Removing CLOSE_WAIT connections

Hello folks, just thought I would share something I came with during one fine day at work.

Recently, we faced a problem where there were a lot of CLOSE_WAIT connections on our server which caused a variety of issues on the server. It seemed like there was a bug in the application (a java based app) but hunting it down was a pain, fixing it would also take a long time. Instead what we did, was to restart the application at periodic intervals which seemed to clean up the CLOSE_WAIT connections.

However, we wanted to remove CLOSE_WAIT connections without killing the process. We found that we could do the same with tools like :

• killcx
• cutter
• tcpkill

We tried them out but none of them seemed to be of much use for CLOSE_WAIT connections. So I hacked into the source code of killcx and found this interesting bit of code:

my $packet = Net::RawIP->new({
      ip => {  frag_off => 0, tos => 0,
               saddr => $dest_ip, daddr => $local_ip
            },
      tcp =>{  dest => $local_port, source => $dest_port,
               seq => 10, syn => 1
            }
   });
   $packet->send;

I modified this and wrote this utility that removes all CLOSE_WAIT connections: https://github.com/rghose/kill-close-wait-connections

This seemed to do the trick! Happy hacking.