Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 29 Mar 2016 22:59:43 +0100
From:      Matthew Seaman <matthew@FreeBSD.org>
To:        freebsd-questions@freebsd.org
Subject:   Re: www/obhttpd and question marks in sockstat
Message-ID:  <56FAFACF.5040404@FreeBSD.org>
In-Reply-To: <20160329165112.GA9259@box.niklaas.eu>
References:  <20160329112840.GA5801@box.niklaas.eu> <56FA6F86.3040302@infracaninophile.co.uk> <20160329165112.GA9259@box.niklaas.eu>

next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--6LeltB7WpCQuPV9AUgNAuxWpereHnC2vp
Content-Type: multipart/mixed; boundary="rK0u1W5uNAIAXeODm7JftO5VA6Nbt88f1"
From: Matthew Seaman <matthew@FreeBSD.org>
To: freebsd-questions@freebsd.org
Message-ID: <56FAFACF.5040404@FreeBSD.org>
Subject: Re: www/obhttpd and question marks in sockstat
References: <20160329112840.GA5801@box.niklaas.eu>
 <56FA6F86.3040302@infracaninophile.co.uk>
 <20160329165112.GA9259@box.niklaas.eu>
In-Reply-To: <20160329165112.GA9259@box.niklaas.eu>

--rK0u1W5uNAIAXeODm7JftO5VA6Nbt88f1
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

On 29/03/2016 17:51, Niklaas Baudet von Gersdorff wrote:
> So there's nothing to worry about too. Nonetheless, I'm wondering: Afte=
r more
> than three hours, the output is still the same? I just started www/obht=
tpd
> again and got the following:
>=20
> USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRE=
SS     =20
> www      obhttpd    9308  4  tcp4   10.15.1.1:80          *:*
> www      obhttpd    9307  4  tcp4   10.15.1.1:80          *:*
> www      obhttpd    9305  4  tcp4   10.15.1.1:80          *:*
> root     syslogd    4654  6  udp6   2a00:c98:2200:af07:6:0:1:1:514 *:*
> root     syslogd    4654  7  udp4   10.15.1.1:514         *:*
> ?        ?          ?     ?  tcp6   2a00:c98:2200:af07:6:0:1:1:80 *:*
> ?        ?          ?     ?  tcp4   10.15.1.1:80          *:*
> ?        ?          ?     ?  tcp6   2a00:c98:2200:af07:6:0:1:1:80 *:*
>=20
> So it seems that www/obhttpd has problems binding again on IPv6 while I=
Pv4
> works fine. Stopping and starting again gives me an additional "closed"=
 port on
> IPv6:
>=20
> USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRE=
SS     =20
> www      obhttpd    9355  4  tcp4   10.15.1.1:80          *:*
> www      obhttpd    9354  4  tcp4   10.15.1.1:80          *:*
> www      obhttpd    9352  4  tcp4   10.15.1.1:80          *:*
> root     syslogd    4654  6  udp6   2a00:c98:2200:af07:6:0:1:1:514 *:*
> root     syslogd    4654  7  udp4   10.15.1.1:514         *:*
> ?        ?          ?     ?  tcp6   2a00:c98:2200:af07:6:0:1:1:80 *:*
> ?        ?          ?     ?  tcp6   2a00:c98:2200:af07:6:0:1:1:80 *:*
> ?        ?          ?     ?  tcp4   10.15.1.1:80          *:*
> ?        ?          ?     ?  tcp6   2a00:c98:2200:af07:6:0:1:1:80 *:*
>=20
> Something's not working properly here, is it?

Three hours does seem a little excessive for closing down a listening
socket.  Yeah, that's not right.  Those already-closed connections
should disappear after a few seconds.  Actually, it's also quite odd now
I come to think of it, to see them for the listening socket of a server
process.  It's common for them to appear for the point to point link
when a particular client connects and then disconnects -- you can see
the effect in sockstat on either the server or the client machines.

This is possibly related to the other odd output you've been seeing.
Looks like the obhttpd process is not getting shutdown properly; rather
it seems to be being killed in an excessively brutal way, which prevents
it from cleaning up after itself.

It might be worth trying some alternate web servers.  If you want a
pretty bare-bones but fast alternative, I like www/nginx-devel with most
of the port's OPTIONS turned off.

I know that nginx doesn't normally suffer from anything like this
effect. If you still see it with nginx, then you've good evidence it's
not something to do with a specific httpd implementation, but something
systemic in your server setup.

Do you see anything similar for any other network servers on your
machine?  Assuming, that is, you can afford to turn them off and
on-again a few times while checking.

=09
	Cheers,

	Matthew



--rK0u1W5uNAIAXeODm7JftO5VA6Nbt88f1--

--6LeltB7WpCQuPV9AUgNAuxWpereHnC2vp
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQJ8BAEBCgBmBQJW+vrVXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ2NTNBNjhCOTEzQTRFNkNGM0UxRTEzMjZC
QjIzQUY1MThFMUE0MDEzAAoJELsjr1GOGkATWgQP/2DkbTHAew74iCjxbp/KP/SU
dFLj6TmO7WbUKU7FDUEaSeExWvhw7Xhf3eeBnqGJhYR/AtiQCxXYyD5moyw+Zmqg
pVrbVAB9VwV/A2f1WGaQbxYUGMEPFP4xk5VoP18BjmkAY83YnanWEsUqtINU4aIH
QBGnI1E2uRFgX1ahRa3r0iuwnVOQbCj71jdaPVnqWOi8IOizQWsgfXwjw+4VtRPe
ILk1qVTmrtXvbzusLAF2NY3E/f4Xju4sLC1TVEoey2yxXVLlG+p+uzG4DdCokhA6
+RzQhmxFkllknR+y8tMWJA8cgpovHlEXa2S7fqfppQ97WQz8FZszEn0VwQ/xHu07
I7SNnHEU0X6DduxW4xuJJMUiESAvP+1LIboZPoeJkUNMO1WmG1H4x1rDOXwdzacY
BfdB/Zbua9jEpJ6pzXo5pRtrmAZpRn6ihOBYhve8eevzQDSKOtH3TW+J6zZAoMBv
0g4ZIi1HrX7xBq5ckiNMdqEfSPz/fwnvNUSUzPyd9djDbMHhADPgu2swvUib8t9G
5uvS4kMh/v6v8GHtE2F7Jk3lk4nbJjWPzlvcUXw0Kx0yzhI8xv9VfuXtwCm274Mg
7FJAnhevydJG9eSsYWxcbErjBzIDhuLVm1bGrMK5oho5eODc05d30pLk3FnCaP7L
apLR6mbSyq3ogLH9bWPT
=TImH
-----END PGP SIGNATURE-----

--6LeltB7WpCQuPV9AUgNAuxWpereHnC2vp--



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?56FAFACF.5040404>