HAProxy community

Help with understanding retransmissions from haproxy to the server


#1

Hello, I am fighting with understanding the nature of or retransmissions that are sent after ACK is received.

HA-Proxy version 1.5.18 2016/05/10

Config:

haproxy.cfg

global
log /dev/log local0
log /dev/log local1 debug

daemon
user haproxy
group haproxy
stats socket /var/run/haproxy.sock level admin

defaults
mode tcp
log global
option tcplog
option dontlognull
timeout connect 5s
timeout client 24h
timeout server 60m
maxconn 100000

frontend service_name
bind 50.1.1.3:1234
acl p1234 dst_port 1234
use_backend service_name_48641 if p1234

backend service_name_1234
balance leastconn
option independant-streams
server server_vir1 x1:1234 on-marked-down shutdown-sessions check fall 3 rise 2 inter 10s slowstart 200s source 172.1.2.3
server server_vir2 x2:1234 on-marked-down shutdown-sessions check fall 3 rise 2 inter 10s slowstart 200s source 172.1.2.4
server server_vir3 x3:1234 on-marked-down shutdown-sessions check fall 3 rise 2 inter 10s slowstart 200s source 172.1.2.5

Sysctl config:

sysctl config

abi.vsyscall32 = 1
crypto.fips_enabled = 1
debug.exception-trace = 1
debug.kprobes-optimization = 1
debug.panic_on_rcu_stall = 0
dev.hpet.max-user-freq = 64
fs.aio-max-nr = 65536
fs.aio-nr = 0
fs.nr_open = 1048576
fs.overflowgid = 65534
fs.overflowuid = 65534
fs.pipe-max-size = 1048576
fs.pipe-user-pages-hard = 0
fs.pipe-user-pages-soft = 16384
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
fs.quota.allocated_dquots = 0
fs.quota.cache_hits = 0
fs.quota.drops = 0
fs.quota.free_dquots = 0
fs.quota.lookups = 0
fs.quota.reads = 0
fs.quota.syncs = 4
fs.quota.warnings = 1
fs.quota.writes = 0
fs.suid_dumpable = 2
kernel.random.entropy_avail = 3472
kernel.random.poolsize = 4096
kernel.random.read_wakeup_threshold = 64
kernel.random.urandom_min_reseed_secs = 60
kernel.random.write_wakeup_threshold = 896
kernel.randomize_va_space = 2
kernel.real-root-dev = 0
kernel.sched_autogroup_enabled = 0
kernel.sched_cfs_bandwidth_slice_us = 5000
kernel.sched_child_runs_first = 0
kernel.sched_domain.cpu0.domain0.busy_factor = 32
kernel.sched_domain.cpu0.domain0.busy_idx = 2
kernel.sched_domain.cpu0.domain0.cache_nice_tries = 1
kernel.sched_domain.cpu0.domain0.flags = 4143
kernel.sched_domain.cpu0.domain0.forkexec_idx = 0
kernel.sched_domain.cpu0.domain0.idle_idx = 1
kernel.sched_domain.cpu0.domain0.imbalance_pct = 125
kernel.sched_domain.cpu0.domain0.max_interval = 4
kernel.sched_domain.cpu0.domain0.max_newidle_lb_cost = 17558
kernel.sched_domain.cpu0.domain0.min_interval = 2
kernel.sched_domain.cpu0.domain0.name = DIE
kernel.sched_domain.cpu0.domain0.newidle_idx = 0
kernel.sched_domain.cpu0.domain0.wake_idx = 0
kernel.sched_domain.cpu1.domain0.busy_factor = 32
kernel.sched_domain.cpu1.domain0.busy_idx = 2
kernel.sched_domain.cpu1.domain0.cache_nice_tries = 1
kernel.sched_domain.cpu1.domain0.flags = 4143
kernel.sched_domain.cpu1.domain0.forkexec_idx = 0
kernel.sched_domain.cpu1.domain0.idle_idx = 1
kernel.sched_domain.cpu1.domain0.imbalance_pct = 125
kernel.sched_domain.cpu1.domain0.max_interval = 4
kernel.sched_domain.cpu1.domain0.max_newidle_lb_cost = 9445
kernel.sched_domain.cpu1.domain0.min_interval = 2
kernel.sched_domain.cpu1.domain0.name = DIE
kernel.sched_domain.cpu1.domain0.newidle_idx = 0
kernel.sched_domain.cpu1.domain0.wake_idx = 0
kernel.sched_latency_ns = 12000000
kernel.sched_migration_cost_ns = 500000
kernel.sched_min_granularity_ns = 1500000
kernel.sched_nr_migrate = 32
kernel.sched_rr_timeslice_ms = 100
kernel.sched_rt_period_us = 1000000
kernel.sched_rt_runtime_us = 950000
kernel.sched_schedstats = 0
kernel.sched_shares_window_ns = 10000000
kernel.sched_time_avg_ms = 1000
kernel.sched_tunable_scaling = 1
kernel.sched_wakeup_granularity_ns = 2000000
kernel.sem = 250 32000 32 128
kernel.sem_next_id = -1
kernel.shm_next_id = -1
kernel.shm_rmid_forced = 0
kernel.shmall = 18446744073692774399
kernel.shmmax = 18446744073692774399
kernel.shmmni = 4096
kernel.softlockup_all_cpu_backtrace = 0
kernel.softlockup_panic = 0
kernel.stack_tracer_enabled = 0
kernel.sysrq = 16
kernel.tainted = 0
kernel.threads-max = 62405
kernel.timer_migration = 1
kernel.traceoff_on_warning = 0
kernel.unknown_nmi_panic = 1
kernel.usermodehelper.bset = 4294967295 31
kernel.usermodehelper.inheritable = 4294967295 31
kernel.version = #1 SMP Fri Oct 13 10:46:25 EDT 2017
kernel.watchdog = 1
kernel.watchdog_cpumask = 0-1
kernel.watchdog_thresh = 10
kernel.yama.ptrace_scope = 0
net.core.bpf_jit_enable = 0
net.core.busy_poll = 0
net.core.busy_read = 0
net.core.default_qdisc = pfifo_fast
net.core.dev_weight = 64
net.core.message_burst = 10
net.core.message_cost = 5
net.core.netdev_budget = 300
net.core.netdev_max_backlog = 1000
net.core.netdev_rss_key = 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
net.core.netdev_tstamp_prequeue = 1
net.core.optmem_max = 20480
net.core.rmem_default = 212992
net.core.rmem_max = 212992
net.core.rps_sock_flow_entries = 0
net.core.somaxconn = 1024
net.core.warnings = 1
net.core.wmem_default = 212992
net.core.wmem_max = 212992
net.core.xfrm_acq_expires = 30
net.core.xfrm_aevent_etime = 10
net.core.xfrm_aevent_rseqth = 2
net.core.xfrm_larval_drop = 1
