What are CLOSE_WAIT and TIME_WAIT states?

When I do netstat -a on my Windows machine, I get a listing of the ports with one of the four states:

- LISTENING
- CLOSE_WAIT
- TIME_WAIT
- ESTABLISHED

What do CLOSE_WAIT and TIME_WAIT mean/indicate?

3 Answers

Due to the way TCP/IP works, connections can not be closed immediately. Packets may arrive out of order or be retransmitted after the connection has been closed.

• CLOSE_WAIT indicates that the remote endpoint (other side of the connection) has closed the connection.
• TIME_WAIT indicates that local endpoint (this side) has closed the connection.

The connection is being kept around so that any delayed packets can be matched to the connection and handled appropriately. The connections will be removed when they time out within four minutes. See for more details.

Basically the "WAIT" states mean that one side closed the connection but the final confirmation of the close is pending.

See e.g. this diagram of TCP states for details:

TIME_WAIT represents waiting for enough time to be sure that remote TCP received the ACK of its FIN request. See (and also RFC 793)