Jane Lewis's Weblog

Platforms, Active Directory,Administration, Management,Women in Technology, Random Thoughts

Explaining Close_Wait

Explaining Close_Wait

  • Comments 13
  • Likes

I have been working with a customer recently who has a print server that has had its spooler crashing after a 3rd Party service running on it was locking up and freezing and falling over.

One of the signs it was about to fall over was running the following command against the server and seeing lots and lots of Close_waits. This was observed by running the

Netstat –an command. Example output below.netstat2

So what do the “State” actually mean. And what is the significance of Close_Wait.

Understanding the TCP sequence of steps for socket closing

As the TCP conversation is a ports and sockets sequence, to understand how to troubleshoot it and carry out root cause analysis. This was an excellent blog that explains this tcp socket conversation very well


Also see below for the explanation of the different states sockets can enter into as part of that conversation.

State Description


Indicates that the server has received an ACK signal from the client and the connection is closed

Indicates that the server has received the first FIN signal from the client and the connection is in the process of being closed

So this essentially means that his is a state where socket is waiting for the application to execute close()

A socket can be in CLOSE_WAIT state indefinitely until the application closes it.
Faulty scenarios would be like filedescriptor leak, server not being execute close() on socket leading to pile up of close_wait sockets

Indicates that the server received the SYN signal from the client and the session is established

Indicates that the connection is still active but not currently being used

Indicates that the client just received acknowledgment of the first FIN signal from the server

Indicates that the server is in the process of sending its own FIN signal

Indicates that the server is ready to accept a connection

Indicates that the server just received a SYN signal from the client

Indicates that this particular connection is open and active

Indicates that the client recognizes the connection as still active but not currently being used

So the explanation for a close_wait situation is as below;

CLOSE is an operation meaning "I have no more data to send." that is the

client/server has chosen to treat CLOSE in a simplex fashion. The user who CLOSEs

may continue to RECEIVE Until he is told that the other side has CLOSED also. Thus,

a program/application could initiate several SENDs followed by a CLOSE, and then

continue to RECEIVE until signalled that a RECEIVE failed because the other side has

CLOSED. We assume that the TCP will signal a user, even if no RECEIVEs are

outstanding, that the other side has closed, so the user can terminate his side

gracefully. A TCP will reliably deliver all buffers SENT before the connection was

CLOSED so a user who expects no data in return need only wait to hear the

connection was CLOSED successfully to know that all his data was received at the

destination TCP. Users must keep reading connections they close for sending until

the TCP says no more data.

 Adjusting Registry Settings

Registry keys to look at which can sometimes help to configure and adjust this conversation.




TCP Connection States and Netstat Output




• MaxUserPort

This entry makes more ports available. 

• TcpTimedWaitDelay

Reducing this value from its default setting of 240 seconds will make ports expire sooner. This parameter determines the length of time that a connection stays in the TIME_WAIT state when it is being closed. While a connection is in the TIME_WAIT state, the socket pair cannot be reused. This is also known as the 2MSL state because the value should be double the maximum segment lifetime on the network. See RFC 793 for more details. 

  • I don't have MaxUserPort & TcpTimedWaitDelay in Windows 7 Professional and in Windows Server 2008.

    I have written a service with Qt which sometimes doesn't close connections to it's clients and the socket stays forever in "CLOSE_WAIT". I don't really know how to force close. I don't care if the client still has some data to send. If I say "close" it should close as fast as possible. Any suggestions?

  • Maybe I understood "CLOSE_WAIT" wrong. After reading again I understand that "CLOSE_WAIT" means the client closed the connection and my application has to react. Ok...

  • @MaxU: Incorrect.
    CLOSE_WAIT means client has not closed the connection. the server handled request.
    the client need explicitly close connnection.

  • Richards proved helpful as a Expert Plumber before operating at Viega, and has positive factors to say about a career in water program. Richards became a item instructor at Viega after he was fired from his job truly. https://www.rebelmouse.com/venusfactorreviewslogin/

  • I have written a service with Qt which sometimes doesn't close connections to it's clients and the socket stays forever in. http://regulationofmanifestation.edublogs.org/

  • Maybe I understood "CLOSE_WAIT" wrong. After reading again I understand that "CLOSE_WAIT" means the client closed the connection and my application has to react. Ok...http://finance-icombank.blogspot.com

  • When someone will pay to sign-up bogus application, they get an initial rule that they need to turn the bogus to the full edition. https://www.rebelmouse.com/oldschoolnewbodypdfreview/

  • Your blog is STELLAR! I mean, I've never been so entertained by anything in my life! Your vids are perfect for this. I mean, how did you manage to find something that matches your style of writing so well? I'm really happy I started reading this today. https://www.rebelmouse.com/venusfactor_reviews/

  • It is really good to read such a nice writing. I have searched couple of days and found some interesting writing on it. But it is the best of all. Thanks for writing this. I really appreciate your writing. http://www.allukdeals.com

  • The own perform contains more forays into the RPG industry. Here's expecting for more, because the Wii is ideal for the structure. http://talk.stmikganesha.ac.id/index.php/13869-investigation-engine-optimization-what-search-engine-optimizati

  • A very interesting all worth visiting. I’m glad I found this article. It has helped me a lot. http://www.healthforus.info

  • Very good post, it was an interesting read. You're quite the unique author, but I definitely applaud you for your writing style, definitely unique.

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment