Ports close randomly?
 

Hi,
Sorry if this is covered elsewhere, I looked but was unable to find anything similar. Anyway...

I'm using Slackware 13.37, and it's running as a guest in KVM. I have several services running on it, including SSH, Samba, httpd, and others.

I've been working on a website hosted on that Slackware instance, and I've been connecting to it with both SSH and Samba (usually at the same time). Recently, I've been having a problem roughly every 10-30 minutes, where SSH errors out with "Broken pipe". When this happens, Samba also stops working as well.

When I try to re-connect in SSH, it gives me an error of "ssh: connect to host xxx.xxx.xxx.xxx port 22: Connection refused". I am also unable to re-connect to the Samba share, using Ubuntu's built-in Samba client.

The really bizarre thing is that, when I run an nmap port scan on the Slackware machine (trying to see if there was some sort of firewall issues), it all magically works again.

This problem keeps re-occuring, and I can't find any reason why. I'm pretty new to Slackware specifically, and I'm not having any luck tracking down the source of this problem...


Any ideas?
P.S I'll be happy to supply any information that might be useful in solving this.

Places to start your investigation - on the KVM guest:

• sshd(8) application logging (not sure where Slackware has that going by default)
• smbd(8) application logging (ditto)
• kernel logging (often /var/log/messages)

In addition, the KVM host may have logging that helps you understand what is going on.

One or more of those should provide insight into the problem. In situations like this, I usually like to watch packet activity with tcpdump(1) as well (to see things like whether conversations are being torn down, RST packets are being sent, or hosts are simply not replying at all).

Thanks, that may have helped.

I did a tcpdump from my desktop until I had the problem again, and noticed a RST packet when the problem occurred. I have yet to uncover the cause, but that's a decent start.