net.ipv4.cipso_cache_bucket_size = 10
net.ipv4.cipso_cache_enable = 1
net.ipv4.cipso_rbm_optfmt = 0
net.ipv4.cipso_rbm_strictvalid = 1
net.ipv4.conf.all.accept_local = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.arp_accept = 0
net.ipv4.conf.all.arp_announce = 0
net.ipv4.conf.all.arp_filter = 0
net.ipv4.conf.all.arp_ignore = 0
net.ipv4.conf.all.arp_notify = 0
net.ipv4.conf.all.bootp_relay = 0
net.ipv4.conf.all.disable_policy = 0
net.ipv4.conf.all.disable_xfrm = 0
net.ipv4.conf.all.force_igmp_version = 2
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.all.medium_id = 0
net.ipv4.conf.all.promote_secondaries = 1
net.ipv4.conf.all.proxy_arp = 0
net.ipv4.conf.all.proxy_arp_pvlan = 0
net.ipv4.conf.all.route_localnet = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.shared_media = 1
net.ipv4.conf.all.src_valid_mark = 0
net.ipv4.conf.all.tag = 0
net.ipv4.conf.default.accept_local = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.default.arp_accept = 0
net.ipv4.conf.default.arp_announce = 0
net.ipv4.conf.default.arp_filter = 0
net.ipv4.conf.default.arp_ignore = 0
net.ipv4.conf.default.arp_notify = 0
net.ipv4.conf.default.bootp_relay = 0
net.ipv4.conf.default.disable_policy = 0
net.ipv4.conf.default.disable_xfrm = 0
net.ipv4.conf.default.force_igmp_version = 2
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.default.log_martians = 0
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.default.medium_id = 0
net.ipv4.conf.default.promote_secondaries = 1
net.ipv4.conf.default.proxy_arp = 0
net.ipv4.conf.default.proxy_arp_pvlan = 0
net.ipv4.conf.default.route_localnet = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.secure_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.default.shared_media = 1
net.ipv4.conf.default.src_valid_mark = 0
net.ipv4.conf.default.tag = 0
net.ipv4.conf.eth0.accept_local = 0
net.ipv4.conf.eth0.accept_redirects = 0
net.ipv4.conf.eth0.accept_source_route = 0
net.ipv4.conf.eth0.arp_accept = 0
net.ipv4.conf.eth0.arp_announce = 0
net.ipv4.conf.eth0.arp_filter = 0
net.ipv4.conf.eth0.arp_ignore = 0
net.ipv4.conf.eth0.arp_notify = 0
net.ipv4.conf.eth0.bootp_relay = 0
net.ipv4.conf.eth0.disable_policy = 0
net.ipv4.conf.eth0.disable_xfrm = 0
net.ipv4.conf.eth0.force_igmp_version = 0
net.ipv4.conf.eth0.forwarding = 1
net.ipv4.conf.eth0.log_martians = 0
net.ipv4.conf.eth0.mc_forwarding = 0
net.ipv4.conf.eth0.medium_id = 0
net.ipv4.conf.eth0.promote_secondaries = 1
net.ipv4.conf.eth0.proxy_arp = 0
net.ipv4.conf.eth0.proxy_arp_pvlan = 0
net.ipv4.conf.eth0.route_localnet = 0
net.ipv4.conf.eth0.rp_filter = 1
net.ipv4.conf.eth0.secure_redirects = 0
net.ipv4.conf.eth0.send_redirects = 0
net.ipv4.conf.eth0.shared_media = 1
net.ipv4.conf.eth0.src_valid_mark = 0
net.ipv4.conf.eth0.tag = 0
net.ipv4.conf.eth2.accept_local = 0
net.ipv4.conf.eth2.accept_redirects = 0
net.ipv4.conf.eth2.accept_source_route = 0
net.ipv4.conf.eth2.arp_accept = 0
net.ipv4.conf.eth2.arp_announce = 0
net.ipv4.conf.eth2.arp_filter = 0
net.ipv4.conf.eth2.arp_ignore = 0
net.ipv4.conf.eth2.arp_notify = 0
net.ipv4.conf.eth2.bootp_relay = 0
net.ipv4.conf.eth2.disable_policy = 0
net.ipv4.conf.eth2.disable_xfrm = 0
net.ipv4.conf.eth2.force_igmp_version = 0
net.ipv4.conf.eth2.forwarding = 1
net.ipv4.conf.eth2.log_martians = 0
net.ipv4.conf.eth2.mc_forwarding = 0
net.ipv4.conf.eth2.medium_id = 0
net.ipv4.conf.eth2.promote_secondaries = 1
net.ipv4.conf.eth2.proxy_arp = 0
net.ipv4.conf.eth2.proxy_arp_pvlan = 0
net.ipv4.conf.eth2.route_localnet = 0
net.ipv4.conf.eth2.rp_filter = 1
net.ipv4.conf.eth2.secure_redirects = 0
net.ipv4.conf.eth2.send_redirects = 0
net.ipv4.conf.eth2.shared_media = 1
net.ipv4.conf.eth2.src_valid_mark = 0
net.ipv4.conf.eth2.tag = 0
net.ipv4.conf.lo.accept_local = 0
net.ipv4.conf.lo.accept_redirects = 1
net.ipv4.conf.lo.accept_source_route = 1
net.ipv4.conf.lo.arp_accept = 0
net.ipv4.conf.lo.arp_announce = 0
net.ipv4.conf.lo.arp_filter = 0
net.ipv4.conf.lo.arp_ignore = 0
net.ipv4.conf.lo.arp_notify = 0
net.ipv4.conf.lo.bootp_relay = 0
net.ipv4.conf.lo.disable_policy = 1
net.ipv4.conf.lo.disable_xfrm = 1
net.ipv4.conf.lo.force_igmp_version = 0
net.ipv4.conf.lo.forwarding = 1
net.ipv4.conf.lo.log_martians = 0
net.ipv4.conf.lo.mc_forwarding = 0
net.ipv4.conf.lo.medium_id = 0
net.ipv4.conf.lo.promote_secondaries = 0
net.ipv4.conf.lo.proxy_arp = 0
net.ipv4.conf.lo.proxy_arp_pvlan = 0
net.ipv4.conf.lo.route_localnet = 0
net.ipv4.conf.lo.rp_filter = 0
net.ipv4.conf.lo.secure_redirects = 1
net.ipv4.conf.lo.send_redirects = 1
net.ipv4.conf.lo.shared_media = 1
net.ipv4.conf.lo.src_valid_mark = 0
net.ipv4.conf.lo.tag = 0
net.ipv4.icmp_echo_ignore_all = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_errors_use_inbound_ifaddr = 0
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.icmp_msgs_burst = 50
net.ipv4.icmp_msgs_per_sec = 1000
net.ipv4.icmp_ratelimit = 1000
net.ipv4.icmp_ratemask = 6168
net.ipv4.igmp_max_memberships = 20
net.ipv4.igmp_max_msf = 10
net.ipv4.igmp_qrv = 2
net.ipv4.inet_peer_maxttl = 600
net.ipv4.inet_peer_minttl = 120
net.ipv4.inet_peer_threshold = 65664
net.ipv4.ip_default_ttl = 64
net.ipv4.ip_dynaddr = 0
net.ipv4.ip_early_demux = 1
net.ipv4.ip_forward = 1
net.ipv4.ip_forward_use_pmtu = 0
net.ipv4.ip_local_port_range = 1024 65535
