3

I have ASP.NET application running on Windows Server 2008 R2 hosted on Rackspace servers. Suddenly something went wrong. All my application working fine except for the pages which call third part web-service(in other words access the internet). I am getting An operation on a socket could not be performed because the system lacked sufficient buffer space or because a queue was full. When I login in server via Remote Desktop and access the internet it shows me 'Connection Error'.

Stats 22 Dec 2015,

CLOSE_WAIT  5   
ESTABLISHED 146
TIME_WAIT   646750
LAST_ACK    1
LISTENING   30
user960567
  • 329
  • 2
  • 9
  • 17
  • Check with a netstats -nbt if you don't have strange connexion . This buffer full could be an error for 'too many tcp connexion' . – YuKYuK Jan 22 '15 at 09:00
  • netstats is not recognized as an internal or external command. Ok I think its netstat – user960567 Jan 22 '15 at 09:03
  • This command showing me scrolling window with Tcp ip rows – user960567 Jan 22 '15 at 09:05
  • 1
    Ok so try to check if someting is wrong with connected port if you are more gui user try this : https://technet.microsoft.com/en-us/sysinternals/bb897437 – YuKYuK Jan 22 '15 at 09:22

2 Answers2

1

You've just ran out of TCB (i.e. TCP handles)

The cause could be anything, e.g.:

Port leaks on any commercial software you're running --> Solution: Review which software are you running and apply any available hotfixes. Port exhaustion attack --> Solution: Ask your hosting provider if your traffic levels are abnormal. Port leaks on any custom software deployed --> Solution: Get your devs to review if they're releasing TCBs after closing TCP connections.

A time_wait state happens after the TCP connection has been close. The computer will keep the port in a half closed (sic) state in case there are any delayed packets. It should remain in this state for a time defined as 2xMSL (two times the maximum segment lenght) which by default has a value of 400ms (2x200ms). In your case you're either getting too many connections at a faster pace than how these are completely closed (and freed) or for some reason these are not being freed at all.

Being Rackspace a managed hosting I would recommend you to ask them to login through the ILO/DRAC port and reboot your computer if you just want to get moving.

Pedro Perez
  • 5,652
  • 1
  • 10
  • 11
  • Thanks. Why the TIME_WAIT is not declining since 2 days? – user960567 Jan 24 '15 at 07:54
  • Could be many different things. Make sure your OS and applications are up to date. Also, check the ID of the process keeping those sockets "half closed" and reach out to the vendor for support. – Pedro Perez Jan 25 '15 at 19:55
0

Use this command to find the culprit executable

netstat -nbt

kill that exe or stop the service and you are good to go

HimalayanCoder
  • 103
  • 3