We have used F5 Networks load balancing solutions for some time within our company. Two years ago, we decided to implement our own lvs cluster of http servers. Everything is working fairly well, nodes are appropriately load balanced according to lvs-nat scheduling.
Today, I was reviewing normal system activities, inspecting routing configurations and looking at traffic on each of the real servers. I observed the following and was wondering if it was normal on lvs clusters.
This information was captured from the node 192.168.1.43
220.127.116.11:55885 192.168.1.43:80 ESTABLISHED 268m 0 B/s
It seems like the kernel, is allowing connections to stay in the ESTABLISHED state for entirely too long. Ideas on what to check? I've watched the TCP session off and on for the last hour or so and I have not observed any traffic through the ESTABLISHED connection. Why isn't it terminating??? Not too sure on what direction to look on this one.