net.ipv4.ip_local_reserved_ports =
net.ipv4.ip_no_pmtu_disc = 0
net.ipv4.ip_nonlocal_bind = 1
net.ipv4.ipfrag_high_thresh = 4194304
net.ipv4.ipfrag_low_thresh = 3145728
net.ipv4.ipfrag_max_dist = 64
net.ipv4.ipfrag_secret_interval = 600
net.ipv4.ipfrag_time = 30
net.ipv4.neigh.default.anycast_delay = 100
net.ipv4.neigh.default.app_solicit = 0
net.ipv4.neigh.default.base_reachable_time_ms = 30000
net.ipv4.neigh.default.delay_first_probe_time = 5
net.ipv4.neigh.default.gc_interval = 30
net.ipv4.neigh.default.gc_stale_time = 60
net.ipv4.neigh.default.gc_thresh1 = 128
net.ipv4.neigh.default.gc_thresh2 = 512
net.ipv4.neigh.default.gc_thresh3 = 1024
net.ipv4.neigh.default.locktime = 100
net.ipv4.neigh.default.mcast_solicit = 3
net.ipv4.neigh.default.proxy_delay = 80
net.ipv4.neigh.default.proxy_qlen = 64
net.ipv4.neigh.default.retrans_time_ms = 1000
net.ipv4.neigh.default.ucast_solicit = 3
net.ipv4.neigh.default.unres_qlen = 31
net.ipv4.neigh.default.unres_qlen_bytes = 65536
net.ipv4.neigh.eth0.anycast_delay = 100
net.ipv4.neigh.eth0.app_solicit = 0
net.ipv4.neigh.eth0.base_reachable_time_ms = 30000
net.ipv4.neigh.eth0.delay_first_probe_time = 5
net.ipv4.neigh.eth0.gc_stale_time = 60
net.ipv4.neigh.eth0.locktime = 100
net.ipv4.neigh.eth0.mcast_solicit = 3
net.ipv4.neigh.eth0.proxy_delay = 80
net.ipv4.neigh.eth0.proxy_qlen = 64
net.ipv4.neigh.eth0.retrans_time_ms = 1000
net.ipv4.neigh.eth0.ucast_solicit = 3
net.ipv4.neigh.eth0.unres_qlen = 31
net.ipv4.neigh.eth0.unres_qlen_bytes = 65536
net.ipv4.neigh.eth1.anycast_delay = 100
net.ipv4.neigh.eth1.app_solicit = 0
net.ipv4.neigh.eth1.base_reachable_time_ms = 30000
net.ipv4.neigh.eth1.delay_first_probe_time = 5
net.ipv4.neigh.eth1.gc_stale_time = 60
net.ipv4.neigh.eth1.locktime = 100
net.ipv4.neigh.eth1.mcast_solicit = 3
net.ipv4.neigh.eth1.proxy_delay = 80
net.ipv4.neigh.eth1.proxy_qlen = 64
net.ipv4.neigh.eth1.retrans_time_ms = 1000
net.ipv4.neigh.eth1.ucast_solicit = 3
net.ipv4.neigh.eth1.unres_qlen = 31
net.ipv4.neigh.eth1.unres_qlen_bytes = 65536
net.ipv4.neigh.eth2.anycast_delay = 100
net.ipv4.neigh.eth2.app_solicit = 0
net.ipv4.neigh.eth2.base_reachable_time_ms = 30000
net.ipv4.neigh.eth2.delay_first_probe_time = 5
net.ipv4.neigh.eth2.gc_stale_time = 60
net.ipv4.neigh.eth2.locktime = 100
net.ipv4.neigh.eth2.mcast_solicit = 3
net.ipv4.neigh.eth2.proxy_delay = 80
net.ipv4.neigh.eth2.proxy_qlen = 64
net.ipv4.neigh.eth2.retrans_time_ms = 1000
net.ipv4.neigh.eth2.ucast_solicit = 3
net.ipv4.neigh.eth2.unres_qlen = 31
net.ipv4.neigh.eth2.unres_qlen_bytes = 65536
net.ipv4.neigh.lo.anycast_delay = 100
net.ipv4.neigh.lo.app_solicit = 0
net.ipv4.neigh.lo.base_reachable_time_ms = 30000
net.ipv4.neigh.lo.delay_first_probe_time = 5
net.ipv4.neigh.lo.gc_stale_time = 60
net.ipv4.neigh.lo.locktime = 100
net.ipv4.neigh.lo.mcast_solicit = 3
net.ipv4.neigh.lo.proxy_delay = 80
net.ipv4.neigh.lo.proxy_qlen = 64
net.ipv4.neigh.lo.retrans_time_ms = 1000
net.ipv4.neigh.lo.ucast_solicit = 3
net.ipv4.neigh.lo.unres_qlen = 31
net.ipv4.neigh.lo.unres_qlen_bytes = 65536
net.ipv4.ping_group_range = 1 0
net.ipv4.route.error_burst = 5000
net.ipv4.route.error_cost = 1000
net.ipv4.route.gc_elasticity = 8
net.ipv4.route.gc_interval = 60
net.ipv4.route.gc_min_interval = 0
net.ipv4.route.gc_min_interval_ms = 500
net.ipv4.route.gc_thresh = -1
net.ipv4.route.gc_timeout = 300
net.ipv4.route.max_size = 2147483647
net.ipv4.route.min_adv_mss = 256
net.ipv4.route.min_pmtu = 552
net.ipv4.route.mtu_expires = 600
net.ipv4.route.redirect_load = 20
net.ipv4.route.redirect_number = 9
net.ipv4.route.redirect_silence = 20480
net.ipv4.tcp_abort_on_overflow = 0
net.ipv4.tcp_adv_win_scale = 1
net.ipv4.tcp_allowed_congestion_control = cubic reno
net.ipv4.tcp_app_win = 31
net.ipv4.tcp_autocorking = 1
net.ipv4.tcp_available_congestion_control = cubic reno
net.ipv4.tcp_base_mss = 1024
net.ipv4.tcp_challenge_ack_limit = 2147483647
net.ipv4.tcp_congestion_control = cubic
net.ipv4.tcp_dsack = 1
net.ipv4.tcp_early_retrans = 3
net.ipv4.tcp_ecn = 2
net.ipv4.tcp_fack = 1
net.ipv4.tcp_fastopen = 0
net.ipv4.tcp_fastopen_key = 00000000-00000000-00000000-00000000
net.ipv4.tcp_fin_timeout = 60
net.ipv4.tcp_frto = 2
net.ipv4.tcp_invalid_ratelimit = 500
net.ipv4.tcp_keepalive_intvl = 75
net.ipv4.tcp_keepalive_probes = 9
net.ipv4.tcp_keepalive_time = 7200
net.ipv4.tcp_limit_output_bytes = 262144
net.ipv4.tcp_low_latency = 0
net.ipv4.tcp_max_orphans = 32768
net.ipv4.tcp_max_ssthresh = 0
net.ipv4.tcp_max_syn_backlog = 1280
net.ipv4.tcp_max_tw_buckets = 32768
net.ipv4.tcp_mem = 185361 247148 370722
net.ipv4.tcp_min_tso_segs = 2
net.ipv4.tcp_moderate_rcvbuf = 1
net.ipv4.tcp_mtu_probing = 2
net.ipv4.tcp_no_metrics_save = 0
net.ipv4.tcp_notsent_lowat = -1
net.ipv4.tcp_orphan_retries = 0
net.ipv4.tcp_reordering = 3
net.ipv4.tcp_retrans_collapse = 1
net.ipv4.tcp_retries1 = 3
net.ipv4.tcp_retries2 = 15
net.ipv4.tcp_rfc1337 = 0
net.ipv4.tcp_rmem = 4096 87380 6291456
net.ipv4.tcp_sack = 1
net.ipv4.tcp_slow_start_after_idle = 0
net.ipv4.tcp_stdurg = 0
net.ipv4.tcp_syn_retries = 6
net.ipv4.tcp_synack_retries = 5
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_thin_dupack = 0
net.ipv4.tcp_thin_linear_timeouts = 0
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_tso_win_divisor = 3
