CMK version: Raw 2.4.0p34
OS version: Debian 12
We run about 3 dozens of HTTPS checks using check_httpv2. Once an hour, sometimes more often, sometimes less often, one of those connections will fail to establish within 10 seconds, and a critical state is raised…
So I went to explore, and I found out that at the same time, Wireshark logs “TCP Port numbers reused”. And indeed, the HTTP client sometimes causes a SYN packet from port X to be sent while the socket is in TIME_WAIT state.
Now, you must know that we are behind a Clavister crap commercial piece of rubbish firewall. I say this, because the senior engineers at Clavister do not seem to understand simple concepts like TCP sequence numbers in the context of port address translation (“do not rewrite them”…), and the company has announced IPv6 support in beta only last year. Anyway, I digress…
Three dozen HTTP connections do not use up 64k of source ports, and it seems to me that SO_REUSEADDR or SO_REUSEPORT are in effect when check_httpv2 does it’s thing.
My question is: given that we are behind a stupid firewall, can I somehow force check_httpv2 to not reuse ports that are in TIME_WAIT state?
Thanks,
martin