Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I do netstat -a on my Windows machine, I get a listing of the ports with one of the four states:

  • LISTENING
  • CLOSE_WAIT
  • TIME_WAIT
  • ESTABLISHED

What do CLOSE_WAIT and TIME_WAIT mean/indicate?

share|improve this question
    
    
see 'man netstat', scroll down to the state section: linux.die.net/man/8/netstat – MaQleod Apr 10 '14 at 18:26
1  
Shameless plug to an answer on our sistersite Server Fault. – Hennes Jun 24 '15 at 19:46
up vote 102 down vote accepted

Due to the way TCP/IP works, connections can not be closed immediately. Packets may arrive out of order or be retransmitted after the connection has been closed. CLOSE_WAIT indicates that the remote endpoint (other side of the connection) has closed the connection. TIME_WAIT indicates that local endpoint (this side) has closed the connection. The connection is being kept around so that any delayed packets can be matched to the connection and handled appropriately. The connections will be removed when they time out within four minutes. See http://en.wikipedia.org/wiki/Transmission_Control_Protocol for more details.

share|improve this answer
3  
The weasel words "other side" and "this side" are confusing. Can we have this rewritten (correctly) with "source" and "destination" instead? – ADTC Mar 12 '14 at 8:11
48  
@ADTC No, because that wouldn't make sense -- TCP is full-duplex, either side can be the source or destination. The correct words would be "local endpoint" and "remote endpoint". – Jonathon Reinhart Apr 28 '14 at 1:03
    
@JonathonReinhart, It's just "local" and "remote". "endpoint" is redundant. – Pacerier Jan 23 at 3:29
2  
@Pacerier Except "endpoint" is a noun and "local" isn't. – Jonathon Reinhart Jan 23 at 5:16
1  
@JonathonReinhart, Both "local" and "remote" can be nouns. That aside, I found another discussion here which states it's "local / peer" instead of "local / remote": stackoverflow.com/questions/14388706/… – Pacerier Jan 23 at 18:08

Basically the "WAIT" states mean that one side closed the connection but the final confirmation of the close is pending.

See e.g. this diagram of TCP states for details:

http://www.jxos.org/Projects/TCP/tcpstate.html

share|improve this answer
8  
This accurately describes CLOSE_WAIT but not TIME_WAIT. TIME_WAIT indicates that the local application closed the connection, and the other side acknowledged and sent a FIN of its own. We're now waiting for any stray duplicate packets that may upset a new user of the same port. – Chris Smowton Apr 10 '14 at 12:11
    
@ChrisSmowton, So who is using the right terminology? The diagram or netstat? (cf.) – Pacerier Jan 23 at 3:38
    
@Pacerier I think they match -- where do you think they disagree? – Chris Smowton Feb 1 at 16:42

TIME_WAIT represents waiting for enough time to be sure that remote TCP received the ACK of its FIN request. See en.wikipedia.org/wiki/Transmission_Control_Protocol (and also RFC 793)

share|improve this answer
    
What does this add to the information provided by the existing answers? – fixer1234 May 20 at 16:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.