net.ipv4.tcp_tw_recycle = 0
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_wmem = 4096 16384 4194304
net.ipv4.tcp_workaround_signed_windows = 0
net.ipv4.udp_mem = 187218 249624 374436
net.ipv4.udp_rmem_min = 4096
net.ipv4.udp_wmem_min = 4096
net.ipv4.vs.am_droprate = 10
net.ipv4.vs.amemthresh = 1024
net.ipv4.vs.backup_only = 0
net.ipv4.vs.cache_bypass = 0
net.ipv4.vs.conn_reuse_mode = 1
net.ipv4.vs.conntrack = 0
net.ipv4.vs.drop_entry = 0
net.ipv4.vs.drop_packet = 0
net.ipv4.vs.expire_nodest_conn = 0
net.ipv4.vs.expire_quiescent_template = 0
net.ipv4.vs.nat_icmp_send = 0
net.ipv4.vs.pmtu_disc = 1
net.ipv4.vs.secure_tcp = 0
net.ipv4.vs.snat_reroute = 1
net.ipv4.vs.sync_ports = 1
net.ipv4.vs.sync_qlen_max = 61800
net.ipv4.vs.sync_refresh_period = 0
net.ipv4.vs.sync_retries = 0
net.ipv4.vs.sync_sock_size = 0
net.ipv4.vs.sync_threshold = 3 50
net.ipv4.vs.sync_version = 1
net.ipv4.xfrm4_gc_thresh = 32768
net.netfilter.nf_conntrack_acct = 0
net.netfilter.nf_conntrack_buckets = 65536
net.netfilter.nf_conntrack_checksum = 1
net.netfilter.nf_conntrack_count = 7575
net.netfilter.nf_conntrack_dccp_loose = 1
net.netfilter.nf_conntrack_dccp_timeout_closereq = 64
net.netfilter.nf_conntrack_dccp_timeout_closing = 64
net.netfilter.nf_conntrack_dccp_timeout_open = 43200
net.netfilter.nf_conntrack_dccp_timeout_partopen = 480
net.netfilter.nf_conntrack_dccp_timeout_request = 240
net.netfilter.nf_conntrack_dccp_timeout_respond = 480
net.netfilter.nf_conntrack_dccp_timeout_timewait = 240
net.netfilter.nf_conntrack_events = 1
net.netfilter.nf_conntrack_events_retry_timeout = 15
net.netfilter.nf_conntrack_expect_max = 1024
net.netfilter.nf_conntrack_generic_timeout = 600
net.netfilter.nf_conntrack_helper = 1
net.netfilter.nf_conntrack_icmp_timeout = 30
net.netfilter.nf_conntrack_log_invalid = 0
net.netfilter.nf_conntrack_max = 1048576
net.netfilter.nf_conntrack_sctp_timeout_closed = 10
net.netfilter.nf_conntrack_sctp_timeout_cookie_echoed = 3
net.netfilter.nf_conntrack_sctp_timeout_cookie_wait = 3
net.netfilter.nf_conntrack_sctp_timeout_established = 432000
net.netfilter.nf_conntrack_sctp_timeout_heartbeat_acked = 210
net.netfilter.nf_conntrack_sctp_timeout_heartbeat_sent = 30
net.netfilter.nf_conntrack_sctp_timeout_shutdown_ack_sent = 3
net.netfilter.nf_conntrack_sctp_timeout_shutdown_recd = 0
net.netfilter.nf_conntrack_sctp_timeout_shutdown_sent = 0
net.netfilter.nf_conntrack_tcp_be_liberal = 0
net.netfilter.nf_conntrack_tcp_loose = 0
net.netfilter.nf_conntrack_tcp_max_retrans = 3
net.netfilter.nf_conntrack_tcp_timeout_close = 10
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60
net.netfilter.nf_conntrack_tcp_timeout_established = 3600
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120
net.netfilter.nf_conntrack_tcp_timeout_last_ack = 30
net.netfilter.nf_conntrack_tcp_timeout_max_retrans = 300
net.netfilter.nf_conntrack_tcp_timeout_syn_recv = 60
net.netfilter.nf_conntrack_tcp_timeout_syn_sent = 120
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120
net.netfilter.nf_conntrack_tcp_timeout_unacknowledged = 300
net.netfilter.nf_conntrack_timestamp = 0
net.netfilter.nf_conntrack_udp_timeout = 30
net.netfilter.nf_conntrack_udp_timeout_stream = 180
net.netfilter.nf_log.0 = NONE
net.netfilter.nf_log.1 = NONE
net.netfilter.nf_log.2 = nfnetlink_log
net.netfilter.nf_log.3 = NONE
net.netfilter.nf_log.4 = NONE
net.netfilter.nf_log.5 = NONE
net.netfilter.nf_log.6 = NONE
net.netfilter.nf_log.7 = NONE
net.netfilter.nf_log.8 = NONE
net.netfilter.nf_log.9 = NONE
net.nf_conntrack_max = 1048576
net.unix.max_dgram_qlen = 512
sunrpc.max_resvport = 1023
sunrpc.min_resvport = 665
sunrpc.nfs_debug = 0x0000
sunrpc.nfsd_debug = 0x0000
sunrpc.nlm_debug = 0x0000
sunrpc.rpc_debug = 0x0000
sunrpc.tcp_fin_timeout = 15
sunrpc.tcp_max_slot_table_entries = 65536
sunrpc.tcp_slot_table_entries = 2
sunrpc.transports = tcp 1048576
sunrpc.transports = udp 32768
sunrpc.transports = tcp-bc 1048576
sunrpc.udp_slot_table_entries = 16
user.max_ipc_namespaces = 31202
user.max_mnt_namespaces = 31202
user.max_net_namespaces = 31202
user.max_pid_namespaces = 31202
user.max_user_namespaces = 0
user.max_uts_namespaces = 31202
vm.admin_reserve_kbytes = 8192
vm.block_dump = 0
vm.dirty_background_bytes = 0
vm.dirty_background_ratio = 10
vm.dirty_bytes = 0
vm.dirty_expire_centisecs = 3000
vm.dirty_ratio = 20
vm.dirty_writeback_centisecs = 500
vm.drop_caches = 0
vm.extfrag_threshold = 500
vm.hugepages_treat_as_movable = 0
vm.hugetlb_shm_group = 0
vm.laptop_mode = 0
vm.legacy_va_layout = 0
vm.lowmem_reserve_ratio = 256 256 32
vm.max_map_count = 65530
vm.memory_failure_early_kill = 0
vm.memory_failure_recovery = 1
vm.min_free_kbytes = 67584
vm.min_slab_ratio = 5
vm.min_unmapped_ratio = 1
vm.mmap_min_addr = 4096
vm.mmap_rnd_bits = 28
vm.mmap_rnd_compat_bits = 8
vm.nr_hugepages = 0
vm.nr_hugepages_mempolicy = 0
vm.nr_overcommit_hugepages = 0
vm.nr_pdflush_threads = 0
vm.numa_zonelist_order = default
vm.oom_dump_tasks = 1
vm.oom_kill_allocating_task = 0
vm.overcommit_kbytes = 0
vm.overcommit_memory = 0
vm.overcommit_ratio = 50
vm.page-cluster = 3
vm.panic_on_oom = 0
vm.percpu_pagelist_fraction = 0
vm.stat_interval = 1
vm.swappiness = 60
vm.user_reserve_kbytes = 131072
vm.vfs_cache_pressure = 100
vm.zone_reclaim_mode = 0

