[users@httpd] Apache + mod_proxy, too many TIME_WAIT TCP statess?

[Emre Bastuz <in...@emre.de>]

Hi,

I´ve been using Apache with mod_proxy and mod_ssl for accepting
HTTPS connections and forwarding them to a cluster of three W2K
servers that are visible with one IP (forwarding is done by HTTP).

Using keepalive to transfer the web page elements over a persistent
session led to an error message "the page can not be displyed" with
Internet Explorer browsers, so I turned off the keepalive for this
particular browser.

After "heavy" load on the Solaris server two days ago I saw that MSIE
opens 10-15 connections per page, resulting in about 3.000 TIME_WAIT states
for just 30-40 users accessing the pages, which leads to a server crash
on the Windows part.

Though Mozilla is also being used with nokeepalive, it _does_ use a
persistent connection and does not screw up the W2K TCP/IP stack.

I have the following questions:

1. does anyone have an idea why I get this "The page can not be displayed"
   message from time to time when turning keepalive on (IE)? 

2. why does Mozilla only create one TCP session, though keepalive
   is turned off?

3. what exactly is the dependency of setting keepalive on or off with
   forcing HTTP/1.0?

4. did anyone here have a similar problem and found a solution?

As a workaround I have reduced the lifetime of a TIME_WAIT on both the Solaris
machine and the W2K servers but this does not seem as a solution as it 
raises the number of concurrent users to only 350. 

I know that this problem does indeed relate to many things, not merely to
the Apache - this list seemed the most appropriate place for me to start
(after having done some heavy Googling and RTFM :-)

Thanks in advance,

Emre

P.S.: the relevant config parts from httpd.conf are as follows:

ProxyPass               /       http://1.2.3.4/
ProxyPassReverse        /       http://1.2.3.4/

BrowserMatch "Mozilla/2" nokeepalive
BrowserMatch "Mozilla/5" nokeepalive
BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0
BrowserMatch "RealPlayer 4\.0" force-response-1.0
BrowserMatch "Java/1\.0" force-response-1.0
BrowserMatch "JDK/1\.0" force-response-1.0

# Problem mit SSL+IE:
#BrowserMatch "MSIE" nokeepalive downgrade-1.0 force-response-1.0
BrowserMatch "MSIE" nokeepalive

-- 
info@emre.de              http://www.emre.de        
UIN: 561260           PGP Key ID: 0xAFAC77FD
I don't see why some people even HAVE cars. -- Calvin

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org