|
Hi all,
I've setup LVS on a box using Keepalived (and Iptables) to load balance
traffic between 2 web servers. I have a problem :
A lot of TCP packets with FIN or RST flags (all I think) are dropped by
Iptables as state INVALID. The consequence is that I have a lot of
connection in FIN_WAIT state (shown by netstat) on the 2 web servers...
I have reproduced this on my lab...
I have sniff packets with tcpdump to see flags, ACK number,... I've
found nothing bad.
I have tried to accept these packets with Iptables and then, all my
connections are terminated in a normal way (only 1-2 connection(s) stay
in FIN_WAIT on web servers).
I know I can play with TCP timeout to reduce this behavior, but I'll
prefer correct the problem. I don't understand why these packets are
invalid if when I accept them, the connections end normaly...
Google is NOT my friend on this issue.
Is someone can help me ???
Dimitri Gourdon
Linux Web Administrator
Itool systems
PS : Sorry for my poor english !
|
