AIX TCP/IP rmsock command
When to use the rmsock command
TCP/IP Utilities to use When the socket does not have a file descriptor
The system administrator is running his usual commands and tools and everything is right in the world. Then it happens, an error log somewhere indicating an TCP application had to stop and restart but it can't restart. Further analysis of error codes indicates that it cannot restart because the reserve ports are in use. It looks like the other end of the connection is down and the sockets used by this application has not reached it timeout limits. Until then, the system will not cleanup these sockets and our hopes of a reboot is not an option.
By using netstat with the -Aan options, you can obtain the process control block (PCB) address of a socket structure.
You are looking at the socket in FIN_WAIT_1 state on your system. Looks like it is a telnet connection using destination port 23 and an ephemeral port 58420. Note in this scenario, the application should be able to restart if it is using a new ephemeral port, unless all ephemeral ports are used, which is highly unlikely and in that case there are bigger issues at hand.
# netstat -aAn|grep FIN
f1000e000258d3b8 tcp 0 0 192.168.1.114.58420 192.168.1.115.23 FIN_WAIT_1
Now to remove the socket...
# rmsock f1000e000258d3b8 tcpcb
socket 0x258d008 is removed.
Which socket states from netstat are candidates for the rmsock command?
FIN_WAIT_1,FIN_WAIT_2, TIME_WAIT, CLOSING are all states where the application performed an active close of the socket.
How do we know a socket is no longer associated with a process?
You can use lsof to check. It is highly recommend that you use netstat in conjunction with lsof to validate the situation prior to doing anything drastic.
Which socket states are not candidates for the rmsock command?
Why are CLOSE_WAIT and CLOSED not suitable for rmsock?
The short answer is both have file descriptors associated with them. A CLOSE_WAIT means the application has done an passive close and is awaiting a response. A CLOSED state means the socket was created, but has not been used. The rmsock command is useless in this instance, but if you are absolutely and positively sure this socket needs to be terminated, then use the kill command to take out the application.
# netstat -aAn|grep CLOS*
f1000e0000aa4bb8 tcp 0 0 *.* *.* CLOSED
f1000e0000aa1bb8 tcp4 0 0 *.* *.* CLOSED
f1000e0000acc3b8 tcp6 0 0 ::1.32777 ::1.32778 CLOSE_WAIT
Notice it is still associated with a file descriptor and process!
(0)> sockinfo f1000e0000acc3b8 tcpcb
proc/fd: fd: 134
SLOT NAME STATE PID PPID ADSPACE CL #THS
pvproc+016000 88*java ACTIVE 05800D0 05C003E 0000000858496400 0 0050
(0)> hcal 05800D0
Value hexa: 005800D0 Value decimal: 5767376
# ps auxw|grep 5767376
root 5767376 0.0 6.0 78936 78952 - A Apr 25 8:06 /var/opt/tivoli/ep/_jvm/jre/bin/java -Xmx384m -Xminf0.01 -Xmaxf0.4
More support for:
Software version: Version Independent
Operating system(s): AIX
Reference #: T1019570
Modified date: 24 June 2015