SSL 的奇怪问题 ！

[wohaixiao]

环境：FreeBSD6.2 Apache/2.2.4 (Unix) DAV/2 PHP/5.2.3 mod_ssl/2.2.4 OpenSSL/0.9.8g

用https://www.xxx.com 打开一个较大的页面（有较多图片），每次页面打开到一半的时候服务器就失去响应了（看日志，此时大约建立了200多次https连接）。接着服务器就对这个IP拒绝响应了（ftp,http,https,ssh2都连不上），换其他IP则连接均无问题。

如果是一个没有图片的小页面，则不会出现以上问题。


望有这方面经验或遇到过同样问题的师傅指教解决的方法！

[wohaixiao]

#netstat

Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp4 0 122 test-1.https 242.24.118.125.b.29035 ESTABLISHED
tcp4 0 0 test-1.http 61.175.197.137.23768 ESTABLISHED
tcp4 0 215 test-1.https 242.24.118.125.b.29034 FIN_WAIT_1
tcp4 0 215 test-1.https 242.24.118.125.b.29033 FIN_WAIT_1
tcp4 0 0 test-1.http 61.175.197.137.23761 ESTABLISHED
tcp4 0 0 xx.xx.xx.xx.http 221.194.136.14.44819 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.29032 TIME_WAIT
tcp4 0 0 test-1.http 125.122.111.205.57303 ESTABLISHED
tcp4 0 0 test-1.http 125.122.111.205.57302 ESTABLISHED
tcp4 0 0 test-1.https 242.24.118.125.b.29031 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.29030 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.29029 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.29028 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 61.135.219.15.33961 FIN_WAIT_2
tcp4 0 0 test-1.http 221.12.45.154.21169 ESTABLISHED
tcp4 0 0 test-1.http 221.12.45.154.21160 ESTABLISHED
tcp4 0 0 test-1.https 242.24.118.125.b.29027 TIME_WAIT
tcp4 0 0 test-1.http 125.122.111.205.57298 FIN_WAIT_2
tcp4 0 0 test-1.https 242.24.118.125.b.29026 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.29024 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.194.136.14.44578 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.29023 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 242.24.118.125.b.29022 ESTABLISHED
tcp4 0 0 test-1.https 242.24.118.125.b.29021 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.29020 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.29019 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.29016 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.12.5.10.30432 FIN_WAIT_2
tcp4 0 0 xx.xx.xx.xx.http 221.12.5.10.30431 FIN_WAIT_2
tcp4 0 0 test-1.https 242.24.118.125.b.29015 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.29013 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.29012 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.29011 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.194.136.14.44307 TIME_WAIT
tcp4 0 0 test-1.http lj910405.crawl.y.48622 TIME_WAIT
tcp4 0 0 test-1.http 125.122.111.205.57291 TIME_WAIT
tcp4 0 0 test-1.http 125.122.111.205.57290 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.29010 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.29009 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.29008 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.29007 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.29005 TIME_WAIT
tcp4 0 0 test-1.http 221.12.45.154.21152 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.29002 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.29001 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28998 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28996 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 242.24.118.125.b.28992 TIME_WAIT
tcp4 0 0 test-1.http 125.122.111.205.57289 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28994 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28993 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.194.136.14.44105 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28991 TIME_WAIT
tcp4 0 0 test-1.http 219.129.83.3.37719 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28988 TIME_WAIT
tcp4 0 0 test-1.http tq901003.inktomi.37239 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.12.5.10.30430 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.12.5.10.30429 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28987 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28986 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28985 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28982 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.194.136.14.43881 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28981 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28980 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28979 TIME_WAIT
tcp4 0 0 test-1.http 125.122.111.205.57288 TIME_WAIT
tcp4 0 0 test-1.http 125.122.111.205.57287 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 61.135.219.15.60463 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28978 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28977 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28976 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28973 TIME_WAIT
tcp4 0 0 test-1.http 221.12.45.154.21144 TIME_WAIT
tcp4 0 0 test-1.http 221.12.45.154.21141 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28970 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.194.136.14.43609 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 61.135.190.21.45722 TIME_WAIT
tcp4 0 0 test-1.http crawl-15.cuill.c.59975 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28969 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28968 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28967 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 242.24.118.125.b.28966 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28965 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28964 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28963 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28962 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.12.5.10.30428 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.12.5.10.30427 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28960 TIME_WAIT
tcp4 0 0 test-1.http 221.12.45.154.21129 ESTABLISHED
tcp4 0 0 test-1.http 221.12.45.154.21120 FIN_WAIT_2
tcp4 0 214 test-1.https 242.24.118.125.b.28959 FIN_WAIT_1
tcp4 0 0 test-1.https 242.24.118.125.b.28958 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.194.136.14.43344 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28957 TIME_WAIT
tcp4 0 0 test-1.http 125.122.111.205.57281 TIME_WAIT
tcp4 0 0 test-1.http 125.122.111.205.57279 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28956 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28955 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28954 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28953 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28951 TIME_WAIT
