TIME_WAIT

TIME_WAIT is a TCP state entered by the endpoint that actively closes a connection. The socket stays in this state for a period, typically 60 seconds on Linux, so delayed packets from the old connection are not mistaken for a new one using the same address and port pair.

Why it matters

TIME_WAIT is normal and healthy. It becomes a problem only on hosts that open and close huge numbers of short connections to the same destination, such as a proxy calling a backend without connection reuse. Thousands of sockets can pile up and the pool of ephemeral source ports runs out, causing connection errors.

Example

Count states on a Linux host:

ss -tan | awk '{print $1}' | sort | uniq -c

A result like 28000 TIME-WAIT on a proxy suggests a lack of connection reuse. Fix it by enabling keep-alive to the backend, using connection pools, and widening the local port range if needed:

sysctl net.ipv4.ip_local_port_range

Avoid tuning options sold as quick fixes without understanding them, since some break correctness for clients behind NAT.

Common mistakes

• Treating a high TIME_WAIT count on a busy server as an attack.
• Lowering the timeout instead of reusing connections.
• Forgetting that the side that closes first holds the state, so server design affects it.

Related

• Port exhaustion
• Keep-alive
• Three-way handshake
• TCP keepalive

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.