When running an apache server, why does the server intermittently send a duplicate SYN ACK?

Solution Verified - Updated -

Issue

  • Duplicate SYN ACK's are sent from a server to a client after a client initiates a new connection, as shown in a packet capture:
PACKET  TIME(EPOCH)     SOURCE      DESTINATION PROTO   LENGTH  INFO
1   1355964301.054431   10.0.2.5    192.168.2.7 TCP 66  29319 > 11045 [SYN] Seq=0 Win=4380 Len=0 MSS=1460 WS=1 SACK_PERM=1
2   1355964301.054459   192.168.2.7 10.0.2.5    TCP 66  11045 > 29319 [SYN, ACK] Seq=0 Ack=1 Win=14600 Len=0 MSS=1460 SACK_PERM=1 WS=128
3   1355964301.054573   10.0.2.5    192.168.2.7 TCP 60  29319 > 11045 [ACK] Seq=1 Ack=1 Win=4380 Len=0
4   1355964304.853627   192.168.2.7 10.0.2.5    TCP 66  11045 > 29319 [SYN, ACK] Seq=0 Ack=1 Win=14600 Len=0 MSS=1460 SACK_PERM=1 WS=128
5   1355964304.853807   10.0.2.5    192.168.2.7 TCP 60  [TCP Dup ACK 3#1] 29319 > 11045 [ACK] Seq=1 Ack=1 Win=4380 Len=0
  • A situation arises in which a client system will request a socket opened, sending a SYN, and then the server will respond with the appropriate SYN ACK. The client will then successfully ACK, and the conversation will begin. When the client no longer sends data, exactly the same SYN ACK is retransmitted by the server, which results in a duplicate ACK from the client.

Environment

  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Apache (httpd)

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content