hostnamectl

Icon name: computer-vm
Chassis: vm
Virtualization: vmware
Operating System: Red Hat Enterprise Linux Server 7.5 (Maipo)
CPE OS Name: cpe:/o:redhat:enterprise_linux:7.5:GA:server
Kernel: Linux 3.10.0-862.11.6.el7.x86_64
Architecture: x86-64

Retransmissions

β€œNo.”,β€œTime”,β€œSource”,β€œDestination”,β€œDelta”,β€œProtocol”,β€œLength”,β€œSeq”,β€œNext seq”,β€œack”,β€œMSS Value”,β€œInfo”
β€œ1”,β€œ0.000000”,β€œ1.2.3.4”,β€œ50.1.1.3”,β€œ0.000000”,β€œTCP”,β€œ76”,β€œ0”,β€œ0”,β€œ0”,β€œ1420”,β€œ40935 > 1234 [SYN] Seq=0 Win=65535 Len=0 MSS=1420 SACK_PERM=1 WS=256”
β€œ2”,β€œ0.000021”,β€œ50.1.1.3”,β€œ1.2.3.4”,β€œ0.000021”,β€œTCP”,β€œ76”,β€œ0”,β€œ0”,β€œ1”,β€œ1460”,β€œ1234 > 40935 [SYN, ACK] Seq=0 Ack=1 Win=28960 Len=0 MSS=1460 SACK_PERM=1 WS=128”
β€œ3”,β€œ0.040704”,β€œ1.2.3.4”,β€œ50.1.1.3”,β€œ0.040683”,β€œTCP”,β€œ68”,β€œ1”,β€œ1”,β€œ1”,"",β€œ40935 > 1234 [ACK] Seq=1 Ack=1 Win=85248 Len=0”
β€œ4”,β€œ0.040825”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ0.000121”,β€œTCP”,β€œ76”,β€œ0”,β€œ0”,β€œ0”,β€œ1460”,β€œ16712 > 1234 [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 WS=128”
β€œ5”,β€œ0.040881”,β€œ172.1.2.10”,β€œ172.1.2.6”,β€œ0.000056”,β€œTCP”,β€œ76”,β€œ0”,β€œ0”,β€œ1”,β€œ1460”,β€œ1234 > 16712 [SYN, ACK] Seq=0 Ack=1 Win=28960 Len=0 MSS=1460 SACK_PERM=1 WS=128”
β€œ6”,β€œ0.040894”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ0.000013”,β€œTCP”,β€œ68”,β€œ1”,β€œ1”,β€œ1”,"",β€œ16712 > 1234 [ACK] Seq=1 Ack=1 Win=29312 Len=0”
β€œ7”,β€œ0.043899”,β€œ1.2.3.4”,β€œ50.1.1.3”,β€œ0.003005”,β€œTLSv1.2”,β€œ276”,β€œ1”,β€œ209”,β€œ1”,"",β€œClient Hello”
β€œ8”,β€œ0.043914”,β€œ50.1.1.3”,β€œ1.2.3.4”,β€œ0.000015”,β€œTCP”,β€œ68”,β€œ1”,β€œ1”,β€œ209”,"",β€œ1234 > 40935 [ACK] Seq=1 Ack=209 Win=30080 Len=0”
β€œ9”,β€œ0.043967”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ0.000053”,β€œTLSv1.2”,β€œ276”,β€œ1”,β€œ209”,β€œ1”,"",β€œClient Hello”
β€œ10”,β€œ0.044020”,β€œ172.1.2.10”,β€œ172.1.2.6”,β€œ0.000053”,β€œTCP”,β€œ68”,β€œ1”,β€œ1”,β€œ209”,"",β€œ1234 > 16712 [ACK] Seq=1 Ack=209 Win=30080 Len=0”
β€œ11”,β€œ0.044497”,β€œ172.1.2.10”,β€œ172.1.2.6”,β€œ0.000477”,β€œTLSv1.2”,β€œ154”,β€œ1”,β€œ87”,β€œ209”,"",β€œServer Hello”
β€œ12”,β€œ0.044506”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ0.000009”,β€œTCP”,β€œ68”,β€œ209”,β€œ209”,β€œ87”,"",β€œ16712 > 1234 [ACK] Seq=209 Ack=87 Win=29312 Len=0”
β€œ13”,β€œ0.044532”,β€œ50.1.1.3”,β€œ1.2.3.4”,β€œ0.000026”,β€œTLSv1.2”,β€œ154”,β€œ1”,β€œ87”,β€œ209”,"",β€œServer Hello”
β€œ14”,β€œ0.044541”,β€œ172.1.2.10”,β€œ172.1.2.6”,β€œ0.000009”,β€œTLSv1.2”,β€œ119”,β€œ87”,β€œ138”,β€œ209”,"",β€œChange Cipher Spec, Encrypted Handshake Message”
β€œ15”,β€œ0.044545”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ0.000004”,β€œTCP”,β€œ68”,β€œ209”,β€œ209”,β€œ138”,"",β€œ16712 > 1234 [ACK] Seq=209 Ack=138 Win=29312 Len=0”
β€œ16”,β€œ0.044561”,β€œ50.1.1.3”,β€œ1.2.3.4”,β€œ0.000016”,β€œTLSv1.2”,β€œ119”,β€œ87”,β€œ138”,β€œ209”,"",β€œChange Cipher Spec, Encrypted Handshake Message”
β€œ17”,β€œ0.072641”,β€œ1.2.3.4”,β€œ50.1.1.3”,β€œ0.028080”,β€œTCP”,β€œ68”,β€œ209”,β€œ209”,β€œ87”,"",β€œ40935 > 1234 [ACK] Seq=209 Ack=87 Win=85248 Len=0”
β€œ18”,β€œ0.080670”,β€œ1.2.3.4”,β€œ50.1.1.3”,β€œ0.008029”,β€œTCP”,β€œ68”,β€œ209”,β€œ209”,β€œ138”,"",β€œ40935 > 1234 [ACK] Seq=209 Ack=138 Win=85248 Len=0”
β€œ19”,β€œ0.080893”,β€œ1.2.3.4”,β€œ50.1.1.3”,β€œ0.000223”,β€œTLSv1.2”,β€œ119”,β€œ209”,β€œ260”,β€œ138”,"",β€œChange Cipher Spec, Encrypted Handshake Message”
β€œ20”,β€œ0.080941”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ0.000048”,β€œTLSv1.2”,β€œ119”,β€œ209”,β€œ260”,β€œ138”,"",β€œChange Cipher Spec, Encrypted Handshake Message”
