Lot of TCP TIME_WAIT's shown on Netstat tied to my browers session on admin interface

[Scott Jacobs]

I was first noticing some apparent slowdows in my network today - so I was taking a look at my RT-AC68U's log (running Merlin 380.63_2 level) when I saw a number of these messages:

Nov 18 17:31:19 kernel: net_ratelimit: 3 callbacks suppressed

Did a little research and in another thread it was suggested to take a look at the Netstat page in the router admin interface to see if there were a large number of TCP_WAIT's showing for a particular device, etc. So I did that and what I found were a large number (50+ at least) of TCP_WAIT's showing for my browser session with the router's admin interface.

To be honest I have never looked at the netstat page before - but this seems really abnormal. The direction seems to be from the router back to my browser (router address and port 80 is listed in the local address column). So it is like the router is trying to send a bunch of replies back to my browser but my browser is not listening...

Any ideas on what might be causing this and how to resolve?

 

[mstombs]

Unfortunately the multiple connections are a feature of the Asus web interface, presumably new connections are made for lots of different items on screen. It shouldn't be an issue however, the router ends of the connected sockets go through a tcp handling state machine which means they spend a time - 1 or 5 minutes in the various WAIT states before disappearing. I think the web interface would need to be upgraded to html5 and persistent websocket connections made so all the communication can go through a single connection?

 

[Scott Jacobs]

Unfortunately the multiple connections are a feature of the Asus web interface, presumably new connections are made for lots of different items on screen. It shouldn't be an issue however, the router ends of the connected sockets go through a tcp handling state machine which means they spend a time - 1 or 5 minutes in the various WAIT states before disappearing. I think the web interface would need to be upgraded to html5 and persistent websocket connections made so all the communication can go through a single connection?

OK - thanks - I was wondering about that - certainly familiar with that kind of behavior on web interfaces depending on how the site is constructed as my background is in software / web development. Just surprised me to see that many. Had never looked at this before so came as a bit of a surprise. But there is a lot going on in this web app - so guess it makes sense...

I tracked down the real issue with all of those callback suppressed messages in my logs - turns out I stupidly left my secondary WAN router/modem (uverse) connected to the LAN 1 port after I turned off multiple WANs and went back to single Lan to test out stability of WAN connection w/o mult-wan's being configured. That created a mess because that combo AT&T Uverse device still had its DHCP service running so suddenly some of my clients were getting addresses in a different subnet and all of them tie into a single 48 port managed switch and of course they were all tagged in the same default Vlan...not good Anyhow - got that resolved and now those messages have disappeared from the router's logs. And my network is behaving much more normally