15

We have an home-brewed XMPP server and I was asked what is our server's MSL (Maximum Segment Lifetime).
What does it mean and how can I obtain it? Is it something in the Linux /proc TCP settings?

3 Answers 3

13

The MSL (Maximum Segment Lifetime) is the longest time (in seconds) that a TCP segment is expected to exist in the network. It most notably comes into play during the closing of a TCP connection -- between the CLOSE_WAIT and CLOSED state, the machine waits 2 MSL's (conceptually a round trip to the end of the internet and back) for any late packets. During this time, the machine is holding resources for the mostly-closed connection. If a server is busy, then the resources held this way can become an issue. One "fix" is to lower the MSL so that they are released sooner. Generally this works OK, but occasionally it can cause confusing failure scenarios.

On Linux (RHEL anyway, which is what I am familiar with), the "variable" /proc/sys/net/ipv4/tcp_fin_timeout is the 2*MSL value. It is normally 60 (seconds). To see it, do:

cat /proc/sys/net/ipv4/tcp_fin_timeout

To change it, do something like:

echo 5 > /proc/sys/net/ipv4/tcp_fin_timeout

Here is a TCP STATE DIAGRAM. You can find the wait in question at the bottom.


TCP State Diagram

4
  • 2
    I think you mean "between the TIME_WAIT and CLOSED state".
    – claymation
    Oct 18, 2018 at 23:28
  • 5
    The delay between TIME_WAIT and CLOSED is NOT configurable via tcp_fin_timeout
    – Greg Bray
    Dec 6, 2018 at 2:44
  • the tcp protocol decree that no packet should "live" in the network for more than MSL, but I'm still very curious - how DOES the network actually guarantees maximum lifetime of a packet, to my understanding this would require a globaly synchronized clock, right? Otherwise how can any router know if the packet it receives are dying and stops forwarding it accordingly?
    – Weipeng
    May 12, 2020 at 20:42
  • this answer is totally wrong, based on the documentation, tcp_fin_timeout is the time to wait for the last FIN packet, it should be the timeout setting for state of FIN_WAIT_2 //// tcp_fin_timeout (integer; default: 60; since Linux 2.2) This specifies how many seconds to wait for a final FIN packet before the socket is forcibly closed. This is strictly a violation of the TCP specification, but required to prevent denial-of-service attacks. In Linux 2.2, the default value was 180. Sep 3, 2021 at 6:08
12

You can also see a countdown timer for sockets using -o in netstat or ss, which helps show concrete numbers about how long things will wait. For instance, TIME_WAIT does NOT use tcp_fin_timeout (it is based on TCP_TIMEWAIT_LEN which is usually hardcoded to 60s).

cat /proc/sys/net/ipv4/tcp_fin_timeout
3

# See countdown timer for all TIME_WAIT sockets in 192.168.0.0-255
ss --numeric -o state time-wait dst 192.168.0.0/24

NetidRecv-Q  Send-Q    Local Address:Port    Peer Address:Port                             
tcp  0       0         192.168.100.1:57516   192.168.0.10:80    timer:(timewait,55sec,0)   
tcp  0       0         192.168.100.1:57356   192.168.0.10:80    timer:(timewait,25sec,0)   
tcp  0       0         192.168.100.1:57334   192.168.0.10:80    timer:(timewait,22sec,0)   
tcp  0       0         192.168.100.1:57282   192.168.0.10:80    timer:(timewait,12sec,0)   
tcp  0       0         192.168.100.1:57418   192.168.0.10:80    timer:(timewait,38sec,0)   
tcp  0       0         192.168.100.1:57458   192.168.0.10:80    timer:(timewait,46sec,0)   
tcp  0       0         192.168.100.1:57252   192.168.0.10:80    timer:(timewait,7.436ms,0) 
tcp  0       0         192.168.100.1:57244   192.168.0.10:80    timer:(timewait,6.536ms,0)
2
1

This looks like it can answer your question:

http://seer.support.veritas.com/docs/264886.htm

I suggest that you ask why someone asked you this and find out how that applies to XMPP.

TCP/IP Illustrated volume 1 is online and describes 2MSL in more detail: Here

MSL is also described in the TCP RFC 793 as mentioned in wikipedia