fast opening and closing connection with a specific port

Posted by michale on Server Fault See other posts from Server Fault or by michale
Published on 2012-03-19T16:39:06Z Indexed on 2012/03/19 18:07 UTC
Read the original article Hit count: 305

Filed under:

port

|

tcp

|

netstat

We have a Main application named "Trevor" installed in 2008R2 machine named "TEAMER12" which is slow now. One more application named "TVS" also running in and found there were many connections per second occurring to port 5009. netstat tool mentions that some fast connection open/close seen for port 5009 So first it will be listening mode like shown below

TCP    0.0.0.0:5009           TEAMER12:0        LISTENING

then establishes connection like

TCP    127.0.0.1:5009         TEAMER12:49519    ESTABLISHED
TCP    127.0.0.1:5009         TEAMER12:60903    ESTABLISHED

After that iwill become TIME_WAIT and i could see several entries like shown below

TCP 127.0.0.1:49156 TEAMER12:5009 TIME_WAIT

after that it will establish connection like

TCP    127.0.0.1:60903        TEAMER12:5009     ESTABLISHED
TCP    127.0.0.1:64181        TEAMER12:microsoft-ds  ESTABLISHED

again it will go several entries like TIME_WAIT TCP 127.0.0.1:49156 TEAMER12:5009 TIME_WAIT

Finally it will establish like this

TCP    172.26.127.40:139      TEAMER12:0        LISTENING
  TCP    172.26.127.42:139      TEAMER12:0        LISTENING
TCP    172.26.127.42:5009     TEAMER12:64445    ESTABLISHED
TCP    172.26.127.42:64445    TEAMER12:5009     ESTABLISHED

Can any body tell me whats the reason behind why many connections per second occurring to port 5009 and why application slow?

© Server Fault or respective owner

Related posts about port

Port forward to different port number

as seen on Super User - Search for 'Super User'
I have a router that sets up rules like so: TCP Any -> 5800 Any -> 5900 UDP Any -> 5800 Any -> 5900 Computer: ip-address This would allow someone 'outside' to connect to my router's port 5800 and 5900 and forward that to the same port on my computer. My issue is that I want the 'outside'… >>> More
"port forwarding": redirect calls to webservice at port 8081 to port 80

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, a colleague of mine wrote a webservice that runs on port 8081 of our Windows 2008 Server. He uses the class ServiceHost, afaik this means its a standalone host (no IIS or ASP involvement). Note: I'm new into WCF ;) Now there are some issues with clients behind a firewall blocking the requests… >>> More
Problem with hadoop start-dfs.sh

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I installed and configured hadoop on my Ubuntu 14.04 server, virtualized inside of hyper-v, however I am getting an issue when i run start-dfs.sh root@sUbuntu01:/var/log# start-dfs.sh 14/06/04 15:27:08 WARN util.NativeCodeLoader: Unable to load native-hadoop library for your platform... using builtin-java… >>> More
USB Hub and Ubuntu

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I have a powered 7 port hub connected to my Ubuntu box and it does nothing. The devices (zip drive and web cam) work direct, but aren't recognized through the hub. This worked fine in Windows 7. I can't prove it is the OS because this is a new motherboard and processor. Any advice? EDIT : Output… >>> More
Cannot change port 25 to port 587

as seen on Super User - Search for 'Super User'
I am using outlook 2003. My email provider is Cox. Trying to change my out going port to 587 so I send mail while traveling. Others I know on Cox have done this with succes, but they are using newer version of outlook. When I go to change my existing email accounts, outlook will not allow me to… >>> More

Related posts about tcp

TCP RST Reset Every 5 Minutes on Windows 2003 sp2

as seen on Server Fault - Search for 'Server Fault'
Hey, Recently I had a web developer come to me and ask why he was receiving connection errors in his app that was accessing a sql database. So, I went through my normal trouble shooting steps to isolate or reproduce the issue. I discovered that if I connected to the database using Query Analyzer… >>> More
iptables issue on plesk

as seen on Server Fault - Search for 'Server Fault'
i don't know how to open a specific port (rtmp=1935) on my CentOS server using Plesk or itables. I created new rules for port 1935 i/o using Plesk/Modules/Firewall but this doesn't work. Nmap scanning tells me this : 1935/tcp filtered rtmp . So i decided to have look at my iptable using SSH (iptables… >>> More
Httpd problem, suspect an attack but not sure

as seen on Server Fault - Search for 'Server Fault'
On one of my servers when I type netstat -n I get a huge output, something like 400 entries for httpd. The bandwidth on the server isn't high, so I'm confused as to what's causing it. I'm suspecting an attack, but not sure. Intermittently, the web server will stop responding. When this happens… >>> More
Why can blocked IPs get through my iptables? What's wrong with this configuration?

as seen on Server Fault - Search for 'Server Fault'
(Why can/How are) blocked IPs (get/getting) through my iptables? Hello and thanks for your consideration... I have configured iptables and included (below) output from the command "iptables --line-numbers -n -L" yet IP addresses (like 31.41.219.180) from IP blocks I have already blocked are getting… >>> More
iptables syn flood countermeasure

as seen on Server Fault - Search for 'Server Fault'
I'm trying to adjust my iptables firewall to increase the security of my server, and I found something a bit problematic here : I have to set INPUT policy to ACCEPT and, in addition, to have a rule saying iptables -I INPUT -i eth0 -j ACCEPT. Here comes my script (launched manually for tests) : #… >>> More