Re: does this error message mean anything bad?

On Tue, Feb 12, 2008 at 12:20:12PM -0800, John-Mark Gurney wrote:
> Aryeh M. Friedman wrote this message on Tue, Feb 12, 2008 at 07:49 -0500:
> > Limiting closed port RST response from 266 to 200 packets/second.
> 
> Since everyone else has thrown their two bits in, it could also mean
> that you have a busy server, and that you are exceeding 200
> connections/sec, and that this is limiting the number of connections
> we fully close per second.  If you are testing a web server over
> gige w/ small files, you will usually run into this problem..
> 
> Upding the sysctl net.inet.icmp.icmplim will increase this limit.
> Yes, I know it's not intuitive the ICMP limit is responsible for
> TCP RST's, but that's the way it is...

This is a _closed_ port RST, so a response to a packet, which belong
to a non existing connection.
This usually happens because outdated packets reach you, or your system
isn't the same as the other sides expected (either your host crashed or
you got anothers systems dynamic IP).
Another reason for this to happen is because of bugs in the TCP code
of the _other_ side - IIRC windows has had such a bug many years ago.
There is no special reason to increase the icmp lim, because it is
just to play nice with the other side(s), which is doing something
questionable anyway, if you are seeing that much responses.
This is not limiting you to 200 connection/s in any way, it is just
triggered if things go wrong.
If you see this on a busy server, you are either hit by the windows
bug, or by a bad connection between you and the client(s).

-- 
B.Walter                http://www.bwct.de      http://www.fizon.de
bernd_at_bwct.de           info_at_bwct.de            support_at_fizon.de