Re: dst cache overflow

[Jesse Pollard]

>I have a busy webserver that stops responding to network traffic when
>running for 7-10 days. First the server will gradually slow down and
>then all network traffic will stop. The syslog is full of:
>
>    dst cache overflow
>    NET: 173 messages suppressed.
>
>The machine is alive and well but to start network traffic I have to
>reboot the machine.
>Doing a 'netstat -t -n -o' says that there are 5364 connections in
>LAST_ACK state, is this some kind of DOS or what?

Don't know but the following might be used as a work-around:

Set up a perl script to search for the ports used by the "LAST_ACK".

Use this information to find the processes that hold these open, and
use fuser -k to kill them.

I used to have a news server that exhibited the same type of problem.
My script limited the number of outstanding closes to 20-50. I sorted
the list by port order, and killed all but the last 20. This kept the
server up, and available. I think the web server will respawn processes
as needed, but the leftover ones will be terminated and release the
resources.

It is a problem, but I don't know where, unless a timeout is set too
large in the TCP/IP stack.
-------------------------------------------------------------------------
Jesse I Pollard, II
Email: [e-mail]

Any opinions expressed are solely my own.