TCP backlog with handshake

1. Overview

In simple words, the backlog parameter specifies the number of pending connections the queue will hold(also called pending count in incomplete connection queue). When multiple clients connect to the server, the server then holds the incoming requests in a queue. The clients are arranged in the queue, and the server processes their requests one by one as and when queue-member proceeds. The nature of this kind of connection is called a queued connection. The backlog has an effect on the maximum rate at which a server can accept new TCP connections on a socket. The rate is a function of both the backlog value and the time that connections stay in the queue of partially open connections.

2. Description

2.1 Process(with Three-way handshake)

Each listening socket in TCP/IP stack has two queues

1. Incomplete connection queue
2. Complete connection queue.

When SYN arrives from the client, TCP creates a new entry in on the incomplete queue and then responds with the second segment of the three-way handshake which is SYN/ACK to the client. This entry will remain on the incomplete queue until the third segment of the three-way handshake which is ACK arrives from a client or until the entry times out (timeout is 75 seconds by default e.g. no option tcp_keepinit=150). If the three-way handshake completes normally, the entry moves from the incomplete queue to the end of completed queue. When server application calls accept(), the first entry from completed queue is processed.

 

3. References

https://www.ibm.com/support/pages/what-discarded-due-listeners-queue-full-counter-netstat-s-output

https://stackoverflow.com/questions/36594400/what-is-backlog-in-tcp-connections

https://www.linuxjournal.com/files/linuxjournal.com/linuxjournal/articles/023/2333/2333s2.html#targetText=TCP%20listen()%20Backlog,queue%20of%20partially%20open%20connections.