From: "Massimo S." Received: from [192.168.100.201] (HELO mail.2rosenthals.com) by 2rosenthals.com (CommuniGate Pro SMTP 5.4.10) with ESMTP id 13712172 for ecs-isp@2rosenthals.com; Tue, 29 Jul 2025 13:46:10 -0400 Received: from [192.168.200.201] (port=53046 helo=mail2.2rosenthals.com) by mail.2rosenthals.com with esmtp (Exim 4.97.1) (envelope-from ) id 1ugoOm-000000006Cf-1YMc for ecs-isp@2rosenthals.com; Tue, 29 Jul 2025 13:46:00 -0400 Received: from mail2.quasarbbs.net ([80.86.52.115]:10039) by mail2.2rosenthals.com with esmtp (Exim 4.97.1) (envelope-from ) id 1ugoOa-000000000jG-0o1e for ecs-isp@2rosenthals.com; Tue, 29 Jul 2025 13:45:48 -0400 X-SASI-Hits: BODYTEXTP_SIZE_3000_LESS 0.000000, BODY_SIZE_1500_1599 0.000000, BODY_SIZE_2000_LESS 0.000000, BODY_SIZE_5000_LESS 0.000000, BODY_SIZE_7000_LESS 0.000000, CTE_8BIT 0.000000, DKIM_ALIGNS 0.000000, DKIM_SIGNATURE 0.000000, HTML_00_01 0.050000, HTML_00_10 0.050000, IN_REP_TO 0.000000, LEGITIMATE_SIGNS 0.000000, MSGID_SAMEAS_FROM_HEX_844412 0.100000, MSG_THREAD 0.000000, NO_CTA_URI_FOUND 0.000000, NO_URI_HTTPS 0.000000, REFERENCES 0.000000, REPLYTO_SAMEAS_FROM 0.000000, SENDER_NO_AUTH 0.000000, SUSP_DH_NEG 0.000000, TO_IN_SUBJECT 0.500000, USER_AGENT 0.000000, __ANY_URI 0.000000, __BODY_NO_MAILTO 0.000000, __BOUNCE_CHALLENGE_SUBJ 0.000000, __BOUNCE_NDR_SUBJ_EXEMPT 0.000000, __COURIER_PHRASE 0.000000, __CT 0.000000, __CTE 0.000000, __CT_TEXT_PLAIN 0.000000, __DKIM_ALIGNS_1 0.000000, __DKIM_ALIGNS_2 0.000000, __DQ_NEG_DOMAIN 0.000000, __DQ_NEG_HEUR 0.000000, __DQ_NEG_IP 0.000000, __FORWARDED_MSG 0.000000, __FROM_DOMAIN_NOT_IN_BODY 0.000000, __FROM_NAME_NOT_IN_ADDR 0.000000, __FROM_NAME_NOT_IN_BODY 0.000000, __FUR_HEADER 0.000000, __HAS_FROM 0.000000, __HAS_MSGID 0.000000, __HAS_REFERENCES 0.000000, __HAS_REPLYTO 0.000000, __HEADER_ORDER_FROM 0.000000, __IN_REP_TO 0.000000, __IOC_PHRASE 0.000000, __MAIL_CHAIN 0.000000, __MIME_BOUND_CHARSET 0.000000, __MIME_TEXT_ONLY 0.000000, __MIME_TEXT_P 0.000000, __MIME_TEXT_P1 0.000000, __MIME_VERSION 0.000000, __MOZILLA_USER_AGENT 0.000000, __MSGID_HEX_844412 0.000000, __NO_HTML_TAG_RAW 0.000000, __REFERENCES 0.000000, __REPLYTO_SAMEAS_FROM_ACC 0.000000, __REPLYTO_SAMEAS_FROM_ADDY 0.000000, __REPLYTO_SAMEAS_FROM_DOMAIN 0.000000, __SANE_MSGID 0.000000, __SCAN_D_NEG 0.000000, __SCAN_D_NEG2 0.000000, __SCAN_D_NEG_HEUR 0.000000, __SCAN_D_NEG_HEUR2 0.000000, __SUBJ_ALPHA_END 0.000000, __SUBJ_ALPHA_NEGATE 0.000000, __SUBJ_REPLY 0.000000, __TO_IN_SUBJECT 0.000000, __TO_MALFORMED_2 0.000000, __TO_NAME 