When running an apache server, why does the server intermittently send a duplicate SYN ACK?
Issue
- Duplicate SYN ACK's are sent from a server to a client after a client initiates a new connection, as shown in a packet capture:
PACKET TIME(EPOCH) SOURCE DESTINATION PROTO LENGTH INFO
1 1355964301.054431 10.0.2.5 192.168.2.7 TCP 66 29319 > 11045 [SYN] Seq=0 Win=4380 Len=0 MSS=1460 WS=1 SACK_PERM=1
2 1355964301.054459 192.168.2.7 10.0.2.5 TCP 66 11045 > 29319 [SYN, ACK] Seq=0 Ack=1 Win=14600 Len=0 MSS=1460 SACK_PERM=1 WS=128
3 1355964301.054573 10.0.2.5 192.168.2.7 TCP 60 29319 > 11045 [ACK] Seq=1 Ack=1 Win=4380 Len=0
4 1355964304.853627 192.168.2.7 10.0.2.5 TCP 66 11045 > 29319 [SYN, ACK] Seq=0 Ack=1 Win=14600 Len=0 MSS=1460 SACK_PERM=1 WS=128
5 1355964304.853807 10.0.2.5 192.168.2.7 TCP 60 [TCP Dup ACK 3#1] 29319 > 11045 [ACK] Seq=1 Ack=1 Win=4380 Len=0
- A situation arises in which a client system will request a socket opened, sending a SYN, and then the server will respond with the appropriate SYN ACK. The client will then successfully ACK, and the conversation will begin. When the client no longer sends data, exactly the same SYN ACK is retransmitted by the server, which results in a duplicate ACK from the client.
Environment
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Apache (httpd)
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.