https延迟TIME_WAIT连接

从我的客户端PC连接到networking服务器,它只使用HTTPS。

当我连接时,我看到在TCPView(sysinternals工具替代netstat)很多TIME_WAIT连接到https端点。 很多时候我在TIME_WAIT看到11个连接持续2分钟。 这是每次我做一个请求。 2-4连接保持打开ESTABLISHED不pipe多久我设置服务器的Keep-Alive: timeout=xx

后面的连接是可以的,它们被适当的重用。 前连接build立并采取全部2分钟。

我使用WireShark捕获stream量,并在延迟连接的源端口上看到正常的FIN,ACK等。 我经常看到Chrome和IE(它们都使用Windows HTTP协议栈),在任何带有真实数据的请求出现之前发出6个TCP请求。 有效载荷很小(约2000字节)。

Firefox根本不会发出这些请求…

还值得一提的是,证书是自签名的,并不在浏览器中进行validation(Firefox的处理方式完全不同于Chrome)。

为什么我的浏览器发出这些请求? 为什么Firefox不能发出这些tcp连接?

编辑,这是从Chrome的第一个连接转储(用wireshark捕获):

  "https","0.000000",local-ip,dest-ip,"443","TCP","53890 > https [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=8 SACK_PERM=1" "53890","0.012749",dest-ip,local-ip,"53890","TCP","https > 53890 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1400 WS=1 SACK_PERM=1" "https","0.012828",local-ip,dest-ip,"443","TCP","53890 > https [ACK] Seq=1 Ack=1 Win=65792 Len=0" "53890","0.025979",dest-ip,local-ip,"53890","TCP","https > 53890 [ACK] Seq=1 Ack=222 Win=128578 Len=0" "53890","0.026099",dest-ip,local-ip,"53890","TLSv1.1","Server Hello, Certificate, Server Hello Done" "53890","0.038848",dest-ip,local-ip,"53890","TCP","https > 53890 [ACK] Seq=1093 Ack=436 Win=128364 Len=0" "53890","0.040474",dest-ip,local-ip,"53890","TLSv1.1","Change Cipher Spec, Encrypted Handshake Message" "https","0.041191",local-ip,dest-ip,"443","TCP","53890 > https [FIN, ACK] Seq=436 Ack=1168 Win=64512 Len=0" "53890","0.053312",dest-ip,local-ip,"53890","TCP","https > 53890 [ACK] Seq=1168 Ack=437 Win=128364 Len=0" "53890","0.053313",dest-ip,local-ip,"53890","TCP","https > 53890 [FIN, PSH, ACK] Seq=1168 Ack=437 Win=128364 Len=0" "https","0.053345",local-ip,dest-ip,"443","TCP","53890 > https [ACK] Seq=437 Ack=1169 Win=64512 Len=0" 

这是完全正常的。

浏览器对Web服务器的每个新请求都是一个TCP连接,它将使用一个新的套接字。

在握手,数据传输和优雅的closures之后,套接字将在TIME_WAIT中,直到内核的定时器到期。

TIME_WAIT定时器在TCP RFC(RFC 793)中定义为最大段生存时间的2倍。 MSL被任意定义为2分钟。

根据操作系统中TCP的实现情况,这个定时器可能会或可能不会被遵守。 例如,较早的BSD在1分钟到4分钟之间变化了TIME_WAIT。