Four-Way Teardown
TCP four-way teardown (FIN, ACK, FIN, ACK) gracefully closes a connection. Each side independently signals it has no more data (FIN) and acknowledges the other's FIN. The initiator enters TIME_WAIT for 2*MSL (60-120s) after close, consuming a socket until the timer expires.
Definition
TCP connection close requires four packets because each half of the connection closes independently. The initiator sends FIN (I am done sending), the peer ACKs it. The peer may continue sending data. When the peer finishes, it sends its own FIN, which the initiator ACKs. The initiator then enters TIME_WAIT state for 2*MSL (Maximum Segment Lifetime, typically 60 seconds on Linux). TIME_WAIT ensures delayed packets from the old connection do not contaminate a new connection on the same 5-tuple. On busy servers (load balancers, proxies), thousands of TIME_WAIT sockets accumulate. Mitigations: tcp_tw_reuse allows outgoing connections to reuse TIME_WAIT sockets, HTTP keep-alive reduces close frequency, and having the server initiate close (server FINs first) puts TIME_WAIT on the server where port exhaustion is less likely.
Examples
- –ss -o state time-wait | wc -l – count TIME_WAIT sockets
- –sysctl net.ipv4.tcp_tw_reuse=1 – reuse TIME_WAIT for outgoing
- –HTTP Connection: keep-alive avoids repeated teardown/setup cycles
Related Protocols
Related Terms
FIN (Finish)
FIN is a TCP flag used to gracefully close a connection. TCP close is a four-way process: FIN from initiator, ACK from peer, FIN from peer, ACK from initiator. The TIME_WAIT state after closing lasts 2*MSL (typically 60s) to handle delayed packets – this can exhaust ports on busy servers.
Three-Way Handshake
The TCP three-way handshake (SYN, SYN-ACK, ACK) establishes a connection between client and server. It synchronizes sequence numbers, negotiates options (MSS, window scale, SACK, timestamps), and costs exactly 1 RTT before data can flow. TLS adds 1-2 more RTTs on top.
Keep-Alive
Keep-alive has two meanings: TCP keep-alive sends periodic probes on idle connections to detect dead peers (default: 2 hours). HTTP keep-alive (Connection: keep-alive) reuses a TCP connection for multiple requests, avoiding repeated handshake overhead. Both reduce connection churn but serve different purposes.