tcp4 0 0 test-1.http 125.122.111.205.57277 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.194.136.14.43077 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28950 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28949 TIME_WAIT
tcp4 0 0 test-1.http 242.24.118.125.b.28948 FIN_WAIT_2
tcp4 0 0 test-1.http 242.24.118.125.b.28947 FIN_WAIT_2
tcp4 0 0 test-1.http 242.24.118.125.b.28946 FIN_WAIT_2
tcp4 0 0 test-1.https 242.24.118.125.b.28945 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 61.135.219.15.59029 TIME_WAIT
tcp4 0 0 test-1.http tq901003.inktomi.37080 TIME_WAIT
tcp4 0 0 test-1.http tq901003.inktomi.36972 TIME_WAIT
tcp4 0 0 test-1.http tq901003.inktomi.36961 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28944 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.12.5.10.30426 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.12.5.10.30425 TIME_WAIT
tcp4 0 0 test-1.http tq901003.inktomi.36799 TIME_WAIT
tcp4 0 0 test-1.http tq901003.inktomi.36769 TIME_WAIT
tcp4 0 0 test-1.http tq901003.inktomi.36734 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28943 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28942 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28941 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28940 TIME_WAIT
tcp4 0 0 test-1.http crawl-15.cuill.c.45155 TIME_WAIT
tcp4 0 0 test-1.http 242.24.118.125.b.28939 FIN_WAIT_2
tcp4 0 0 test-1.http 242.24.118.125.b.28938 FIN_WAIT_2
tcp4 0 0 test-1.http 242.24.118.125.b.28937 FIN_WAIT_2
tcp4 0 0 test-1.http 242.24.118.125.b.28936 FIN_WAIT_2
tcp4 0 0 xx.xx.xx.xx.http 242.24.118.125.b.28931 TIME_WAIT
tcp4 0 0 test-1.http 242.24.118.125.b.28935 FIN_WAIT_2
tcp4 0 0 xx.xx.xx.xx.http 221.194.136.14.42810 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28934 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28933 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28932 TIME_WAIT
tcp4 0 0 test-1.http 125.122.111.205.57254 TIME_WAIT
tcp4 0 0 test-1.http 125.122.111.205.57253 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28925 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28924 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28923 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28922 TIME_WAIT
tcp4 0 0 test-1.http 242.24.118.125.b.28921 FIN_WAIT_2
tcp4 0 0 xx.xx.xx.xx.http 221.194.136.14.42570 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28919 TIME_WAIT
tcp4 0 0 test-1.http 242.24.118.125.b.28918 FIN_WAIT_2
tcp4 0 0 test-1.https 242.24.118.125.b.28917 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28916 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28915 TIME_WAIT
tcp4 0 0 test-1.http 220.181.38.190.46164 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.12.5.10.30418 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.12.5.10.30417 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28914 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28913 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28912 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28911 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 242.24.118.125.b.28909 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.194.136.14.42281 TIME_WAIT
tcp4 0 0 test-1.http 125.122.111.205.57242 TIME_WAIT
tcp4 0 0 test-1.http 125.122.111.205.57241 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28908 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28907 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28906 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28905 TIME_WAIT
tcp4 0 0 test-1.http tq901002.inktomi.40473 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.194.136.14.42020 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28902 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28900 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28899 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28898 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28897 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.12.5.10.30409 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.12.5.10.30407 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28895 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28894 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28893 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28891 TIME_WAIT
tcp4 0 0 test-1.https 242.24.118.125.b.28887 TIME_WAIT
tcp4 0 0 test-1.http crawl-66-249-72-.65141 TIME_WAIT
tcp4 0 0 test-1.http 125.122.111.205.57237 TIME_WAIT
tcp4 0 23 test-1.https 242.24.118.125.b.28886 LAST_ACK
tcp4 0 0 test-1.http 125.122.111.205.57236 TIME_WAIT
tcp4 0 0 test-1.http 125.122.111.205.57235 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.12.5.10.30395 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 221.12.5.10.30394 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 242.24.118.125.b.28885 TIME_WAIT
tcp4 0 0 xx.xx.xx.xx.http 61.135.219.15.53477 TIME_WAIT
tcp4 0 0 test-1.http 125.122.111.205.57199 FIN_WAIT_2
tcp4 0 0 test-1.http 125.122.111.205.57198 FIN_WAIT_2
tcp4 0 0 test-1.http 125.122.111.205.57197 FIN_WAIT_2
tcp4 0 0 xx.xx.xx.xx.http 221.12.5.10.30344 ESTABLISHED
tcp4 0 0 xx.xx.xx.xx.http 221.12.5.10.30343 ESTABLISHED
tcp4 0 0 test-1.http 125.122.111.205.57173 FIN_WAIT_1
tcp4 0 0 xx.xx.xx.xx.http 221.12.5.10.30299 FIN_WAIT_1
tcp4 0 0 test-1.http 59.59.49.142.2707 FIN_WAIT_2
tcp4 0 2405 test-1.http 125.122.111.205.57085 FIN_WAIT_1
tcp4 0 0 test-1.http 125.122.111.205.57049 FIN_WAIT_1
tcp4 0 0 test-1.http 59.173.182.29.3297 FIN_WAIT_2
tcp4 0 0 test-1.http 125.95.189.82.3542 ESTABLISHED
tcp4 0 0 test-1.http 125.122.111.205.57011 FIN_WAIT_1
tcp4 0 0 test-1.http 221.131.147.247.16616 FIN_WAIT_2
tcp4 0 0 test-1.http 125.122.111.205.56968 FIN_WAIT_1
tcp4 0 0 test-1.http 59.173.182.29.3270 FIN_WAIT_2
tcp4 0 0 xx.xx.xx.xx.http 242.24.118.125.b.28374 ESTABLISHED
tcp4 0 96 test-1.ssh 242.24.118.125.b.27603 ESTABLISHED
tcp4 0 0 xx.xx.xx.xx.ssh 221.12.5.10.28075 ESTABLISHED
tcp4 0 33120 test-1.http .39831 ESTABLISHED
tcp4 0 0 test-1.http 125.122.111.205.51880 ESTABLISHED
tcp4 0 0 test-1.http 125.122.111.205.50636 ESTABLISHED
tcp4 0 0 test-1.http 125.122.111.205.50624 ESTABLISHED

