Flow Timeouts & TCP FIN/RST

[dennis-hess]

I've been reading for a few hours, both the docs and the web, and I can't seem to definitively answer if the CSS cleans flows internally or if it closes them to the server too. It seems to be a local cleanup process from what I've read. I also wonder if there's a way to have the CSS send FINs or RSTs to the server for old flows. Basically, I'm about to help on an issue where the servers are not having their connections closed properly and they end up out of ports. I don't know if it's the app or the lb but I am curious anyway if there's a way to have the CSS send FINs or RSTs to the server for old entries. If I understand properly, the CSS proxies requests between the client and server and there should be nothing to stop FINs or RSTs from being sent back and forth. Thanks!

[pradeepde]

The mechanism to see to clean up a FCB (flow) is that the flow manager must get an accounting report response back from the fastpath code running on the E/XPIF. An accounting report is generated by the fastpath when a FIN/RST is seen (this would be normal flow termination) or when the a flow is garbage collected. With garbage collection the flow manager sends a query message to the fastpath and if the flow has been idle long enough the fastpath will send an accounting report up to the flow manager. When the accounting report is seen the flow manager will clean up the FCB resources.

[Gilles Dufour]

the CSS does not send any RESET when deleting a flow.

The reset is sent to the client when a flow was deleted AND the client sends a packet that would have matched that flow.

I believe there is a feature request to reset client and server on flow deletion but not yet implemented.

You should look for a solution on the server side.

Reduce the tcp idle timeout or something equivalent.

Also, I know some server do not like the RESET sent by CSS keepalive when using tcp keepalive.

There is a command 'tcp-close-fin' to change the reset into a fin.

If you think the kal could be part of the problem, I would recommend to use this command.

Regards,

Gilles.