0.000000, __TO_NAME_DIFF_FROM_ACC 0.000000, __TO_REAL_NAMES 0.000000, __URI_MAILTO 0.000000, __URI_NO_WWW 0.000000, __URI_NS 0.000000, __USER_AGENT 0.000000 X-SASI-Probability: 10% X-SASI-RCODE: 200 X-SASI-Version: Antispam-Engine: 5.1.4, AntispamData: 2025.7.29.165719 X-SASI-Hits: BODYTEXTP_SIZE_3000_LESS 0.000000, BODY_SIZE_1500_1599 0.000000, BODY_SIZE_2000_LESS 0.000000, BODY_SIZE_5000_LESS 0.000000, BODY_SIZE_7000_LESS 0.000000, CTE_8BIT 0.000000, DKIM_ALIGNS 0.000000, DKIM_SIGNATURE 0.000000, HTML_00_01 0.050000, HTML_00_10 0.050000, IN_REP_TO 0.000000, LEGITIMATE_SIGNS 0.000000, MSGID_SAMEAS_FROM_HEX_844412 0.100000, MSG_THREAD 0.000000, NO_CTA_URI_FOUND 0.000000, NO_URI_HTTPS 0.000000, REFERENCES 0.000000, REPLYTO_SAMEAS_FROM 0.000000, SUSP_DH_NEG 0.000000, TO_IN_SUBJECT 0.500000, USER_AGENT 0.000000, __ANY_URI 0.000000, __AUTH_RES_PASS 0.000000, __BODY_NO_MAILTO 0.000000, __BOUNCE_CHALLENGE_SUBJ 0.000000, __BOUNCE_NDR_SUBJ_EXEMPT 0.000000, __COURIER_PHRASE 0.000000, __CT 0.000000, __CTE 0.000000, __CT_TEXT_PLAIN 0.000000, __DKIM_ALIGNS_1 0.000000, __DKIM_ALIGNS_2 0.000000, __DQ_NEG_DOMAIN 0.000000, __DQ_NEG_HEUR 0.000000, __DQ_NEG_IP 0.000000, __FORWARDED_MSG 0.000000, __FROM_DOMAIN_NOT_IN_BODY 0.000000, __FROM_NAME_NOT_IN_ADDR 0.000000, __FROM_NAME_NOT_IN_BODY 0.000000, __FUR_HEADER 0.000000, __HAS_FROM 0.000000, __HAS_MSGID 0.000000, __HAS_REFERENCES 0.000000, __HAS_REPLYTO 0.000000, __HEADER_ORDER_FROM 0.000000, __IN_REP_TO 0.000000, __IOC_PHRASE 0.000000, __MAIL_CHAIN 0.000000, __MIME_BOUND_CHARSET 0.000000, __MIME_TEXT_ONLY 0.000000, __MIME_TEXT_P 0.000000, __MIME_TEXT_P1 0.000000, __MIME_VERSION 0.000000, __MOZILLA_USER_AGENT 0.000000, __MSGID_HEX_844412 0.000000, __NO_HTML_TAG_RAW 0.000000, __REFERENCES 0.000000, __REPLYTO_SAMEAS_FROM_ACC 0.000000, __REPLYTO_SAMEAS_FROM_ADDY 0.000000, __REPLYTO_SAMEAS_FROM_DOMAIN 0.000000, __SANE_MSGID 0.000000, __SCAN_D_NEG 0.000000, __SCAN_D_NEG2 0.000000, __SCAN_D_NEG_HEUR 0.000000, __SCAN_D_NEG_HEUR2 0.000000, __SUBJ_ALPHA_END 0.000000, __SUBJ_ALPHA_NEGATE 0.000000, __SUBJ_REPLY 0.000000, __TO_IN_SUBJECT 0.000000, __TO_MALFORMED_2 0.000000, __TO_NAME 0.000000, __TO_NAME_DIFF_FROM_ACC 0.000000, __TO_REAL_NAMES 0.000000, __URI_MAILTO 0.000000, __URI_NO_WWW 0.000000, __URI_NS 0.000000, __USER_AGENT 0.000000 X-SASI-Probability: 10% X-SASI-RCODE: 200 X-SASI-Version: Antispam-Engine: 5.1.4, AntispamData: 2025.7.29.165719 DKIM-Signature: