我们发现了很多错误消息，如下所示：
[ERROR 2015-07-10 20:00:02.105] [Thread-60] org.apache.thrift.server.TNonblockingServer$FrameBuffer.read(TNonblockingServer.java:542) [Read a frame size of 1246907721, which is bigger than the maximum allowable buffer size for ALL connections.]
[ERROR 2015-07-10 20:13:05.597] [Thread-60] org.apache.thrift.server.TNonblockingServer$FrameBuffer.read(TNonblockingServer.java:542) [Read a frame size of 1246907721, which is bigger than the maximum allowable buffer size for ALL connections.]
[ERROR 2015-07-10 20:20:01.609] [Thread-60] org.apache.thrift.server.TNonblockingServer$FrameBuffer.read(TNonblockingServer.java:542) [Read a frame size of 1246907721, which is bigger than the maximum allowable buffer size for ALL connections.]
[ERROR 2015-07-10 20:30:01.971] [Thread-60] org.apache.thrift.server.TNonblockingServer$FrameBuffer.read(TNonblockingServer.java:542) [Read a frame size of 1246907721, which is bigger than the maximum allowable buffer size for ALL connections.]
[ERROR 2015-07-10 20:40:02.481] [Thread-60] org.apache.thrift.server.TNonblockingServer$FrameBuffer.read(TNonblockingServer.java:542) [Read a frame size of 1246907721, which is bigger than the maximum allowable buffer size for ALL connections.]
[ERROR 2015-07-10 20:50:02.425] [Thread-60] org.apache.thrift.server.TNonblockingServer$FrameBuffer.read(TNonblockingServer.java:542) [Read a frame size of 1246907721, which is bigger than the maximum allowable buffer size for ALL connections.]
在mulit服务器上的多个服务中，每十分钟一次异常occer;但我们不是谁请求这个。
然后我们使用tcpdump来查找请求的来源。我们发现了类似下面的内容：
20:50:02.424728 IP localhost.32370 > localhost.9901: Flags [S], seq 697614673, win 32768, options [mss 16396,sackOK,TS val 3592557674 ecr 3592557167,nop,wscale 7], length 0
20:50:02.424744 IP localhost.9901 > localhost.32370: Flags [S.], seq 1999432280, ack 697614674, win 32768, options [mss 16396,sackOK,TS val 3592557674 ecr 3592557674,nop,wscale 7], length 0
20:50:02.425734 IP localhost.9901 > localhost.32370: Flags [R.], seq 1, ack 8, win 256, options [nop,nop,TS val 3592557675 ecr 3592557674], length 0
请求上下文长度为7：“JRMI..K”。
因为请求变得非常快，所以我们不能使用lsof或netstat来找出发送它的进程。
那么，有什么我们可以找出什么是happing？
非常感谢。