netstat CLOSE_WAIT status

[John Ferro]

Hello,

I have "ia64 hp superdome server SD64B" HPUX11i v2. when i issue a command netstat -a |grep (destination server), i got output CLOSE_WAIT status. Since I'm getting backup failure as connection between host and backup server is failing. Port#7937

Kindly your help,
John.

[Prashanth Waugh]

Hi John,

Please look in to below file

1) /etc/services
2)/var/adm/inetd.sec

check the below command
#telnet
============================
What tool you are using for backup purpose

Regards
Prashant

[zkjian517]

The CLOSE_WAIT shows that your host closed the connection between him and the backup server positively. so you should find out why your backup tool or the OS of your host did that.

[Michal Kapalka (mikap)]

hi,

getting backup failure as connection between host and backup server is failing. Port#7937

are you using Veritas Netbackup Software for the backup ??? If yes did uou patch the system ??? if yes you need to remove a PHSS patch from your servers.

mikap

PS : if this is your situation, i will provie exact patch number. It can be removed without reboot of the server.

[Steven E. Protter]

Shalom,

CLOSE_WAIT is almost always from an application that does not properly close its connection.

I would check with the application vendor for a fix. If the connection stays open, its is the application because by default these connections will be closed by the system in 60 seconds.

SEP

[zkjian517]

Sorryï¼ i misunderstood the meaning of the status CLOSE_WAIT.

[rick jones · Accepted solution]

CLOSE_WAIT is the state a TCP endpoint enters when it has received a FINished segment from the remote TCP, indicating the remote TCP will not be sending any more data. The local TCP sends an ACKnowledgement segment and when that arrives at the remote, the remote TCP endpoint will be in FIN_WAIT_2.

99 times out of 10, when a connection remains in CLOSE_WAIT for more than a fraction of a second, it means that the local application (the one where CLOSE_WAIT is found) has not looked for, or has ignored the "close indication" on the socket - eg the zero-byte return from a read() call.

The 100th time out of ten, it means the connection is being used as a simplex connection transferring data from the CLOSE_WAIT end to the FIN_WAIT_2 end.

[DeafFrog]

Hello John ,

And this is the one that i use,written by none other than Rick himself..........Many Thanks Rick !

[Laurent Menase]

99 over ten doesn't leave many place for the other options.


1) application like rcp are using half closed connections ( call of shutdown(SHUT_WRITE) )
to send a FIN.
2) local application is not closing its local socket because doing something else or application error
3) Application on lingering close but with peer receive window closed.

I would say 50 over 100 it is 2, 49 over 100 it is 1) and the last 1 over 100 is 1)

[John Ferro]

Thanks...