleditemptyheartexporteye-with-lineeyefacebookfolderfullheartglobegmailgooglegroupshelp-with-circleimageimagesinstagramFill 1light-bulblinklocation-pinm-swarmSearchmailmessagesminusmoremuplabelShape 3 + Rectangle 1ShapeoutlookpersonJoin Group on CardStartprice-ribbonprintShapeShapeShapeShapeImported LayersImported LayersImported Layersshieldstartickettrashtriangle-downtriangle-uptwitteruserwarningyahoo

Re: [linux-392] Kill FIN_WAIT1 Connections

From: Luis M.
Sent on: Saturday, January 5, 2008 2:29 AM
On Jan 4,[masked]:30 PM, Clyde Goffe <[address removed]> wrote:
> Thanks!!
> No DoS attack.  I'm not the one hosting the ftp server and I can connect to
> the ftp server with the same credentials using an ftp client on a different
> machine so I don't think the DoS is on the server side either.
> The good news is tcpkill did the trick
> This is the command I used for those interested
> tcpkill -i eth0 -9 ip host local_ip and remote_ip
> Of course substitute remote_ip and local_ip with the actual IP's
> The connections dropped right off however it didn't resolve the problem i'm
> having with not being able to connect to the ftp server.  But after
> telneting to the server on port 21 I got an error saying something about
> "too many open connection" and "connection closed by foreign hosts".  So I'm
> filing a ticket with the guys on the server side.

It might be helpful to count the number of ESTABLISHED connections and
compare this to the system limits (lsof, netstat and /etc/sysctl.conf
are your friends)

netstat -na | grep ESTAB | wc -l

For tunning things and increasing some limits, see this link:

That has some good tips on Solaris as well (for those of you who care)

Luis Mondesi
Maestro Debiano

----- START ENCRYPTED BLOCK (Triple-ROT13) ------
Gur Hohagh [Yvahk] qvfgevohgvba oevatf gur fcvevg bs Hohagh gb gur
fbsgjner jbeyq.
----- END ENCRYPTED BLOCK (Triple-ROT13) ------

People in this
Meetup are also in:

Sign up

Meetup members, Log in

By clicking "Sign up" or "Sign up using Facebook", you confirm that you accept our Terms of Service & Privacy Policy