OpenTelemetry Collector与Swoole应用间频繁ACK报文成因咨询

问题背景 #

将OpenTelemetry Collector作为代理与Swoole(PHP)应用部署在同一节点，发现TCP连接出现每15秒一次的ACK互相发送现象，不符合常规TCP连接的表现，需分析触发场景与成因。

抓包数据 #

10:40:33.774730 eth0  In  IP longmao-opentelemetry-collector.default.svc.cluster.local.4318 > new-yisdk-service-cli-66c9cb9b78-dp2dk.33750: Flags [.], ack 1595395123, win 501, options [nop,nop,TS val 4109427885 ecr 4015762947], length 0
10:40:33.774737 eth0  Out IP new-yisdk-service-cli-66c9cb9b78-dp2dk.33750 > longmao-opentelemetry-collector.default.svc.cluster.local.4318: Flags [.], ack 1, win 502, options [nop,nop,TS val 4015778307 ecr 4071644582], length 0
10:40:49.135056 eth0  In  IP longmao-opentelemetry-collector.default.svc.cluster.local.4318 > new-yisdk-service-cli-66c9cb9b78-dp2dk.33750: Flags [.], ack 1, win 501, options [nop,nop,TS val 4109443246 ecr 4015778307], length 0
10:40:49.135058 eth0  Out IP new-yisdk-service-cli-66c9cb9b78-dp2dk.33750 > longmao-opentelemetry-collector.default.svc.cluster.local.4318: Flags [.], ack 1, win 502, options [nop,nop,TS val 4015793667 ecr 4071644582], length 0
10:41:04.476416 eth0  In  IP longmao-opentelemetry-collector.default.svc.cluster.local.4318 > new-yisdk-service-cli-66c9cb9b78-dp2dk.33750: Flags [.], ack 1, win 501, options [nop,nop,TS val 4109458606 ecr 4015793667], length 0
10:41:04.476423 eth0  Out IP new-yisdk-service-cli-66c9cb9b78-dp2dk.33750 > longmao-opentelemetry-collector.default.svc.cluster.local.4318: Flags [.], ack 1, win 502, options [nop,nop,TS val 4015809027 ecr 4071644582], length 0
10:41:19.837258 eth0  In  IP longmao-opentelemetry-collector.default.svc.cluster.local.4318 > new-yisdk-service-cli-66c9cb9b78-dp2dk.33750: Flags [.], ack 1, win 501, options [nop,nop,TS val 4109473967 ecr 4015809027], length 0
10:41:19.837261 eth0  Out IP new-yisdk-service-cli-66c9cb9b78-dp2dk.33750 > longmao-opentelemetry-collector.default.svc.cluster.local.4318: Flags [.], ack 1, win 502, options [nop,nop,TS val 4015824388 ecr 4071644582], length 0
10:41:35.174230 eth0  In  IP longmao-opentelemetry-collector.default.svc.cluster.local.4318 > new-yisdk-service-cli-66c9cb9b78-dp2dk.33750: Flags [.], ack 1, win 501, options [nop,nop,TS val 4109489325 ecr 4015824388], length 0
10:41:35.174236 eth0  Out IP new-yisdk-service-cli-66c9cb9b78-dp2dk.33750 > longmao-opentelemetry-collector.default.svc.cluster.local.4318: Flags [.], ack 1, win 502, options [nop,nop,TS val 4015839747 ecr 4071644582], length 0
10:41:50.534243 eth0  In  IP longmao-opentelemetry-collector.default.svc.cluster.local.4318 > new-yisdk-service-cli-66c9cb9b78-dp2dk.33750: Flags [.], ack 1, win 501, options [nop,nop,TS val 4109504685 ecr 4015839747], length 0
10:41:50.534245 eth0  Out IP new-yisdk-service-cli-66c9cb9b78-dp2dk.33750 > longmao-opentelemetry-collector.default.svc.cluster.local.4318: Flags [.], ack 1, win 502, options [nop,nop,TS val 4015855107 ecr 4071644582], length 0