β€œ21”,β€œ0.091404”,β€œ1.2.3.4”,β€œ50.1.1.3”,β€œ0.010463”,β€œTCP”,β€œ1476”,β€œ260”,β€œ1668”,β€œ138”,"",β€œ40935 > 1234 [ACK] Seq=260 Ack=138 Win=85248 Len=1408 [TCP segment of a reassembled PDU]”
β€œ22”,β€œ0.091417”,β€œ50.1.1.3”,β€œ1.2.3.4”,β€œ0.000013”,β€œTCP”,β€œ68”,β€œ138”,β€œ138”,β€œ1668”,"",β€œ1234 > 40935 [ACK] Seq=138 Ack=1668 Win=33024 Len=0”
β€œ23”,β€œ0.091475”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ0.000058”,β€œTCP”,β€œ1476”,β€œ260”,β€œ1668”,β€œ138”,"",β€œ16712 > 1234 [PSH, ACK] Seq=260 Ack=138 Win=29312 Len=1408 [TCP segment of a reassembled PDU]”
β€œ24”,β€œ0.091565”,β€œ172.1.2.10”,β€œ172.1.2.6”,β€œ0.000090”,β€œTCP”,β€œ68”,β€œ138”,β€œ138”,β€œ1668”,"",β€œ1234 > 16712 [ACK] Seq=138 Ack=1668 Win=33024 Len=0”
β€œ25”,β€œ0.131937”,β€œ1.2.3.4”,β€œ50.1.1.3”,β€œ0.040372”,β€œTLSv1.2”,β€œ332”,β€œ1668”,β€œ1932”,β€œ138”,"",β€œApplication Data”
β€œ26”,β€œ0.131964”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ0.000027”,β€œTLSv1.2”,β€œ332”,β€œ1668”,β€œ1932”,β€œ138”,"",β€œApplication Data”
β€œ27”,β€œ0.136742”,β€œ172.1.2.10”,β€œ172.1.2.6”,β€œ0.004778”,β€œTLSv1.2”,β€œ297”,β€œ138”,β€œ367”,β€œ1932”,"",β€œApplication Data”
β€œ28”,β€œ0.136765”,β€œ50.1.1.3”,β€œ1.2.3.4”,β€œ0.000023”,β€œTLSv1.2”,β€œ297”,β€œ138”,β€œ367”,β€œ1932”,"",β€œApplication Data”
β€œ29”,β€œ0.176645”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ0.039880”,β€œTCP”,β€œ68”,β€œ1932”,β€œ1932”,β€œ367”,"",β€œ16712 > 1234 [ACK] Seq=1932 Ack=367 Win=30336 Len=0”
β€œ30”,β€œ0.212685”,β€œ1.2.3.4”,β€œ50.1.1.3”,β€œ0.036040”,β€œTCP”,β€œ68”,β€œ1932”,β€œ1932”,β€œ367”,"",β€œ40935 > 1234 [ACK] Seq=1932 Ack=367 Win=86272 Len=0”
β€œ31”,β€œ200.137180”,β€œ172.1.2.10”,β€œ172.1.2.6”,β€œ199.924495”,β€œTLSv1.2”,β€œ99”,β€œ367”,β€œ398”,β€œ1932”,"",β€œEncrypted Alert”
β€œ32”,β€œ200.137196”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ0.000016”,β€œTCP”,β€œ68”,β€œ1932”,β€œ1932”,β€œ398”,"",β€œ16712 > 1234 [ACK] Seq=1932 Ack=398 Win=30336 Len=0”
β€œ33”,β€œ200.137214”,β€œ172.1.2.10”,β€œ172.1.2.6”,β€œ0.000018”,β€œTCP”,β€œ68”,β€œ398”,β€œ398”,β€œ1932”,"",β€œ1234 > 16712 [FIN, ACK] Seq=398 Ack=1932 Win=35840 Len=0”
β€œ34”,β€œ200.137233”,β€œ50.1.1.3”,β€œ1.2.3.4”,β€œ0.000019”,β€œTLSv1.2”,β€œ99”,β€œ367”,β€œ398”,β€œ1932”,"",β€œEncrypted Alert”
β€œ35”,β€œ200.137292”,β€œ50.1.1.3”,β€œ1.2.3.4”,β€œ0.000059”,β€œTCP”,β€œ68”,β€œ398”,β€œ398”,β€œ1932”,"",β€œ1234 > 40935 [FIN, ACK] Seq=398 Ack=1932 Win=35840 Len=0”
β€œ36”,β€œ200.168647”,β€œ1.2.3.4”,β€œ50.1.1.3”,β€œ0.031355”,β€œTCP”,β€œ68”,β€œ1932”,β€œ1932”,β€œ398”,"",β€œ40935 > 1234 [ACK] Seq=1932 Ack=398 Win=86272 Len=0”
β€œ37”,β€œ200.176660”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ0.008013”,β€œTCP”,β€œ68”,β€œ1932”,β€œ1932”,β€œ399”,"",β€œ16712 > 1234 [ACK] Seq=1932 Ack=399 Win=30336 Len=0”
β€œ38”,β€œ200.198702”,β€œ1.2.3.4”,β€œ50.1.1.3”,β€œ0.022042”,β€œTCP”,β€œ68”,β€œ1932”,β€œ1932”,β€œ399”,"",β€œ40935 > 1234 [ACK] Seq=1932 Ack=399 Win=86272 Len=0”
β€œ39”,β€œ300.204869”,β€œ1.2.3.4”,β€œ50.1.1.3”,β€œ100.006167”,β€œTLSv1.2”,β€œ99”,β€œ1932”,β€œ1963”,β€œ399”,"",β€œEncrypted Alert”
β€œ40”,β€œ300.204896”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ0.000027”,β€œTLSv1.2”,β€œ99”,β€œ1932”,β€œ1963”,β€œ399”,"",β€œEncrypted Alert”
β€œ41”,β€œ300.207748”,β€œ1.2.3.4”,β€œ50.1.1.3”,β€œ0.002852”,β€œTCP”,β€œ68”,β€œ1963”,β€œ1963”,β€œ399”,"",β€œ40935 > 1234 [RST, ACK] Seq=1963 Ack=399 Win=86272 Len=0”
β€œ42”,β€œ300.207785”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ0.000037”,β€œTCP”,β€œ68”,β€œ1963”,β€œ1963”,β€œ399”,"",β€œ16712 > 1234 [FIN, ACK] Seq=1963 Ack=399 Win=30336 Len=0”
