Monitoring TCP health

The TCPTransmission Control Protocol Health report shows the number of aborted, refused, and ignored connections over time. The report can be categorized by applications, internal hosts, or external hosts. You can drill into particular apps or hosts to view the health for particular traffic.

This report can answers questions such as:

• Why are there so many retransmissions for a particular application or host?"

The definitions of aborted, refused and ignored connections used by the TCP Health report:

• Aborted— Connections were established, but were closed by a RST (reset) issued by either the client or server rather than a clean close. High numbers of aborted connections can point to network or server problems.
• Refused— A SYN packet was observed and a RST or ICMPInternet Control Message Protocol "connection refused" message was received in response. This usually means the server is up, but the application is unavailable or not working correctly. It can also indicate a TCP port scan is occurring.
• Ignored— A SYN packet was observed, but no SYN-ACK response was received. This usually means the server is not responding, does not exist, is not accessible, or is ignoring the connection request. It can also indicate a TCP port scan is occurring.

The TCP Health report displays data about connections over time.

The most unhealthy applications or hosts are shown in the table below the charts. The table shows the number of connections, number of aborted, ignored, and refused connections. You can click the name of the application or host to view the TCP Health details and a graph for that item.

The TCP Health report displays the applications with the most connections.