Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In Windows 7's Resource Monitor, in the TCP Connections graph at the top right -- how are those connections being counted? Does a "listening" state count, for example? Does it matter what state a connection is in to be counted?

NOTES

I'm unsure whether the total number of those graphed TCP connections correlate directly with the number of connections listed under the TCP Connection subsection, which shows connections and their associated program.

A friend called me for help, asking about their computer that had lost internet 45 minutes ago due to an ISP-side outage (per modem lights). Out of curiosity, I asked them to check the TCP connection count in Resource Monitor. Strangely, it was showing 160 TCP connections in the graph, despite the computer being internet-less for nearly an hour. I found this strange that there would be so many connections, having been internet-less for an hour.

Unfortunately, I wasn't able to diagnose any potential running programs they may have had, especially ones showing TCP connections.

share|improve this question
2  
A TCP connection is a TCP connection. All TCP connnections are counted. A dead TCP connection can stay alive until the program releass the port. –  Ramhound May 9 '13 at 13:14
    
So a listening port counts as an actual connection? I guess it's the semantics that throws me off, thinking that a connection isn't a connection until there are at least two IP addresses involved. –  Coldblackice May 9 '13 at 19:15
2  
TCP connections remain open until closed. You could hibernate a PC, send it to alpha centauri, let the centaurians wake that PCs up and continue with the exact same connections--now over the interstellar network (provided it keeps its IP address, e.g using some NAT scheme). The terrestrial connection end would patiently wait for the remote end to arrive at alpha centauri. –  artistoex Jul 2 '13 at 14:43
1  
@artistoex Is there a tutorial for how to do that? –  Coldblackice Jul 4 '13 at 22:46
1  
@Coldblackice You should post another question for that ;-) –  artistoex Jul 5 '13 at 6:39

1 Answer 1

Listening does not count as a connection. Here's how it works: the listening computer is waiting for a remote computer to send a TCP SYN packet to initiate a connection for that TCP port. The listening computer responds with a SYN ACK packet acknowledging that it received the SYN packet. The remote computer then responds with a TCP ACK packet. This is now officially a TCP connection. When a TCP connection ends gracefully, one of the computers will sen a TCP FIN packet and the other responds with a TCP RST or reset packet, and the connection is closed. If neither computer sends a FIN or RST packet, both sides assume that the connection is still valid even if its idle. Of course, there is a limit to how long a computer will keep a connection with no activity. This is the TCP connection timeout value and it varies from one application to another.

I agree with you that 30 minutes does seem like a long time.

share|improve this answer
    
Those connections could have been loopback connections, o simply close_wait connections. The easiest way to check would be to run netstat -n –  gnp Jul 10 '13 at 18:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.