Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If a Windows server has several thousand ports open in LAST_ACK state (as shown by netstat), what could this mean? Is it because one endpoint is waiting for the other to respond?

share|improve this question

3 Answers 3

The last_ack state (if I recall my TCP stack correctly) is the state when you have received your FIN message to close the connection from your neighbour, but you still need to flush and shut down your connection. You send the final FIN yourself and wait for an ACK.

Typically hanging in last_ack means your application keeps a socket open even when the the other end has finished sending data. This can happen for multiple reasons. There might be a firewall or other load balancer which loses last ACK from the client, and leaves you stuck in the last_ack state. If the connections are not timed out after a few minutes (10 or so) you probably have a bug.

Have a look at the state diagram at http://tangentsoft.net/wskfaq/articles/debugging-tcp.html

share|improve this answer
    
Not correct. You're describing CLOSE_WAIT. –  EJP Jun 17 at 5:30

LAST_ACK is the last state right before closing the down the TCP connection.

share|improve this answer
1  
Thanks, what can cause a port to hang in this state? –  nbolton Mar 31 '10 at 15:22
    
Is this an IIS webserver (or other service) you're seeing this on, or, your own application? –  Imo Mar 31 '10 at 15:39
    
The application implements the "Cook Computing" XML-RPC client (from Asp.Net, run through IIS), and is talking to a Java XML-RPC server. –  nbolton Mar 31 '10 at 16:08
1  
It's the final stages of the TCP conversation with the client. Your software looks to close() the TCP session and sends a LAST_ACK to the client. The client then should send back an acknowledgement that the LAST_ACK was received. I agree with pehrs in that client (maybe firewall) may not have acknowledged it or the packet may have been lost... these are the two most likely cases. –  Imo Apr 1 '10 at 18:08
    
It doesn't 'send a LAST_ACK to the client'. It sends a FIN and is presently waiting for an ACK, having already received a FIN and sent an ACK. It's the last state after closing the connection. –  EJP Jun 17 at 5:33

LAST_ACK means your end has received a FIN from the peer, sent an ACK, sent a FIN, and is waiting for the final ACK from the peer. At this point there is nothing further the application can do: the socket is closed. The application may even have exited. From here on it is up to TCP to resend the FIN until it gets the final ACK, or time out doing so. Not much you can do as an admin except investigate he network.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.