What do TCP connection states (such as ESTABLISHED and TIME_WAIT) mean?

Short answer

A TCP connection goes through the states defined in RFC 9293 §3.3.2 while it is being opened, used and closed. Opening happens with the three-way handshake: the client sends SYN (SYN_SENT), the server responds with SYN-ACK (SYN_RECV), and with the client's ACK the connection becomes ESTABLISHED and data flows. At closing, the parties go through the FIN_WAIT1, FIN_WAIT2, CLOSE_WAIT, LAST_ACK and CLOSING states; the party that closes the connection first waits in TIME_WAIT for a while so that late-arriving packets do not get mixed into a new connection. LISTEN is the state of a listener that waits to accept connections. In TR7, these states appear in the Status Code column (despite its name, not an HTTP code but the TCP state) of the vService Sessions list on the Logs & Tracking tab of the vService; the device-wide distribution is in the TCP Connection States, TCP Active Connections and TCP Connection Problems panels on the Network tab of the home page.

Where It Is Used in TR7

Where	Field / label	What for
vService → Logs & Tracking → vService Sessions	Status Code column and filter; values such as TCP_ESTABLISHED, TCP_TIME_WAIT in HTTP and L7 TCP, values without a prefix such as ESTABLISHED, TIME_WAIT in Network vService	Seeing the open connections of the vService and their states (Can I see which connections are currently open (vService Sessions)?)
Home → Network tab	TCP Connection States (Established, Time Wait, Close Wait, FIN Wait 1, FIN Wait 2, Listen, SYN Sent, SYN Received, Last ACK, Closing)	Distribution of the device's TCP connections by state
Home → Network tab	TCP Active Connections (Active, Established, Total), TCP Connection Problems (total of Close Wait, Last ACK, Closing and Time Wait)	The number of active connections and the trend of the connections waiting at closing
L4 DDoS Management screen of the route table	Zombie TCP (Fin Timeout(s), Keepalive Time(s), Established Timeout(s)), Invalid Packets	Cleaning up idle connections; dropping packets that do not match the connection state
WEB-CLI	sys-cmd ss (ss), sys-cmd netstat (netstat)	Listing the sockets on TR7 with their states

States

Status	Meaning
LISTEN	The listener is waiting for a connection
SYN_SENT / SYN_RECV	Handshake in progress
ESTABLISHED	Connection established, data flowing
FIN_WAIT1 / FIN_WAIT2	This side started the closing; the closing of the other side is awaited
CLOSE_WAIT	The other side closed; the closing by the application on this side is awaited
LAST_ACK / CLOSING	The final acknowledgment of the closing is awaited
TIME_WAIT	Connection closed; waiting period for late packets
CLOSE	Connection closed

• A large number of SYN_RECV can point to handshakes that are not completed (e.g. a SYN flood) (What is a SYN Flood attack; which rules does TR7 apply against it?).
• A continuously increasing CLOSE_WAIT points to an application that does not close the connection; the breakdown is read from the TCP Connection States panel.

Common Misconceptions

• "The Status code column shows the HTTP response code." In the vService sessions list, this column shows the TCP connection state; HTTP response codes are seen in the HTTP logs.
• "A large number of TIME_WAIT is an error." TIME_WAIT is the normal waiting state of closed connections; in traffic where short-lived connections are intense, its count is high. This is also why the TCP Connection Problems panel is read by its trend, not by its absolute value.
• "vService sessions also lists past connections." The list shows the currently open connections and does not refresh on its own; Refresh is used for an up-to-date view.

How it is done in the documentation

• vService Sessions · Status Code
• Home · Network · TCP Connection States
• Home · Network · TCP Connection Problems

Related questions

• Can I see which connections are currently open (vService Sessions)?
• What is TCP; where is it used in TR7?
• What is a SYN Flood attack; which rules does TR7 apply against it?