Re: interpreting netstat results

From: Bob Booth - UIUC (booth@UIUC.EDU)
Date: Tue Dec 02 2003 - 13:51:11 EST


It is part of a 'passive close' TCP operation. LAST_ACK state should
transition to CLOSED in 30 seconds.

The state transition looks like this:

ESTABLISHED --> CLOSED_WAIT --> LAST_ACK --> CLOSED

hope this helps.

bob

On Tue, Dec 02, 2003 at 12:36:33PM -0500, Vipin Khushu wrote:
> Does anyone know what to make of the "LAST_ACK" in the output of netstat?
>
> # netstat
>
> Active Internet connections
>
> Proto Recv-Q Send-Q Local Address Foreign Address
> (state)
> tcp4 0 0 companyname.company.8765 123.456.789......
> LAST_ACK
>
> where 8765 is the port number.
>
> Our shopping website was non-functional while the LAST_ACK state persisted.
>
> Upon waiting a few minutes, the following change occurred without any
> intervention on our part (which allowed the site to function normally once
> again):
>
> # netstat
>
> Active Internet connections
>
> Proto Recv-Q Send-Q Local Address Foreign Address
> (state)
> tcp4 0 0 companyname.company.8765 *.*
> LISTEN
> tcp4 0 0 companyname.company.8766 *.*
> LISTEN
>
> man netstat did not have anything useful (based on a quick review) that
> would explain how to interpret the (state) messages.
>
> TIA
>
> Vipin



This archive was generated by hypermail 2.1.7 : Wed Apr 09 2008 - 22:17:23 EDT