What's the difference between port status "LISTENING", "TIME_WAIT", " CLOSE_WAIT" and "ESTABLISHED"?

Question

I use netstat to check my port status.

I was wondering what's the difference between port status LISTENING, TIME_WAIT, CLOSE_WAIT, FIN_WAIT1 and ESTABLISHED?

Answer 1

The manpage of netstat has a brief description of each state:

   ESTABLISHED
          The socket has an established connection.
   SYN_SENT
          The socket is actively attempting to establish a connection.
   SYN_RECV
          A connection request has been received from the network.
   FIN_WAIT1
          The socket is closed, and the connection is shutting down.
   FIN_WAIT2
          Connection is closed, and the socket is waiting for  a  shutdown
          from the remote end.
   TIME_WAIT
          The socket is waiting after close to handle packets still in the
          network.
   CLOSE  The socket is not being used.
   CLOSE_WAIT
          The remote end has shut down, waiting for the socket to close.
   LAST_ACK
          The remote end has shut down, and the socket is closed.  Waiting
          for acknowledgement.
   LISTEN The  socket is listening for incoming connections.  Such sockets
          are  not  included  in  the  output  unless  you   specify   the
          --listening (-l) or --all (-a) option.
   CLOSING
          Both  sockets are shut down but we still don't have all our data
          sent.
   UNKNOWN
          The state of the socket is unknown.

You can use the state transition diagrams (examples here, here and here) to make better sense of the states.

---

Consider two programs attempting a socket connection (call them a and b). Both set up sockets and transition to the LISTEN state. Then one program (say a) tries to connect to the other (b). a sends a request and enters the SYN_SENT state, and b receives the request and enters the SYN_RECV state. When b acknowledges the request, they enter the ESTABLISHED state, and do their business. Now a couple of things can happen:

1. a wishes to close the connection, and enters FIN_WAIT1. b receives the FIN request, sends an ACK (then a enters FIN_WAIT2), enters CLOSE_WAIT, tells a it is closing down and the enters LAST_ACK. Once a acknowledges this (and enters TIME_WAIT), b enters CLOSE. a waits a bit to see if anythings is left, then enters CLOSE.
2. a and b have finished their business and decide to close the connection (simultaneous closing). When a is in FIN_WAIT, and instead of receiving an ACK from b, it receives a FIN (as b wishes to close it as well), a enters CLOSING. But there are still some messages to send (the ACK that a is supposed to get for its original FIN), and once this ACK arrives, a enters TIME_WAIT as usual.

Answer 2

Listen: Service call os using listen() system call "waiting" for a TCP connection. but this system call does not block the server, the service will continue to call accept(), which will block the server when reading an empty queue. after the server calls the listen(), the os will go through the TCP three-way handshake protocol and put an estimated connection into the queue. at this time, the server will wake up from accept() and get a new socket file descriptor for the connection. you can use the new socket fd to read from os queue. at this time your netstate get into "ESTABLISHED"