netstat -a hang

Applications IP Networking
1

Hi, on our Solaris 10 servers, one day 'netstat -a' command return very slow after TCP output, wait 5 minute on this line -
SCTP:
Local Address Remote Address Swind Send-Q Rwind Recv-Q StrsI/O State
------------------------------- ------------------------------- ------ ------ ------ ------ ------- -----------

'netstat -na' return in seconds but not 'netstat -a'. Next day the issue disappear, 'netstat -a' return in seconds. SCTP output like this -

SCTP:
Local Address Remote Address Swind Send-Q Rwind Recv-Q StrsI/O State
------------------------------- ------------------------------- ------ ------ ------ ------ ------- -----------
localhost localhost 0 0 102400 0 32/32 CLOSED
Just wondering what could be the reason this command return slow. What was it waiting?

Thanks!

2

See man netstat to understand what -n does.

It was trying to look up domain names for each and every IP in the list, which if there's a lot can take ages, and if there's DNS trouble will wait until it times out.

3

So does it mean the connection to DNS server got timeout?

---------- Post updated at 12:06 PM ---------- Previous update was at 12:03 PM ----------

TCP/IP was fine though, only SCTP. The fact that only one days returns 5 minutes, other days in seconds, what area should I ask them to check?

4

Either timed out, or just too many of them. If there's a thousand different IP's connected, that's a thousand DNS lookups. If you want to automate it, always give -n.

I've also noticed netstat hanging sometimes when there's lots of network connections being constantly made and broken, even given -n. The kernel's just too busy, perhaps. It won't hang forever, but can take some seconds. This is normal enough. If it's a problem, you can kill it and try again...

5

That day, netstat -a return after wait 5 minutes. Even we kill it and retry. When you said ' look up domain names for each and every IP in the list', where do they look up? from DNS server or local unix server? and where is the list?

6

It'd just be a normal reverse-DNS lookup, asking a DNS server what domain name has that IP. Where it asks first depends on your configuration.

7

Where to look and in which order is defined in the name service configuration file:

grep ^hosts /etc/nsswitch.conf

Might be a combination of files (/etc/hosts), dns (/etc/resolv.conf), nis (ypwhich), ldap (ldapclient list), nis+ ...