If a Windows server has several thousand ports open in LAST_ACK state (as shown by netstat), what could this mean? Is it because one endpoint is waiting for the other to respond?
What does LAST_ACK mean, as a State value in netstat
tcp
Related Topic
- Fast opening and closing connection with a specific port
- Tomcat – Apache Tomcat chokes after 300 connections
- How to determine which TCP/UDP ports are being opened by a given process (linux)
- Linux – What does “connections reset due to unexpected data” in netstat -s mean
- Server 2012 R2 ephemeral ports all slowly being bound
- TCP Flags Explained – What Do TCP:RA, TCP:FA, TCP:PA, TCP:S, TCP:SEC Mean?
Best Answer
The last_ack state (if I recall my TCP stack correctly) is the state when you have received your FIN message to close the connection from your neighbour, but you still need to flush and shut down your connection. You send the final FIN yourself and wait for an ACK.
Typically hanging in last_ack means your application keeps a socket open even when the the other end has finished sending data. This can happen for multiple reasons. There might be a firewall or other load balancer which loses last ACK from the client, and leaves you stuck in the last_ack state. If the connections are not timed out after a few minutes (10 or so) you probably have a bug.
Have a look at the state diagram at http://tangentsoft.net/wskfaq/articles/debugging-tcp.html