Professional Web Applications Themes

ttloop peer died - SCO

I have been seeing an increase in 'ttloop peer died' messages in /usr/adm/syslog (on 5.0.6 and 5.0.7). The TA (107691) does mention it but not in any detail Anyone got any more information on the cause of this error and which combination of the keepalive options can be tweeked to reduce them. Tom -- ================================================== ====================== Tom Melvin demon.co.uk http://www.tkrh.demon.co.uk Veterinary Solutions Ltd Sysop Compuserve Unixforum ================================================== ======================...

  1. #1

    Default ttloop peer died


    I have been seeing an increase in 'ttloop peer died' messages
    in /usr/adm/syslog (on 5.0.6 and 5.0.7). The TA (107691) does
    mention it but not in any detail

    Anyone got any more information on the cause of this error and
    which combination of the keepalive options can be tweeked to
    reduce them.

    Tom

    --
    ================================================== ======================
    Tom Melvin demon.co.uk http://www.tkrh.demon.co.uk
    Veterinary Solutions Ltd Sysop Compuserve Unixforum
    ================================================== ======================
    Tom Guest

  2. #2

    Default Re: ttloop peer died

    Tom Melvin typed (on Tue, Oct 14, 2003 at 07:02:18PM +0000):
    |
    | I have been seeing an increase in 'ttloop peer died' messages
    | in /usr/adm/syslog (on 5.0.6 and 5.0.7). The TA (107691) does
    | mention it but not in any detail

    Is TA115066 more relevant?

    --
    JP
    Jean-Pierre Guest

  3. #3

    Default Re: ttloop peer died

    Tom Melvin wrote:
     

    The messages themselves aren't a problem. Are you seeing an effect that
    _is_ a problem -- like user's sessions being dropped? Get a good
    description of this (for instance, does their client just suddenly exit
    in the middle of doing something? Or does it freeze up for a while,
    then exit? Or does it only happen when they've been away from their
    desk for a while, come back, find that the client window is gone?)

    The most typical cause I've seen of the message is connection attempts
    from a client that dies during the initial connection (due to a client
    bug or misconfiguration). In which case they are just messages in a
    log, not representing any problem at the Unix end.
     
    Bela Guest

  4. #4

    Default Re: ttloop peer died

    Jean-Pierre Radley made comment on Tue Oct 14 20:19:40 2003 : 

    Don't think so.

    The customer is not complaining of failed login, it is a 15 user m/c I
    would think the default 64 pseudo ttys are fine. Actually, just relooked
    at syslog:

    Oct 13 01:57:22 cvntry telnetd[28609]: ttloop: peer died: Unknown error
    Oct 13 02:08:08 cvntry telnetd[28616]: ttloop: peer died: Unknown error
    Oct 13 02:20:57 cvntry telnetd[28630]: ttloop: peer died: Unknown error
    Oct 13 02:32:32 cvntry telnetd[28637]: ttloop: peer died: Unknown error
    Oct 13 02:43:26 cvntry telnetd[28639]: ttloop: peer died: Unknown error
    Oct 13 02:54:18 cvntry telnetd[28641]: ttloop: peer died: Unknown error
    Oct 13 03:05:14 cvntry telnetd[28663]: ttloop: peer died: Unknown error
    Oct 13 03:16:04 cvntry telnetd[28674]: ttloop: peer died: Unknown error
    Oct 13 03:27:01 cvntry telnetd[28681]: ttloop: peer died: Unknown error
    Oct 13 03:38:02 cvntry telnetd[28683]: ttloop: peer died: Unknown error
    Oct 13 03:48:52 cvntry telnetd[28685]: ttloop: peer died: Unknown error
    Oct 13 04:00:28 cvntry telnetd[28692]: ttloop: peer died: Unknown error
    Oct 13 04:10:29 cvntry telnetd[28703]: ttloop: peer died: Unknown error
    Oct 13 04:18:59 cvntry telnetd[28705]: ttloop: peer died: Unknown error
    Oct 13 04:27:29 cvntry telnetd[28712]: ttloop: peer died: Unknown error
    Oct 13 04:35:59 cvntry telnetd[28714]: ttloop: peer died: Unknown error
    Oct 13 04:44:27 cvntry telnetd[28716]: ttloop: peer died: Unknown error
    Oct 13 04:52:53 cvntry telnetd[28718]: ttloop: peer died: Unknown error
    Oct 13 05:02:17 cvntry telnetd[28725]: ttloop: peer died: Unknown error
    Oct 13 05:11:16 cvntry telnetd[28736]: ttloop: peer died: Unknown error

