TCP connections transition through a well-defined set of states defined in RFC 793. Understanding these states is critical for debugging network issues (the netstat or ss command shows them).
The TCP State Machine
CLOSED
│
│ (passive open) (active open)
├───→ LISTEN ───────────→ SYN_SENT
│ │ │
│ │ (recv SYN) │ (recv SYN+ACK)
│ ↓ ↓
│ SYN_RCVD ───────────→ ESTABLISHED
│ │
│ (active close)
│ │
│ ↓
│ FIN_WAIT_1
│ │
│ (recv ACK) │ (recv FIN+ACK)
│ │
│ FIN_WAIT_2 ←─── CLOSE_WAIT
│ │ │
│ (recv FIN) │ │ (send FIN)
│ ↓ ↓
│ TIME_WAIT ─────→ LAST_ACK
│ │ │
│ (timeout) (recv ACK)
│ ↓ ↓
└─────────────────────────── CLOSED ←───────┘Key States
| State | Meaning | Typical ss output |
|---|---|---|
| LISTEN | Server waiting for incoming connection | ss -tlnp shows listening sockets |
| SYN-SENT | Client sent SYN, waiting for SYN-ACK | Brief — usually not visible |
| SYN-RCVD | Server received SYN, sent SYN-ACK | Half-open connections (SYN flood target) |
| ESTABLISHED | Connection active, data flowing | ss -tnp shows active connections |
| FIN-WAIT-1 | Client initiated close, waiting for ACK | Brief |
| FIN-WAIT-2 | Client received ACK, waiting for server’s FIN | Can persist if server forgets to close |
| CLOSE-WAIT | Server received FIN, waiting for app to close | Stuck here = app bug (leaked socket) |
| TIME-WAIT | Client sent final ACK, waiting 2×MSL | Seen on busy clients (normal) |
| LAST-ACK | Server sent FIN, waiting for final ACK | Brief |
| CLOSED | Connection fully terminated | Not visible |
Debugging Common States
- Many CLOSE-WAIT → server application isn’t closing the socket properly (bug)
- Many TIME-WAIT → normal on high-throughput clients, but can exhaust port range
- Many SYN-RCVD → possible SYN flood attack
Q: What does CLOSE-WAIT indicate?
A: The server received a FIN from the client (initiating close) but the server application hasn’t called close() yet. Many CLOSE-WAIT connections suggest the server app has a socket leak — it’s not closing connections properly.
Q: What is TIME-WAIT and why is it needed?
A: After sending the final ACK, the client waits 2×MSL (about 2-4 minutes) in TIME-WAIT. This ensures: (1) the server received the final ACK (retransmits if needed), and (2) any delayed packets in the network expire before a new connection with the same 5-tuple.
Q: How to identify a SYN flood with state machine?
A: A large number of connections in SYN-RCVD state (half-open) indicates a SYN flood attack. The server has sent SYN-ACK but never received the final ACK. These connections consume resources until they time out.
Q: What states are most common in netstat?
A: ESTABLISHED (active connections), TIME-WAIT (completed connections waiting for cleanup), LISTEN (server ports), CLOSE-WAIT (potential application bug if numerous).
Premium Content
Unlock TCP Connection States and all premium lessons with a subscription.
From ₹199.99/year — See plans