netstat TIME_WAIT

[Shivkumar]

Dear Sirs,

I am working on HP Apache web server on hpux 11. I gave "netstat -an" command. I saw the output as "TIME_WAIT". I am not able to figure out whether it is good or bad ?

Any help appreciated.

Thanks,
Shiv

[Sandman!]

The TIME_WAIT state occurs after the socket is closed out. The system is monitoring the socket descriptor and will not release it for a few minutes. It's waiting for any delayed packets to turn up from the remote host after acknowledging the connection termination request.

The TIME_WAIT state prevents old socket connections from being reused before all data is 'flushed' off the network.

You can view it with:
# ndd -get /dev/tcp tcp_time_wait_interval

and set it with:
# ndd -set /dev/tcp tcp_time_wait_interval xxxxx

cheers!

[Bejoy C Alias]

See tha attachment

It is normal to have a socket in the TIME_WAIT state for a long period of time. The time is specified in RFC793 as twice the Maximum Segment Lifetime (MSL). MSL is specified to be 2 minutes. So, a socket could be in a TIME_WAIT state for as long as 4 minutes. Some systems implement different values (less than 2 minutes) for the MSL.

[rick jones · Accepted solution]

Strictly speaking, TIME_WAIT is about TCP connections, which are named by the four-tuple of local/remote IP and local/remote port number. By the time a TCP connection has entered TIME_WAIT, the socket is (virtually always) long gone.

It is highly unlikely that anyone would ever need to shorten tcp_time_wait_interval.

The HP-UX TCP stack can deal with a great many connections in TIME_WAIT.

Any application that cannot restart while there are connections in TIME_WAIT is broken.