Mastering TCP: Decode the 11 Connection States and Solve Nginx TIME_WAIT Issues

Before tackling Nginx TIME_WAIT problems, it is essential to understand the 11 TCP connection states that appear during connection establishment and termination.

Operators typically use

netstat

or

ss

to view current TCP states.

The 11 states consist of five states in the three‑way handshake and six states in the four‑way termination. The diagram below summarizes them:

Three‑Way Handshake

A captured packet trace shows the complete handshake process, matching the state diagram.

CLOSED : Initial state, connection is not open.

LISTEN : Server socket is listening for incoming connections.

SYN_RCVD : Server has received a SYN from the client; a short‑lived intermediate state.

SYN_SENT : Client has sent a SYN and is awaiting the server's SYN‑ACK.

ESTABLISHED : Connection is fully established and data can be transferred.

During the handshake,

CLOSED

and

ESTABLISHED

appear on both client and server, while

LISTEN

and

SYN_RCVD

are typically server‑side and

SYN_SENT

is client‑side. Nginx often acts as both client and server, so distinguishing roles by port is advisable.

Four‑Way Termination

The following diagram illustrates the six termination states:

FIN_WAIT_1 : Client initiates close, sends FIN and waits for ACK.

FIN_WAIT_2 : After receiving ACK, client waits for the server's FIN.

CLOSE_WAIT : Passive side has received FIN and awaits its own close.

LAST_ACK : Passive side has sent FIN and waits for the final ACK.

TIME_WAIT : Active side has received the server's FIN and stays in this state to ensure all packets are drained.

CLOSING : Both sides simultaneously send FIN, leading to this rare intermediate state before moving to CLOSED.

Understanding these states helps quickly locate performance bottlenecks and configure appropriate kernel parameters.

The article sets the stage for a follow‑up discussion on how to efficiently recycle TIME_WAIT sockets in Nginx.