How to know how long a tcp established connection is ?

Discussion in 'Linux Networking' started by javibarroso, Jun 23, 2015.

  1. javibarroso

    javibarroso Guest


    I have a tcp connection which is hang. I would like to know when it was created.

    This is the connetion (changing ips) on /proc/tcp/net:
    11: A104DC0A:05F1 281ED70A:F704 01 00000000:00000000 00:00000000 00000000 1015 0 152351656 1 ffff81001c654d80 51 10 7 2 -1

    From dst host I cannot see such connection

    From lsof command:
    oracle 10132 oracle9i 17u IPv4 152351656 TCP xxx:1521->yyy:63236 (ESTABLISHED)

    I think this is a kernel bug, It is running on:


    $ ss -n -e -i -o dst
    State Recv-Q Send-Q Local Address:port Peer Address:port
    ESTAB 0 0 xxx:1521 yyy:63236 rto:0.204 ato:0.04 qack:3 bidir uid:1015 ino:152351656 sk:ffff81001c654d80

    There is any trick to know how long are that connection there ? I have log from oracle which says that there were connection to yyy at 2012. But not to from port 63236 ..

    I suppose that which a newer kernel this would not happen ..

    Thanks !
    javibarroso, Jun 23, 2015
    1. Advertisements

  2. javibarroso

    Jorgen Grahn Guest

    I don't have the answer (and wasn't aware of ss, so thanks!) but when
    people say they suspect a kernel bug without giving any particular
    evidence, it's usually not a kernel bug ... so don't rely too much on
    that theory.

    The Linux TCP implementation doesn't strike me as something that has
    just recently matured.

    Jorgen Grahn, Jun 24, 2015
    1. Advertisements

  3. javibarroso

    Javi Barroso Guest

    El miércoles, 24 de junio de 2015, 8:43:03 (UTC+2), Jorgen Grahn escribió:
    Thank you Jorgen.

    I think I now understand what is happen on such connection.

    Reading TCP RFC ( ), we cannot find any timeout to established state. We can see at TCP state diagram ( that we can only out from a connection if we receive some packet.

    We can find at such RFC "Half-Open Connections and Other Anomalies" section, which explain what is happening there. Surely a java application was not able to close that connection.

    Please, tell me if I'm wrong

    Thank you
    Javi Barroso, Jun 24, 2015
  4. javibarroso

    Rick Jones Guest

    If the local endpoint lists ESTABLISHED, it means the local
    application has not made any attempt to close/shutdown the connection,
    nor has the local TCP endpoint seen evidence of a similar attempt by
    the remote end of the connection.

    And indeed, ESTABLISHED can persist indefinitely.

    Ideally, applications will define their own application-level
    keepalive mechanism, whereby one side or the other will send a message
    and expect to see a response within a certain length of time. If no
    response is forthcoming, the side which initiated the keepalive would
    initiate connection tear-down.

    Kludgy applications will simply make a setsockopt() call to set
    SO_KEEPALIVE and rely on a TCP-layer-only keepalive mechanism which
    only determines if the remote TCP endpoint is reachable and says
    nothing about the actual health of the appliction at that end.

    rick jones
    Rick Jones, Jun 25, 2015
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.