I think, with netstat, you're measuring the remaining interval
Try running this shell script, add to the grep to limit the output to one of the sockets that exhibits this behaviour
Quote:
#!/bin/sh
erp=1
netstat -ano | head -2 | tail -1 | awk '{ print " --- " $8 " ------- " $9}'
while [ $erp -le 10 ]
do
netstat -ano | grep keepalive | awk '{print $6 " " $7 " " $8}'
sleep 1
erp=$(( $erp+1 ))
done
|
It gives me this output.
Quote:
--- State ------- Timer
ESTABLISHED keepalive (31.76/0/0)
ESTABLISHED keepalive (30.75/0/0)
ESTABLISHED keepalive (29.74/0/0)
ESTABLISHED keepalive (28.72/0/0)
ESTABLISHED keepalive (27.71/0/0)
ESTABLISHED keepalive (26.69/0/0)
ESTABLISHED keepalive (25.68/0/0)
ESTABLISHED keepalive (24.67/0/0)
ESTABLISHED keepalive (23.66/0/0)
ESTABLISHED keepalive (22.65/0/0)
|
If you see the same thing, look at the application that's associated with the socket, since keep_alive can be manipulated by the application layer or the peer you're connected to
