[TechNote] "netstat -a" shows many connections with a status of FIN_WAIT_2

"netstat -a" shows many connections with a status of FIN_WAIT_2

Problem(Abstract)

You are running the IBM® HTTP Server on AIX® and are noticing that when issuing a netstat -a that many connections have a status of FIN_WAIT_2. This symptom usually occurs on AIX platforms running high traffic Web sites and does not indicate a problem with the IBM HTTP Server.

Cause

Some clients or browsers never properly close their side of the connection (possibly a bug in the browser, the clients TCP stack or perhaps the client is dialed in and the dial-up link drops before the shutdown completes).
There might be other causes, but these are the most common.

Resolving the problem

• Impact:If too many FIN_WAIT_2 sessions build up, it can fill up the space allocated for storing connection information and crash the Kernel.
  
• Resolution or workaround:The right way to handle this problem is for the TCP/IP stack to have a fin_wait2 timer that will shutdown sockets stuck in fin_wait2 state.
  
  By default, a socket in TIME_WAIT2 will be cleaned up in 600 seconds (tcp_keepintvl * tcp_keep_alive_retry):
  • tcp_keepintvl is tunable.
  • tcp_keep_alive_retry is not tunable (set to 8).
  • tcp_keepintvl defaults to '150' half second intervals (75 seconds). Times 8 is 600 seconds.
  • You can reduce this 600 second timeout by reducing tcp_keepintvl.
  • You should be able to set tcp_keepintvl to as low as 30 (from 150) which should cause the TIME_WAIT2 sockets to time out in 2 minutes (rather than 10 minutes).
    
• How to set the value:
  1. Note what the current setting is by entering the following command (it should be 150):
     
     

     no -o tcp_keepintvl

  2. Login as root.
     
  3. To change the value, enter the following command:
     
     

     no -o tcp_keepintvl=30

• Since AIX 4.3, FIN_WAIT2 can be controlled using the no command

example:
To reduce fin_wait2 time out to one minute, the command is no -o tcp_finwait2=120