2

I am requesting a webpage running on local server port 8080 and was expecting one connection to be established between the server (port 8080) and client (random port). But one additional port is also getting created and connecting to the server with TIME_WAIT as status. So just wondering what is this time wait connection about?

Before connection to the webserver

netstat -ntap | grep 8080
tcp6       0      0 :::8080                 :::*                    LISTEN      104965/java 

After connecting to the web page which returned result immediately.

netstat -ntap | grep 8080
tcp6       0      0 :::8080                 :::*                    LISTEN      104965/java         
tcp6       0      0 ::1:8080                ::1:53950               ESTABLISHED 104965/java         
tcp6       0      0 ::1:53948               ::1:8080                TIME_WAIT   -                   
tcp6       0      0 ::1:53950               ::1:8080                ESTABLISHED 20656/_Postman --no 

Port 53950 is the client random port to speak to server and this is understandable.

But what is the function of port 53948 with status TIME_WAIT.

After about one minute the port 53948 connection to server is closed. But the port 54950 moves to TIME_WAIT status.

netstat -ntap | grep 8080
tcp6       0      0 :::8080                 :::*                    LISTEN      104965/java         
tcp6       0      0 ::1:8080                ::1:53950               TIME_WAIT   -

After about few minutes - a new port (54008) is open and is in TIME_WAIT status.

netstat -ntap | grep 8080
tcp6       0      0 :::8080                 :::*                    LISTEN      104965/java         
tcp6       0      0 ::1:54008               ::1:8080                TIME_WAIT   - 

After about 5 minutes - all of the ports are closed

 netstat -ntap | grep 8080
tcp6       0      0 :::8080                 :::*                    LISTEN      104965/java  

Could someone explain what TIME_WAIT is about and why 2 additional ports are required.

12
  • 2
    Have you tried RFC 793?
    – Zac67
    Commented Dec 5, 2020 at 14:44
  • @zac67, thx. How about the additional ports - would the RFC capture this too. I will appreciate if u can summarize in to an answer. RFC's are generally not English :-) for every one.
    – samshers
    Commented Dec 5, 2020 at 14:48
  • There is a clear diagram on page 23 that explains the different states and how to get to them.
    – Ron Maupin
    Commented Dec 5, 2020 at 16:44
  • A new socket connection uses a new ephemeral port - possibly, there's a redirect. Try your browser's network/diagnostic tools, wget, curl, or similar. Also, what you're really asking about is the workings of HTTP which are off-topic here as an application-layer protocol...
    – Zac67
    Commented Dec 5, 2020 at 17:22
  • Yes, RFC's may look like an alien language, but they are perfectly clear english. I know reading is hard, and it's a long block of monospaced text, but it is very clearly documented.
    – Ricky
    Commented Dec 5, 2020 at 17:34

1 Answer 1

1
TIME-WAIT - represents waiting for enough time to pass to be sure
the remote TCP received the acknowledgment of its connection
termination request.

[RFC 792, p.22]

The purpose is to wait long enough for any outstanding traffic to be processed before potential reuse of the port.

1
  • 1
    I would expect tcp to be smart enough to figure out the last packet in fraction of seconds, is not it simple, the last packet would say its the last packet. In my example the last packet definitely arrived and still the TIME_WAIT state was held for few minutes.
    – samshers
    Commented Dec 6, 2020 at 3:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.