β€œ43”,β€œ300.207837”,β€œ172.1.2.10”,β€œ172.1.2.6”,β€œ0.000052”,β€œTCP”,β€œ68”,β€œ399”,β€œ399”,β€œ1964”,"",β€œ1234 > 16712 [ACK] Seq=399 Ack=1964 Win=35712 Len=0”
β€œ44”,β€œ300.217641”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ0.009804”,β€œTCP”,β€œ68”,β€œ1963”,β€œ1963”,β€œ399”,"","[TCP Retransmission] 16712 > 1234 [FIN, ACK] Seq=1963 Ack=399 Win=30336 Len=0"
β€œ45”,β€œ300.217690”,β€œ172.1.2.10”,β€œ172.1.2.6”,β€œ0.000049”,β€œTCP”,β€œ68”,β€œ399”,β€œ399”,β€œ1964”,"","[TCP Dup ACK 43#1] 1234 > 16712 [ACK] Seq=399 Ack=1964 Win=35712 Len=0"
β€œ46”,β€œ300.419643”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ0.201953”,β€œTLSv1.2”,β€œ99”,β€œ1932”,β€œ1964”,β€œ399”,"","[TCP Spurious Retransmission] , Encrypted Alert"
β€œ47”,β€œ300.419704”,β€œ172.1.2.10”,β€œ172.1.2.6”,β€œ0.000061”,β€œTCP”,β€œ68”,β€œ399”,β€œ399”,β€œ1964”,"","[TCP Dup ACK 43#2] 1234 > 16712 [ACK] Seq=399 Ack=1964 Win=35712 Len=0"
β€œ48”,β€œ300.824654”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ0.404950”,β€œTLSv1.2”,β€œ99”,β€œ1932”,β€œ1964”,β€œ399”,"","[TCP Spurious Retransmission] , Encrypted Alert"
β€œ49”,β€œ300.824709”,β€œ172.1.2.10”,β€œ172.1.2.6”,β€œ0.000055”,β€œTCP”,β€œ68”,β€œ399”,β€œ399”,β€œ1964”,"","[TCP Dup ACK 43#3] 1234 > 16712 [ACK] Seq=399 Ack=1964 Win=35712 Len=0"
β€œ50”,β€œ301.633648”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ0.808939”,β€œTLSv1.2”,β€œ99”,β€œ1932”,β€œ1964”,β€œ399”,"","[TCP Spurious Retransmission] , Encrypted Alert"
β€œ51”,β€œ301.633705”,β€œ172.1.2.10”,β€œ172.1.2.6”,β€œ0.000057”,β€œTCP”,β€œ68”,β€œ399”,β€œ399”,β€œ1964”,"","[TCP Dup ACK 43#4] 1234 > 16712 [ACK] Seq=399 Ack=1964 Win=35712 Len=0"
β€œ52”,β€œ303.253642”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ1.619937”,β€œTLSv1.2”,β€œ99”,β€œ1932”,β€œ1964”,β€œ399”,"","[TCP Spurious Retransmission] , Encrypted Alert"
β€œ53”,β€œ303.253698”,β€œ172.1.2.10”,β€œ172.1.2.6”,β€œ0.000056”,β€œTCP”,β€œ68”,β€œ399”,β€œ399”,β€œ1964”,"","[TCP Dup ACK 43#5] 1234 > 16712 [ACK] Seq=399 Ack=1964 Win=35712 Len=0"
β€œ54”,β€œ306.493641”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ3.239943”,β€œTLSv1.2”,β€œ99”,β€œ1932”,β€œ1964”,β€œ399”,"","[TCP Spurious Retransmission] , Encrypted Alert"
β€œ55”,β€œ306.493694”,β€œ172.1.2.10”,β€œ172.1.2.6”,β€œ0.000053”,β€œTCP”,β€œ68”,β€œ399”,β€œ399”,β€œ1964”,"","[TCP Dup ACK 43#6] 1234 > 16712 [ACK] Seq=399 Ack=1964 Win=35712 Len=0"
β€œ56”,β€œ312.965655”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ6.471961”,β€œTLSv1.2”,β€œ99”,β€œ1932”,β€œ1964”,β€œ399”,"","[TCP Spurious Retransmission] , Encrypted Alert"
β€œ57”,β€œ312.965775”,β€œ172.1.2.10”,β€œ172.1.2.6”,β€œ0.000120”,β€œTCP”,β€œ68”,β€œ399”,β€œ399”,β€œ1964”,"","[TCP Dup ACK 43#7] 1234 > 16712 [ACK] Seq=399 Ack=1964 Win=35712 Len=0"
β€œ58”,β€œ325.925671”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ12.959896”,β€œTLSv1.2”,β€œ99”,β€œ1932”,β€œ1964”,β€œ399”,"","[TCP Spurious Retransmission] , Encrypted Alert"
β€œ59”,β€œ325.925726”,β€œ172.1.2.10”,β€œ172.1.2.6”,β€œ0.000055”,β€œTCP”,β€œ68”,β€œ399”,β€œ399”,β€œ1964”,"","[TCP Dup ACK 43#8] 1234 > 16712 [ACK] Seq=399 Ack=1964 Win=35712 Len=0"
β€œ60”,β€œ351.845660”,β€œ172.1.2.6”,β€œ172.1.2.10”,β€œ25.919934”,β€œTLSv1.2”,β€œ99”,β€œ1932”,β€œ1964”,β€œ399”,"","[TCP Spurious Retransmission] , Encrypted Alert"
β€œ61”,β€œ351.845697”,β€œ172.1.2.10”,β€œ172.1.2.6”,β€œ0.000037”,β€œTCP”,β€œ68”,β€œ399”,β€œ399”,β€œ1964”,"","[TCP Dup ACK 43#9] 1234 > 16712 [ACK] Seq=399 Ack=1964 Win=35712 Len=0"

