netstat

Linux and Unix-Like Red Hat
1

Hi

Can any body tell me about TIME_WAIT status meaning in the following command output.

[root@mbzsadm2 ~]# netstat -anp|grep 5000
tcp        0      0 127.0.0.1:50006             0.0.0.0:*                   LISTEN      5058/ccsd
tcp        0      0 0.0.0.0:50008               0.0.0.0:*                   LISTEN      5058/ccsd
tcp        0      0 172.18.57.12:19937          10.154.0.76:5000            ESTABLISHED 29100/java
tcp        0      0 172.18.57.12:19939          10.154.0.76:5000            ESTABLISHED 29100/java
tcp        0      0 172.18.57.12:19940          10.154.0.76:5000            ESTABLISHED 29100/java
tcp        0      0 172.18.57.12:49679          10.154.0.76:5000            TIME_WAIT   -
tcp        0      0 172.18.57.12:49694          10.154.0.76:5000            TIME_WAIT   -
tcp        0      0 172.18.57.12:49687          10.154.0.76:5000            TIME_WAIT   -
tcp        0      0 172.18.57.12:49723          10.154.0.76:5000            TIME_WAIT   -
udp        0      0 0.0.0.0:50007               0.0.0.0:*                               5058/ccsd

Regards,
Mastan

2

Hi Mastan,

tcp 0 0 172.18.57.12:49679 10.154.0.76:5000 TIME_WAIT -

This means the servers are waiting for the connection.You can also check 

man netstat
 
 TIME_WAIT
 
 The socket is waiting after close to handle packets still in the network.
3

As mentioned by others, having some connections in TIME_WAIT is a normal part of the socket close process. If you have a large number of TIME_WAIT connections you might want to decrease the wait interval.

You can see the current number of seconds by examining /proc/sys/net/ipv4/tcp_fin_timeout:

# cat /proc/sys/net/ipv4/tcp_fin_timeout
60

And modify the value:

# echo 45 > /proc/sys/net/ipv4/tcp_fin_timeout
4

They are TCP-states only!!!

If an application using STREAM sockets; tcp protocol thread serve them and each such thread, at any point in time during the socket operations, has an state out of a total of 11 defined TCP states, based on the phase of the communication. This includes the beginning (right from the 1st SYN in the 3-way handshake) to the termination of the communication (when you close a socket).

The 'netstat' shows these states of all the TCP threads serving their corresponding sockets.

Please look at RFC#793.

Attaching the text showing TCP state change diagram.
The diagram depicts the states a TCP thread under goes (taken from RFC#793).