Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

netstat -o includes some timer information in the output but I haven't found an explanation of the output in the Timer column anywhere.
Can anybody explain this or point to an explanation?

This ist what the ouptput of netstat -o looks like (on Ubuntu 8.04).

Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       Timer
tcp        0      0     ESTABLISHEDkeepalive (6176.47/0/0)
tcp        0      0    TIME_WAIT  timewait (36.57/0/0)
tcp        0    924         ESTABLISHEDon (0.34/0/0)
tcp        0      0     ESTABLISHEDkeepalive (6963.60/0/0)
tcp        0      0     ESTABLISHEDkeepalive (1393.60/0/0)
tcp        0      0         ESTABLISHEDoff (0.00/0/0)
tcp        0      0         ESTABLISHEDoff (0.00/0/0)
tcp        0    940         ESTABLISHEDon (0.28/0/0)
tcp        0      0    TIME_WAIT  timewait (31.57/0/0)
tcp        0      0         ESTABLISHEDoff (0.00/0/0)
tcp        0      0         ESTABLISHEDoff (0.00/0/0)
share|improve this question

2 Answers 2

up vote 2 down vote accepted

The first number is clearly the countdown timer. Depending on status type, once the timer times out, it will retry and send out another FIN or whatever needed packet to try again. So the second number keeps track of the number of retries. Notice that the timer increases because TCP has backoff timers in case there is a traffic condition. The backoff timer avoids excessively frequent retries. Each failure results in a larger and larger backoff. The backoff could be exponential growth or linear, depending on TCP stack. I have not figured out what the 3 figure is for. Always zero in my displays.

share|improve this answer

First field: timewait/keepalive

Time in seconds from when the last data was transferred until when the next TCP keepalive probe will be sent. By default this starts at 7200s, and resets again every time more data is sent. If the value is low , for eg. 4000 seconds , it means some of the keep alive connections are hanging or doing nothing for a long period. Note, connections to internal proxy or other internal processes might hang longer but this should not happen to web based connection.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.