v=1; q=dns/txt; a=rsa-sha256; c=relaxed/relaxed; s=default; d=ecomstation.it; bh=t4WsumDHqfujHnNz7dG217hmfXqPjD52pyLv+xCpaIA=; h=Return-Path:From:To:Subject:Date:Message-ID; b=enEdXI0+uOaDkLRu/x3K41XppCp9WZ2LbTfF5Z7/F3IVTqcagEf0OdaNqRTL5nDULhh74 /DPGATeIejEtvdVCuKGJ92fjTG2k5WFmCsajRfJA9kkiTkjNArwIq+31iVCBm6Z3w1e3dQ5 dztTkzyG+uBXN29WtfFvManGNi9VDdPTbO98vzOBV2oek6ZZqyOcKXJxEVblbYdJQxZ3NtA DdNXY79yppxkmUp47fRGf6mEmGrRFODaxVvaLRGQ989LmADn5Lhv57EH6UxwO+8U2OJZIPd HH3VncKh6DUyuMTLdc+ZPEe425/Z6xFXbcnbUXoG8ZKPQzhn+UtayzbKcINA== Received: from [192.168.10.199] (dtp [192.168.10.199]) by srv2 (Weasel v3.05012) for ; Tue, 29 Jul 2025 19:45:43 -0000 Reply-To: ml@ecomstation.it Subject: Re: [eCS-ISP] socket - no buffer space availble To: eCS ISP Mailing List References: <246bd6b3-a116-7813-a257-e7275fb7fd4c@ecomstation.it> Organization: Massimo S. Message-ID: Date: Tue, 29 Jul 2025 19:45:41 +0200 User-Agent: Mozilla/5.0 (OS/2; U; Warp 4.5; it-IT; rv:1.7.13) Gecko/20060424 Thunderbird/1.0.8 Mnenhy/0.7.4.0 MIME-Version: 1.0 In-Reply-To: <246bd6b3-a116-7813-a257-e7275fb7fd4c@ecomstation.it> Content-Type: text/plain; charset=iso-8859-15; format=flowed Content-Language: it Content-Transfer-Encoding: 8bit Il 29/07/2025 19:20, Massimo S. ha scritto: > > > Il 29/07/2025 08:43, Steven Levine ha scritto: >> In , on 07/29/25 >>     at 10:15 AM, "Peter Moylan" said: >> >> Hi all, >> >>> Just because Apache was the one to report the problem, that doesn't mean >>> that Apache caused the socket starvation. You have to use Lewis's >>> approach of closing one application at a time, to see which "close" >>> fixed the problem. >> >> Agreed. >> >> Another useful took for tracking down the source of this kind of issue is >> >>    netstat -s >> >> There's often enough information in the port numbers to track down the >> offending application. >> >> Steven > > Hi all, > > i'm sorry for the copy and paste, i know that i will be troublesome > there are a lot of this stuff (hundreds of sockets) in this state, > maybe it's a sort of DDOS attack > >      0 STREAM           42164        http..80 217.182.195.225  FIN_WAIT_2 >      0 STREAM           56842      https..443    103.42.4.140  FIN_WAIT_2 >      0 STREAM           18331        http..80   51.68.111.239  FIN_WAIT_2 >      0 STREAM           62505        http..80  91.225.160.193  FIN_WAIT_2 > > > massimo i also read: FIN_WAIT_2 has no universally mandated timeout in TCP protocol, so some OSes keep these sockets indefinitely without cleanup. I add, that i've seen that even closing apache the hundreds of sockets stay in FIN_WAIT_2 and do not disappear So, what to do? massimo