    All these times are in the early am - they do not use the system over
    night - those must be left over from during the day but then again,
    the 13th was a monday, they also don't use the system on Sunday's
    so I have no idea where those are comming from. Weird

    Tom


    --
    ================================================== ======================
    Tom Melvin demon.co.uk http://www.tkrh.demon.co.uk
    Veterinary Solutions Ltd Sysop Compuserve Unixforum
    ================================================== ======================
    Tom Guest

  5. #5

    Default Re: ttloop peer died

    Tom Melvin wrote:
     

    It could be some sort of an attack; or some device (like a network
    printer) wigging out. Notice that the times are pretty evenly spaced:
    about 10 minutes apart, until the last few which are about 8.5 minutes
    apart. The regularity strongly suggests some sort of automated process.

    You could put in a little watcher daemon, something like:

    #!/bin/sh
    while :; do
    tail -0f /usr/adm/syslog | grep -q ttloop
    date >> /usr/adm/ttloop-netstat
    netstat -n -p tcp | fgrep '.23 ' >> /usr/adm/ttloop-netstat
    done

    You're looking for output that looks something like:

    Proto Recv-Q Send-Q Local Address Foreign Address (state)
    tcp 0 0 127.0.0.1.23 127.0.0.1.1160 TIME_WAIT

    Here I had done a `telnet localhost` and immediately disconnected. Your
    mystery connections will probably be from a different host, and may be
    in a different state than TIME_WAIT (but probably TIME_WAIT). The "-n"
    flag skips hostname lookups, which could be slow in some cases, and
    might possibly make it miss the actual lines you're interested in. Once
    you have an idea of which lines are the mystery telnets, you can look
    the names up witn `ping`, `host`, `nslookup`, etc.
     
    Bela Guest

  6. #6

    Default Re: ttloop peer died

    Bela Lubkin made comment on Tue Oct 14 22:31:03 2003 : [/ref]
    [snipped]
     
    >
    > It could be some sort of an attack; or some device (like a network
    > printer) wigging out. Notice that the times are pretty evenly spaced:
    > about 10 minutes apart, until the last few which are about 8.5 minutes
    > apart. The regularity strongly suggests some sort of automated process.
    >
    > You could put in a little watcher daemon, something like:
    >
    > #!/bin/sh
    > while :; do
    > tail -0f /usr/adm/syslog | grep -q ttloop
    > date >> /usr/adm/ttloop-netstat
    > netstat -n -p tcp | fgrep '.23 ' >> /usr/adm/ttloop-netstat
    > done
    >
    > You're looking for output that looks something like:
    >
    > Proto Recv-Q Send-Q Local Address Foreign Address (state)
    > tcp 0 0 127.0.0.1.23 127.0.0.1.1160 TIME_WAIT
    >
    > Here I had done a `telnet localhost` and immediately disconnected. Your
    > mystery connections will probably be from a different host, and may be
    > in a different state than TIME_WAIT (but probably TIME_WAIT). The "-n"
    > flag skips hostname lookups, which could be slow in some cases, and
    > might possibly make it miss the actual lines you're interested in. Once
    > you have an idea of which lines are the mystery telnets, you can look
    > the names up witn `ping`, `host`, `nslookup`, etc.[/ref]

    Yes it was an user who decided to probe all the ports just to see if the
    machines were still alive. The little script quickly showed where it was
    coming from - thanks

    Tom


    --
    ================================================== ======================
    Tom Melvin demon.co.uk http://www.tkrh.demon.co.uk
    Veterinary Solutions Ltd Sysop Compuserve Unixforum
    ================================================== ======================
    Tom Guest

Similar Threads

  1. Replies: 4
    Last Post: August 5th, 02:10 PM
  2. Replies: 1
    Last Post: June 30th, 09:40 PM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139