eG Monitoring
 

Measures reported by TcpPortTest

This operating system-specific test periodically tracks the status of TCP connections to and from a server. This test can be used in different ways. For instance, an administrator can use this test to determine the number of connections that currently exist to a specific TCP port on the server (e.g., the web server port). Alternately, the administrator can also determine the number of TCP connections established from one server to another server - for example, from a web server to a specific application server.

To use the TcpPortTest, an administrator should specify a list of TCP source/port or destination/port combinations that he/she is interested in monitoring. For each such combination, the TcpPortTest reports the number of TCP connections in each of the TCP protocol states. Analysis of the results can point to scenarios that need attention - e.g., abnormally high established connections to a specific TCP port, unusually large number of connections in the FIN_WAIT state, etc. Often in multi-tier infrastructures that include a number of inter-dependent application tiers, it is also interesting to compare the number of connections established to each tier and correlate the increase/decrease of connections across tiers.

Measurement Description Measurement Unit Interpretation
Syn_sent
Indicates the number of connections that are in the process of being established by the host to other server(s)
Number  
Syn_received
Indicates the number of connections that are in the process of being established by remote hosts to this host
Number  
Established
Indicates the total number of TCP connections on this host for the port number(s) specified in the test arguments
Number
The number of TCP connections established to a server is one indicator of the server workload
Close_wait
Indicates the current number of TCP connections to a port that are in the TCP CLOSE_WAIT state. Connections remain in the close wait state when they are waiting for a process to close the TCP socket.
Number  
Fin_wait1
Indicates the number of TCP connections to a TCP port that are in the FIN_WAIT_1 state. A TCP connection moves to the FIN_WAIT_1 state when a local program closes a socket but the remote server does not respond.
Number
A large number of FIN_WAIT_1 connections can occur if clients are not properly closing down TCP connections. A connection may linger in this state for tens of minutes.
 
Fin_wait2
Indicates the number of TCP connections to a TCP port that are in the FIN_WAIT_2 state. A connection moves to the FIN_WAIT_2 state when a remote server shuts down its side of a TCP connection and the local server does not respond to it.
 
Number  
Time_wait
Indicates the number of connections in the TCP TIME_WAIT state. The TIME_WAIT state is a safety mechanism, to catch stray packets for that connection after the connection is "officially" closed. Since the maximum time that such stray packets can exist is 2 times the maximum round-trip time, the TIME_WAIT state lasts twice the round-trip period. Roughly, the duration is 30-120 seconds.
Number  
Send_queue Send-Q is used to show the socket buffer status. This indicates the number of bytes that have been sent to the destination, and are awaiting acknowledgement.

(Available only for Solaris, Linux, HP-UX and AIX)

Bytes/sec A high value of this measure indicates a poor network response.
Receive_queue Receive-Q is used to show the socket buffer status. The number indicates the number of bytes received from the source and copied.

(Available only for Solaris, Linux, HP-UX and AIX)

Bytes/sec A high value of this measure indicates a poor network response.