<div dir="ltr"><div>Hi!</div><div><br></div><div>We recently updated from squid v2 to v3 and now see huge increase in connections in TIME_WAIT state on our squid servers (verified that this is clients connections).</div><div><br></div><div>See versions and amount of such connections under the same load with the same configs (except some incompatible stuff):</div><div><br></div><div>squid 2.7.STABLE9</div><div><br></div><div><div>configure options: '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--includedir=/usr/include' '--libdir=/usr/lib' '--libexecdir=/usr/libexec' '--sharedstatedir=/usr/com' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--exec_prefix=/usr' '--bindir=/usr/sbin' '--libexecdir=/usr/lib/squid' '--localstatedir=/var' '--datadir=/usr/share' '--sysconfdir=/etc/squid' '--enable-epoll' '--enable-removal-policies=heap,lru' '--enable-storeio=aufs' '--enable-delay-pools' '--with-pthreads' '--enable-cache-digests' '--enable-useragent-log' '--enable-referer-log' '--with-large-files' '--with-maxfd=16384' '--enable-err-languages=English'</div></div><div><br></div><div># netstat -tn | grep TIME_WAIT | grep 3128 | wc -l</div><div>95</div><div><br></div><div>squid 3.5.25</div><div><br></div><div><div>configure options: '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/sbin' '--sbindir=/usr/sbin' '--sysconfdir=/etc/squid' '--libdir=/usr/lib' '--libexecdir=/usr/lib/squid' '--includedir=/usr/include' '--datadir=/usr/share' '--sharedstatedir=/usr/com' '--localstatedir=/var' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--enable-epoll' '--enable-removal-policies=heap,lru' '--enable-storeio=aufs' '--enable-delay-pools' '--with-pthreads' '--enable-cache-digests' '--enable-useragent-log' '--enable-referer-log' '--with-large-files' '--with-maxfd=16384' '--enable-err-languages=English' '--enable-htcp'</div></div><div><br></div><div># netstat -tn | grep TIME_WAIT | grep 3128 | wc -l</div><div>11277</div><div><br></div><div>Config:</div><div><br></div><div><div>http_port <a href="http://0.0.0.0:3128">0.0.0.0:3128</a></div><div><br></div><div>acl localnet src <a href="http://10.0.0.0/8">10.0.0.0/8</a> # RFC1918 possible internal network</div><div>acl localnet src <a href="http://172.16.0.0/12">172.16.0.0/12</a> # RFC1918 possible internal network</div><div>acl localnet src <a href="http://192.168.0.0/16">192.168.0.0/16</a> # RFC1918 possible internal network</div><div>acl localnet src fc00::/7 # RFC 4193 local private network range</div><div>acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines</div><div><br></div><div>acl SSL_ports port 443</div><div><br></div><div>acl Safe_ports port 80 # http</div><div>acl Safe_ports port 21 # ftp</div><div>acl Safe_ports port 443 # https</div><div>acl Safe_ports port 70 # gopher</div><div>acl Safe_ports port 210 # wais</div><div>acl Safe_ports port 280 # http-mgmt</div><div>acl Safe_ports port 488 # gss-http</div><div>acl Safe_ports port 591 # filemaker</div><div>acl Safe_ports port 777 # multiling http</div><div>acl Safe_ports port 1025-65535 # unregistered ports</div><div><br></div><div>acl CONNECT method CONNECT</div><div><br></div><div>### START CUSTOM</div><div>acl Purge_method method PURGE</div><div><br></div><div># Allow localhost to selectively flush the cache</div><div>http_access allow localhost Purge_method</div><div>http_access deny Purge_method</div><div>### END CUSTOM</div><div><br></div><div>### ALLOW ACCESS TO ALL PORTS</div><div># http_access deny !Safe_ports</div><div>http_access deny CONNECT !SSL_ports</div><div>http_access allow localhost manager</div><div>http_access deny manager</div><div><br></div><div>http_access allow localnet</div><div>http_access allow localhost</div><div>http_access deny all</div><div><br></div><div>### START CUSTOM</div><div># Disable icp</div><div>icp_port 0</div><div># Allow ICP queries from local networks only</div><div>icp_access allow localnet</div><div>icp_access allow localhost</div><div>icp_access deny all</div><div><br></div><div># Disable htcp</div><div>htcp_port 0</div><div># Allow HTCP queries from local networks only</div><div>htcp_access allow localnet</div><div>htcp_access allow localhost</div><div>htcp_access deny all</div><div><br></div><div># Check for custom request header</div><div>acl custom_acl req_header x-use-custom-proxy -i true</div><div># Check for x-use-new-proxy request header</div><div>acl custom_new_acl req_header x-use-new-proxy -i true</div><div><br></div><div># first_proxy</div><div>cache_peer 127.0.0.1 parent 18070 0 no-query no-digest name=first_proxy</div><div>cache_peer_access first_proxy deny custom_acl</div><div>cache_peer_access first_proxy deny custom_new_acl</div><div><br></div><div># second_proxy</div><div>cache_peer 127.0.0.1 parent 18079 0 no-query no-digest name=second_proxy</div><div>cache_peer_access second_proxy allow custom_acl</div><div>cache_peer_access second_proxy allow custom_new_acl</div><div>cache_peer_access second_proxy deny all</div><div><br></div><div>never_direct allow all</div><div><br></div><div>cache_mem 4620591 KB</div><div>maximum_object_size_in_memory 8 KB</div><div>memory_replacement_policy heap LRU</div><div>cache_replacement_policy heap LRU</div><div><br></div><div>cache_dir aufs /mnt/services/squid/cache 891289 16 256</div><div><br></div><div>minimum_object_size 64 bytes # none-zero so we dont cache mistakes</div><div>maximum_object_size 102400 KB</div><div><br></div><div>logformat combined %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %>Hs %<st %tr "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh</div><div>logformat squid %ts.%03tu %6tr %>a %Ss/%03>Hs %<st %rm %ru %un %Sh/%<A %mt</div><div><br></div><div>access_log stdio:/var/log/squid/access.log combined</div><div>cache_log /var/log/squid/cache.log</div><div>cache_store_log none</div><div>logfile_rotate 0</div><div><br></div><div>client_db off</div><div><br></div><div>pid_filename /var/run/squid.pid</div><div><br></div><div><br></div><div>coredump_dir /var/cache</div><div>### END CUSTOM</div><div><br></div><div>refresh_pattern ^ftp: 1440 20% 10080</div><div>refresh_pattern ^gopher: 1440 0% 1440</div><div># refresh_pattern -i (/cgi-bin/|\?) 0 0% 0</div><div>refresh_pattern . 0 20% 4320</div><div><br></div><div>### START CUSTOM</div><div># don't cache errors</div><div>negative_ttl 0 minutes</div><div># always fetch object from the beginning regardless of Range requests</div><div>range_offset_limit none</div><div>cache_effective_user squid</div><div>cache_effective_group squid</div><div>max_filedescriptors 524288</div><div>via off</div><div>forwarded_for delete</div><div>### END CUSTOM</div></div><div><br></div><div>We tried "half_closed_clients on" but it didn't help.</div><div><br></div><div>Any ideas?</div><div><br></div><div>Thanks.</div><div><br></div>-- <br><div class="gmail_signature">With best regards, Ivan Larionov.</div>
</div>