none
CLOSE_WAIT and TIME_WAIT status in Netstat

    Question

  • What are the possible causes for many TCP port connections that are in a CLOSE_WAIT and TIME_WAIT status on a Windows 2008 Server? I see this when I run a netstat on the server and whoever attempts to log into the server is having problems connecting. Thanks for your rapid response.
    Wednesday, December 22, 2010 7:33 PM

Answers

  • CLOSE_WAIT Indicates passive close. Server just received first FIN from a client.

    As an example, consider the following scenario: 

    A socket application has been terminated, but Netstat reports the socket in a CLOSE_WAIT state. This could indicate that the client properly closed the connection (FIN has been sent), but the server still has its socket open. This could be the result of one instance (among all threads or processes) of the socket not being closed. 

    NOTE: It is normal to have a socket in the TIME_WAIT state for a long period of time. The time is specified in RFC793 as twice the Maximum Segment Lifetime (MSL). MSL is specified to be 2 minutes. So, a socket could be in a TIME_WAIT state for as long as 4 minutes. Some systems implement different values (less than 2 minutes) for the MSL. 

    For more information, refer to this Microsoft article.



    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

    • Marked as answer by Tiger Li Monday, December 27, 2010 2:21 AM
    Thursday, December 23, 2010 9:30 AM
  • Hi,

     

    Thanks for posting here.

     

    In addition with Mr X’s explanation , you may also refer to Jane Lewis's blog post that discussed this scenario and also provide some good suggestions for this issue :

     

    Explaining Close_Wait

    http://blogs.technet.com/b/janelewis/archive/2010/03/09/explaining-close-wait.aspx

     

    Meanwhile, which services have been deployed on that server ?

     

    Thanks.

     

    Tiger Li

     

    TechNet Subscriber Support in forum

    If you have any feedback on our support, please contact tngfb@microsoft.com


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by Tiger Li Monday, December 27, 2010 2:21 AM
    Friday, December 24, 2010 2:07 AM

All replies

  • CLOSE_WAIT Indicates passive close. Server just received first FIN from a client.

    As an example, consider the following scenario: 

    A socket application has been terminated, but Netstat reports the socket in a CLOSE_WAIT state. This could indicate that the client properly closed the connection (FIN has been sent), but the server still has its socket open. This could be the result of one instance (among all threads or processes) of the socket not being closed. 

    NOTE: It is normal to have a socket in the TIME_WAIT state for a long period of time. The time is specified in RFC793 as twice the Maximum Segment Lifetime (MSL). MSL is specified to be 2 minutes. So, a socket could be in a TIME_WAIT state for as long as 4 minutes. Some systems implement different values (less than 2 minutes) for the MSL. 

    For more information, refer to this Microsoft article.



    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

    • Marked as answer by Tiger Li Monday, December 27, 2010 2:21 AM
    Thursday, December 23, 2010 9:30 AM
  • Hi,

     

    Thanks for posting here.

     

    In addition with Mr X’s explanation , you may also refer to Jane Lewis's blog post that discussed this scenario and also provide some good suggestions for this issue :

     

    Explaining Close_Wait

    http://blogs.technet.com/b/janelewis/archive/2010/03/09/explaining-close-wait.aspx

     

    Meanwhile, which services have been deployed on that server ?

     

    Thanks.

     

    Tiger Li

     

    TechNet Subscriber Support in forum

    If you have any feedback on our support, please contact tngfb@microsoft.com


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by Tiger Li Monday, December 27, 2010 2:21 AM
    Friday, December 24, 2010 2:07 AM
  • Hi,

    If there is any update on this issue, please feel free to let us know.

    We are looking forward to your reply.

    Tiger Li

    TechNet Subscriber Support in forum
    If you have any feedback on our support, please contact tngfb@microsoft.com

     


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Monday, December 27, 2010 2:21 AM