|
Why does splunkd close internal sockets before the receive queue has been emptied? This appears to leave them laying around in CLOSE_WAIT state instead of moving directly to CLOSE.
|
Refine your search:
|
Why does splunkd close internal sockets before the receive queue has been emptied? This appears to leave them laying around in CLOSE_WAIT state instead of moving directly to CLOSE.
|
Markdown Basics
Tags:
Asked: 07 Jun '11, 15:28
Seen: 446 times
Last updated: 20 Mar, 05:56
I believe CLOSE_WAIT can actually be an optimization technique -- the client's able to start sending data again without going through the full process of establishing the connection. However, I'm not an expert at this, so just thought I'd mention it as a possibility, and leave the real answers to someone who knows for sure. Good question though.
According to http://blog.olivierlanglois.net/index.php/2008/06/05/close_wait_vs_time_wait:
"A TCP connection goes into the CLOSE_WAIT state when it receives a FIN segment from its peer. From that point the connection becomes half-duplex and the TCP connection will not receive any new data from its peer ... the socket will stay there as long as the server does not call close() explicitly on the socket."
Therefore, this does look like the socket is not being closed rather than an optimization technique.