netstat shows multiple identical instances of a connection
 

We are running a combination of Apache-2 with mod_jk connecting to tomcat workers running on separate hardware.

Internet --- Apache/mod_jk --- tomcat

Strange: "netstat -tn" on the Apache server outputs identical combinations of source address, source port, destination address and destination port.

$ : count all TCP connections
$ netstat -tn | wc -l
4194
$ : count unique combinations of source/destination address/port
$ netstat -tn | sort | uniq -c | sort -n | wc -l
3846
$ : count only multiple occurrences of identical source/destination address/port
$ netstat -tn | sort | uniq -c | sort -n | awk '$1>1' | wc -l
210


I.e. I see lines like

tcp 0 0 10.198.40.64:443 10.198.40.3:26168 TIME_WAIT
tcp 0 0 10.198.40.64:443 10.198.40.3:26168 TIME_WAIT

usually separated by other lines. The states CLOSE_WAIT, ESTABLISHED, FIN_WAIT1, FIN_WAIT2 and TIME_WAIT are all affected.

The Apache server is running Debian.

$ uname -a
Linux webp05 2.6.18-6-amd64 #1 SMP Tue May 5 08:01:28 UTC 2009 x86_64 GNU/Linux

Has anybody else experienced this phenomenon? (I googled and searched LQ but couldn't find anybody else reporting this)

Should we be worried about it?

Is netstat broken, or is there another explanation?

We're scratching our heads here :confused:

http://www.developerweb.net/forum/showthread.php?t=2941

So when a connection is closed, it's state turns TIME_WAIT just to be really really sure that all the data has gone through.

Nothing to worry about I guess if you don't experience weird problems.

The issue is not the TIME_WAIT but the fact that netstat reports multiple instances of the same combination of source address, source port, destination address and destination port.

We're also seeing

tcp 0 0 10.198.41.4:59906 10.198.41.248:31289 ESTABLISHED
tcp 0 0 10.198.41.4:59906 10.198.41.248:31289 ESTABLISHED

and

tcp 0 1 10.198.40.32:80 87.167.207.96:1412 FIN_WAIT1
tcp 0 1 10.198.40.32:80 87.167.207.96:1412 FIN_WAIT1

Well, a browser can make multiple simultaneous connections to your webserver. Again, if your aren't experiencing any problems, why bother about this "issue" ?

The fact that nobody replies to your questions also tells that there's nothing to worry about ;)

True, but each connection would have a different source port.

In case it bothers you that a tcp connection is out there and you want to get rid of it, there is a handle linux app called "cutter".
http://www.lowth.com/cutter/

Pretty easy to install and use.