10

When I use dmesg to look at linux kernel messages, I see a flood of....

TCP: too many orphaned sockets

messages. My guess is this is sockets that are hanging around in TIME_WAIT after being closed that are waiting to be cleared up. I am interested to know if this would be likely to affect services running on these servers.

andrew pate
  • 271
  • 1
  • 2
  • 6

2 Answers2

8

From the LARTC HOWTO:

/proc/sys/net/ipv4/tcp_max_orphans

Maximal number of TCP sockets not attached to any user file handle, 
held by system. If this number is exceeded orphaned connections are
reset immediately and warning is printed. This limit exists only to
prevent simple DoS attacks, you _must_ not rely on this or lower the
limit artificially, but rather increase it (probably, after increasing
installed memory), if network conditions require more than default value,
and tune network services to linger and kill such states more aggressively.

Let me remind you again: each orphan eats up to  64K of unswappable memory.

The implementation of the function limiting the number of orphans is here.

gtirloni
  • 5,746
  • 3
  • 25
  • 52
3

The possible cause of this error is system run out of socket memory.Either you need to increase the socket memory(net.ipv4.tcp_mem) or find out the cause of memory consumption

        [root@test ~]# cat /proc/sys/net/ipv4/tcp_mem
         362688  483584  725376

So here in my system you can see 725376(pages)*4096=2971140096bytes/1024*1024=708 megabyte

So this 708 megabyte of memory is used by application for sending and receiving data as well as utilized by my loopback interface.If at any stage this value reached no further socket can be made until this memory is released from the application which are holding socket open which you can determine using netstat -antulp.

Prashant Lakhera
  • 713
  • 2
  • 10
  • 25