HP-UX TCP/IP Performance White Paper, March 2008

45
If the cause is application handshake failure then the applications should be inspected to make sure that the
handshake is either repaired or the effects of the handshake will not cause data loss or corruption.
0 segments discarded for bad checksum
On a private network, or intranet, this value should be very, very small. It may be larger for an Internet
connected system. Even then however, the value should be a very small fraction of the total number of TCP
segments received.
0 bad TCP segments dropped due to state change
An incoming TCP segment is discarded because it is in an invalid TCP state. This value should be very
small.
199570 connection requests
This is the number of "active" opens performed on this system. An "active" open is when an application
calls connect(). This system was the one to initiate connection establishment by sending a SYNchronize
segment to the remote system(s).
87471 connection accepts
This is the number of "passive" opens performed by this system – this is the number of times we
accept()ed a connection initiated by remote systems.
287041 connections established (including accepts)
This is simply the sum of the two prior statistics.
335394 connections closed (including 48427 drops)
This is the number of connections which have been terminated – either through a proper graceful shutdown
initiated by the application calling shutdown() or close() (without setting SO_LINGER for an abortive
close) i.e. an exchange of FIN segments, or through an abortive close (the drops) - receipt or transmission
of RST segments in response to an SO_LINGER setting or some other protocol violation.
The number of abortive closes (aka drops) should be very much smaller than the number of graceful closes.
Ideally, it would be zero.
27589 embryonic connections dropped
This is the number of TCP connections which were closed before they could transition to the ESTABLISHED
state. It could mean that this system is trying to establish connections to remote systems which are not
listening for connection requests, or are being rejected by firewalls or other means.
It could also mean that some remote rogue system or systems are trying to initiate some sort of denial of
service attack by flooding the local machine with bogus connection requests.
222735273 segments updated rtt (of 222735273 attempts)
In broad terms, the only segments which can update the RTT (Round Trip Time) are those which are
transmitted and then ACKed without a retransmission. If the retransmission rate increases, the ratio of RTT
updates to attempts will get worse.