after haproxy got RST form the client (frame 41)
connection between client and haproxy seems to be closd
after haproxy sends FIN,ACK to the server ( frame 42 )
and gets ACK from the server ( frame 43 )

But starting from β€œframe 44” haproxy starts to send retransmissions of FIN,ACK like it never got ACK from the server. It seems like ACK had been arrived to the interface but never arrived to the process. or I am missing some important config line or I it is a bug?
Help me to understand the nature of those retransmissions.


#2

The kernel handles everything TCP related, not haproxy.

Can you share an actual pcap file?


#3

Correct, my assumption is that ACK I see in the network capture received by the kernel but never reach haproxy or there some logic in haproxy that ignores that ACK…
Right now I can’t really share pcap file… Need to work on it to hide ips


#4

What I am saying is that ACKs or FIN’s are never delivered to an application like haproxy. That’s the kernel jobs to handle them. The interface between kernel and haproxy is the socket API, it’s not a TCP stack.

The application can influence TCP behavior a little, but for the most part the kernel handles it on it’s own.


#5

Understand, thanks for clarification.

What are the possible reasons for kernel to send retransmissions after it got ACK? I checked pcap and all retrnasmissions have different identifier so it is not a loop on a vswitch


#6

The proxy instance continues to send 31 bytes of TLS encrypted alert towards that backend, which is already correctly acknowledged. Wireshark shows this as Spurious Retransmission which is correct.

I think your local firewall may be dropping the TCP ACK signal because of the close_wait timeout.

Can you bump net.netfilter.nf_conntrack_tcp_timeout_close_wait from 60 to something way beyond 100, actually make it 300 just for testing.


#7

Thanks, seems like it resolved retranmission problem. setting it to 110 was enough


#8

With this particular client, that closed his side of the connection after 100 seconds. Another client may keep the TLS sessions open longer.

I’d suggest you don’t firewall your internal network between haproxy and the backend servers.


#9

I can’t disable iptables completely as it is used to filter incoming traffic on public interface and also used to set DSCP bits on some packets.
Is there any way to disable netfilter, connection tracking on private network only? I need to study this.


#10

I guess you’d disable connection-tracking and accept all traffic on that specific interface in both the input and output chain, something like:

iptables -I INPUT 1 -i safeeth -j NOTRACK
iptables -I INPUT 2 -i safeeth -j ACCEPT
iptables -I OUTPUT 1 -i safeeth -j NOTRACK
iptables -I OUTPUT 2 -i safeeth -j ACCEPT

But make sure you properly understand what this does and test it (including rollback, box reboot, etc).


#11

Thanks, I think I can test this, I will also test it with default net.netfilter.nf_conntrack_tcp_timeout_close_wait 60
Seems like disabling tracking on private network will be safer than tuning conntrack parameters.