10:42:05.872673 eth0  In  IP longmao-opentelemetry-collector.default.svc.cluster.local.4318 > new-yisdk-service-cli-66c9cb9b78-dp2dk.33750: Flags [.], ack 1, win 501, options [nop,nop,TS val 4109520045 ecr 4015855107], length 0
10:42:05.872676 eth0  Out IP new-yisdk-service-cli-66c9cb9b78-dp2dk.33750 > longmao-opentelemetry-collector.default.svc.cluster.local.4318: Flags [.], ack 1, win 502, options [nop,nop,TS val 4015870467 ecr 4071644582], length 0
10:42:21.232720 eth0  In  IP longmao-opentelemetry-collector.default.svc.cluster.local.4318 > new-yisdk-service-cli-66c9cb9b78-dp2dk.33750: Flags [.], ack 1, win 501, options [nop,nop,TS val 4109535405 ecr 4015870467], length 0
10:42:21.232723 eth0  Out IP new-yisdk-service-cli-66c9cb9b78-dp2dk.33750 > longmao-opentelemetry-collector.default.svc.cluster.local.4318: Flags [.], ack 1, win 502, options [nop,nop,TS val 4015885827 ecr 4071644582], length 0
10:42:36.571147 eth0  In  IP longmao-opentelemetry-collector.default.svc.cluster.local.4318 > new-yisdk-service-cli-66c9cb9b78-dp2dk.33750: Flags [.], ack 1, win 501, options [nop,nop,TS val 4109550766 ecr 4015885827], length 0
10:42:36.571152 eth0  Out IP new-yisdk-service-cli-66c9cb9b78-dp2dk.33750 > longmao-opentelemetry-collector.default.svc.cluster.local.4318: Flags [.], ack 1, win 502, options [nop,nop,TS val 4015901187 ecr 4071644582], length 0
10:42:51.931373 eth0  In  IP longmao-opentelemetry-collector.default.svc.cluster.local.4318 > new-yisdk-service-cli-66c9cb9b78-dp2dk.33750: Flags [.], ack 1, win 501, options [nop,nop,TS val 4109566126 ecr 4015901187], length 0
10:42:51.931375 eth0  Out IP new-yisdk-service-cli-66c9cb9b78-dp2dk.33750 > longmao-opentelemetry-collector.default.svc.cluster.local.4318: Flags [.], ack 1, win 502, options [nop,nop,TS val 4015916547 ecr 4071644582], length 0
10:43:07.275810 eth0  In  IP longmao-opentelemetry-collector.default.svc.cluster.local.4318 > new-yisdk-service-cli-66c9cb9b78-dp2dk.33750: Flags [.], ack 1, win 501, options [nop,nop,TS val 4109581485 ecr 4015916547], length 0
10:43:07.275816 eth0  Out IP new-yisdk-service-cli-66c9cb9b78-dp2dk.33750 > longmao-opentelemetry-collector.default.svc.cluster.local.4318: Flags [.], ack 1, win 502, options [nop,nop,TS val 4015931907 ecr 4071644582], length 0

成因分析 #

• 这是TCP保活机制的典型行为：TCP保活是系统用来检测长时间空闲连接有效性的机制，避免无效连接持续占用资源。多数操作系统默认的TCP保活探测间隔为15秒，和抓包中的周期完全匹配。
• 发起方为OpenTelemetry Collector：从抓包可以看到，每次ACK交互都是Collector（4318端口）先发探测包，说明Collector端启用了TCP保活配置。OpenTelemetry Collector的网络客户端默认会开启TCP保活，用来维持与业务应用的长连接，确保trace、metrics数据能稳定传输，避免连接意外断开后重建的开销。
• Swoole端的响应符合TCP规范：Swoole作为TCP客户端，收到Collector的保活探测ACK后，会按照TCP协议要求回复ACK，确认连接仍处于可用状态。
• 触发条件为连接空闲：如果连接有业务数据传输，保活探测会被数据报文附带的ACK覆盖，不会出现单独的ACK交互。当前场景下，这段时间Swoole应用没有向Collector发送任何监控数据，连接处于空闲状态，因此保活机制周期性触发单独的ACK交互。

内容的提问来源于stack exchange，提问作者CHIIIINA