here are the matching entries: ss -a --sctp State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 [::ffff:194.0.137.189]:2020 *:* UNCONN 0 0 [::ffff:194.0.137.189]:2020 *:1202 SYN-RECV 0 0 [::ffff:194.0.137.234]%eth0:2020 *:1202 from /proc/net/sctp/assocs ASSOC SOCK STY SST ST HBKT ASSOC-ID TX_QUEUE RX_QUEUE UID INODE LPORT RPORT LADDRS <-> RADDRS HBINT INS OUTS MAXRT T1X T2X RTXC wmema wmemq sndbuf rcvbuf 6947dc99 7e08fe9b 1 7 3 0 5 0 0 0 0 2020 1202 194.0.137.234 194.0.137.189 <-> *93.95.48.82 93.95.48.90 7500 2 10 10 0 2 9 1 0 212992 212992 The application opens up a IPv6 socket with IPv4 conversion. It opens a listener socket on 2020 and had a connection with the indicated IPs (its multihomed with two IPs). The entry in /proc/net/sctp/assocs refers to the association which is being kept alive by the remote but in ss -a --sctp you can see its "unconnected" and listening. So the connection above should be handed over to the listener port and a SCTP UP message should be delivered to the application upon which my application would call sctp_peeloff and everything would restart. quite confusing. > On 5 Oct 2020, at 19:16, Marcelo Ricardo Leitner <marcelo.leitner@xxxxxxxxx> wrote: > > Hi, > > On Mon, Oct 05, 2020 at 06:39:22PM +0200, Andreas Fink wrote: > ... >> What we now see in netstat --sctp is: >> >> we have a LISTEN on port 2010 >> we have a association from port 2010 to the remote in status CLOSED >> >> in tcpdump we see packets coming in from the remote and heartbeat being acknowledged. However our application is not answering to these packets and the status of the application shows SCTP being down. >> In other words, my application sees the association down. Netstat shows the association as being closed but the kernel seems to continue to entertain this association by continue to send heartbeat ACK and not sending ABORT. > > That's weird. If it is in CLOSED, then the stack should be handling > it as an OOTB packet and trigger an Abort. > >> >> We now kill the application >> >> What we now see in netstat --sctp is: >> we no longer listen on port 2010 >> we have a closed association from port 2010 to the remote. >> >> in tcpdump we however we STILL see packets coming in from the remote and heartbeat being acknowledged, even though no application is listening on this port and no userspace application is using that port. >> We do not see any SHUTDOWN or INIT even if we restart the application. >> >> Can anyone explain how this can be? > > Please check the assoc status as well, via 'ss -a --sctp' and > /proc/net/sctp/assocs . Maybe it got out of sync of the socket status. > > Marcelo
