Java 未可知的节俭错误

我们发现了很多错误消息，如下所示：

[ERROR 2015-07-10 20:00:02.105] [Thread-60] org.apache.thrift.server.TNonblockingServer$FrameBuffer.read(TNonblockingServer.java:542) [Read a frame size of 1246907721, which is bigger than the maximum allowable buffer size for ALL connections.]
[ERROR 2015-07-10 20:13:05.597] [Thread-60] org.apache.thrift.server.TNonblockingServer$FrameBuffer.read(TNonblockingServer.java:542) [Read a frame size of 1246907721, which is bigger than the maximum allowable buffer size for ALL connections.]
[ERROR 2015-07-10 20:20:01.609] [Thread-60] org.apache.thrift.server.TNonblockingServer$FrameBuffer.read(TNonblockingServer.java:542) [Read a frame size of 1246907721, which is bigger than the maximum allowable buffer size for ALL connections.]
[ERROR 2015-07-10 20:30:01.971] [Thread-60] org.apache.thrift.server.TNonblockingServer$FrameBuffer.read(TNonblockingServer.java:542) [Read a frame size of 1246907721, which is bigger than the maximum allowable buffer size for ALL connections.]
[ERROR 2015-07-10 20:40:02.481] [Thread-60] org.apache.thrift.server.TNonblockingServer$FrameBuffer.read(TNonblockingServer.java:542) [Read a frame size of 1246907721, which is bigger than the maximum allowable buffer size for ALL connections.]
[ERROR 2015-07-10 20:50:02.425] [Thread-60] org.apache.thrift.server.TNonblockingServer$FrameBuffer.read(TNonblockingServer.java:542) [Read a frame size of 1246907721, which is bigger than the maximum allowable buffer size for ALL connections.]

20:50:02.424728 IP localhost.32370 > localhost.9901: Flags [S], seq 697614673, win 32768, options [mss 16396,sackOK,TS val 3592557674 ecr 3592557167,nop,wscale 7], length 0
20:50:02.424744 IP localhost.9901 > localhost.32370: Flags [S.], seq 1999432280, ack 697614674, win 32768, options [mss 16396,sackOK,TS val 3592557674 ecr 3592557674,nop,wscale 7], length 0
20:50:02.425734 IP localhost.9901 > localhost.32370: Flags [R.], seq 1, ack 8, win 256, options [nop,nop,TS val 3592557675 ecr 3592557674], length 0

在mulit服务器上的mulit服务中，每十分钟发生一次异常occer；但我们不知道是谁要求的

然后我们使用tcpdump查找请求的来源。我们发现如下情况：

[ERROR 2015-07-10 20:00:02.105] [Thread-60] org.apache.thrift.server.TNonblockingServer$FrameBuffer.read(TNonblockingServer.java:542) [Read a frame size of 1246907721, which is bigger than the maximum allowable buffer size for ALL connections.]
[ERROR 2015-07-10 20:13:05.597] [Thread-60] org.apache.thrift.server.TNonblockingServer$FrameBuffer.read(TNonblockingServer.java:542) [Read a frame size of 1246907721, which is bigger than the maximum allowable buffer size for ALL connections.]
[ERROR 2015-07-10 20:20:01.609] [Thread-60] org.apache.thrift.server.TNonblockingServer$FrameBuffer.read(TNonblockingServer.java:542) [Read a frame size of 1246907721, which is bigger than the maximum allowable buffer size for ALL connections.]
[ERROR 2015-07-10 20:30:01.971] [Thread-60] org.apache.thrift.server.TNonblockingServer$FrameBuffer.read(TNonblockingServer.java:542) [Read a frame size of 1246907721, which is bigger than the maximum allowable buffer size for ALL connections.]
[ERROR 2015-07-10 20:40:02.481] [Thread-60] org.apache.thrift.server.TNonblockingServer$FrameBuffer.read(TNonblockingServer.java:542) [Read a frame size of 1246907721, which is bigger than the maximum allowable buffer size for ALL connections.]
[ERROR 2015-07-10 20:50:02.425] [Thread-60] org.apache.thrift.server.TNonblockingServer$FrameBuffer.read(TNonblockingServer.java:542) [Read a frame size of 1246907721, which is bigger than the maximum allowable buffer size for ALL connections.]

20:50:02.424728 IP localhost.32370 > localhost.9901: Flags [S], seq 697614673, win 32768, options [mss 16396,sackOK,TS val 3592557674 ecr 3592557167,nop,wscale 7], length 0
20:50:02.424744 IP localhost.9901 > localhost.32370: Flags [S.], seq 1999432280, ack 697614674, win 32768, options [mss 16396,sackOK,TS val 3592557674 ecr 3592557674,nop,wscale 7], length 0
20:50:02.425734 IP localhost.9901 > localhost.32370: Flags [R.], seq 1, ack 8, win 256, options [nop,nop,TS val 3592557675 ecr 3592557674], length 0

请求上下文长度7为：“JRMI..K”

因为请求进行得非常快，所以我们不能使用lsof或netstat来确定是哪个进程发送它

那么，我们有什么办法来找出发生了什么

---

非常感谢。

您的Thrift server正在侦听哪个端口？从端口32370连接到哪个端口？您的Thrift server正在侦听哪个端口？从端口32370连接到哪个端口？