Shulou(Shulou.com)06/02 Report--

*

* Date: March 10, 2009

* Environment: AIX 5.3 Oracle10g

WARNING: inbound connection timed out (ORA-3136)

*/

1. alter_SID.log log: aaa

Mon Mar 9 02:18:40 2009

ksvcreate: Process(q002) creation failed

Mon Mar 9 02:32:29 2009

WARNING: inbound connection timed out (ORA-3136)

Mon Mar 9 02:33:02 2009

WARNING: inbound connection timed out (ORA-3136)

Mon Mar 9 02:33:19 2009

WARNING: inbound connection timed out (ORA-3136)

2. sqlnet.log log

Fatal NI connect error 12170.

VERSION INFORMATION:

TNS for IBM/AIX RISC System/6000: Version 10.2.0.1.0 - Production

TCP/IP NT Protocol Adapter for IBM/AIX RISC System/6000: Version 10.2.0.1.0 - Production

Oracle Bequeath NT Protocol Adapter for IBM/AIX RISC System/6000: Version 10.2.0.1.0 - Production

Time: 09-MAR-2009 02:32:29

Tracing not turned on.

Tns error struct:

ns main err code: 12535

TNS-12535: TNS:operation timed out

ns secondary err code: 12606

nt main err code: 0

nt secondary err code: 0

nt OS err code: 0

Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=10.171.4.201)(PORT=3663))

3. Refer to the official instructions for this warning:

Note:465043.1

The "WARNING: inbound connection timed out (ORA-3136)" in the alert log indicates that the client was not able to complete it's authentication within the period of time specified by parameter SQLNET.INBOUND_CONNECT_TIMEOUT.

You may also witness ORA-12170 without timeout error on the database server sqlnet.log file.

This entry would also have the clinet address which failed to get authenticated. Some applications or JDBC thin driver applications may not have these details.

Possible causes:

1. Cyber attacks, such as half-open connection attacks

Server gets a connection request from a malicious client which is not supposed to connect to the database ,

in which case the error thrown is the correct behavior. You can get the client address for which the error was thrown via sqlnet log file.

Client does not complete authentication within 60 seconds of default

The server receives a valid client connection request but the client takes a long time to authenticate more than the default 60 seconds.

DB load is too high

The DB server is heavily loaded due to which it cannot finish the client logon within the timeout specified.

WARNING: inbound connection timed out (ORA-3136)

This error is related to a parameter oracle listens on: SQLNET.INBOUND_CONNECT_TIMEOUT

This parameter, introduced since 9i, specifies the timeout period for the client to connect to the server and provide authentication information. If the client does not provide the correct authentication information after this time, the server will automatically abort the connection request and log the IP address of the attempted connection and the ORA-12170: TNS:Connect timeout occurred error.

The introduction of this parameter is mainly to prevent DoS attacks. Malicious attackers can occupy the connection resources of the server by constantly opening a large number of connection requests, so that the server cannot provide effective services. As of 10.2.0.1, this parameter defaults to 60 seconds

However, the introduction of this parameter also led to some related bugs. For example:

Bug 5594769 - REMOTE SESSION DROPPED WHEN LOCAL SESSION SHARED AND INBOUND_CONNECT_TIMEOUT SET

Bug 5249163 - CONNECTS REFUSED BY TNSLSNR EVERY 49 DAYS FOR INBOUND_CONNECT_TIMEOUT SECONDS

This parameter can be disabled by setting it to 0.

Set sqlnet.ora file: SQLNET.INBOUND_CONNECT_TIMEOUT=0

Set listener.ora file: INBOUND_CONNECT_TIMEOUT_listener name =0

Then reload or restart listening

This is a problem caused by connection timeout. In version 10.2.0.1.0, the sqlnet.inbound_connect_timeout parameter defaults to 60 seconds, which indicates a timeout if the connection time exceeds 60 seconds, while in other 10G versions, these two parameters default to 0, which means no limit.

How to operate:

1. Check the inbound_connect_timeout parameter value in listener.ora in the database

1. Enter lsnrctl,

LHXXDBS01:oraoms> lsnrctl

2. Check inbound_connect_timeout parameter:

LSNRCTL> show inbound_connect_time

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=LHXXDBS)(PORT=1568)))

LISTENER parameter "inbound_connect_timeout" set to 0

The command completed successfully

If the inbound_connect_timeout parameter value is not 0, it can be modified to 0

Modifications:

LSNRCTL> set inbound_connect_time 0

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=LHXXDBS)(PORT=1568)))

LISTENER parameter "inbound_connect_timeout" set to 0

The command completed successfully

The requested URL/admin/index.php was not found on this server.

Vi sqlnet.ora

SQLNET.INBOUND_CONNECT_TIMEOUT = 0

Stay out of WQ!

3. Reload listener

LSNRCTL> reload

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=LHXXDBS)(PORT=1568)))

The command completed successfully

The next day, there was no WARNING: inbound connection timed out (ORA-3136).

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.