[wohaixiao]

失去响应后15分钟左右就会自己恢复正常，一开始怀疑是机房的硬件防火墙问题，向机房的人确认没有通过防火墙后问题依旧。

[kenbaby]

ssl 的shm太小了吧~

[wohaixiao]

SSLSessionCache shmcb:/usr/local/apache2/logs/ssl_scache(5120000)

这个么？增加了10倍，问题依旧。

[yarshure]

http keepalive?

[wohaixiao]

# KeepAlive: Whether or not to allow persistent connections (more than
# one request per connection). Set to "Off" to deactivate.
#
KeepAlive On

#
# MaxKeepAliveRequests: The maximum number of requests to allow
# during a persistent connection. Set to 0 to allow an unlimited amount.
# We recommend you leave this number high, for maximum performance.
#
MaxKeepAliveRequests 100

#
# KeepAliveTimeout: Number of seconds to wait for the next request from the
# same client on the same connection.
#
KeepAliveTimeout 5

[wohaixiao]

查明不是本地路由器的问题，晕死。

不知道有没有方法避免。

[kenbaby]

所有东西全部重新装一遍

[wohaixiao]

确定的几件事：

1，和SSL连接数有关，连接数多才会发生。
2，根据客户端IP来封，每次15分钟左右自动解除。
3，客户端用firefox访问不会被封。

[scyzxp]

[wohaixiao]

感谢楼上的赐教，不过还想问下如果不改变现有的环境的话如何解决这个问题。