We have an application named "Seamer" installed on 2008R2 machine named "R2DUO" which has IP address set as in host file and is IP address of Ethernet card .We have two more systems in the LAN named R2TMBER and R2LEAF. One functionality should be achieved when there is a connection with port 5009.As of now that functionality is not achieving,, when I checked netstat -a I could see these entries ,

TCP           R2DUO:0        LISTENING
TCP          R2DUO:64181    ESTABLISHED
TCP         R2DUO:49519    ESTABLISHED

TCP        R2DUO:5009     TIME_WAIT            around 50 entries are there now

TCP        R2DUO:5009     ESTABLISHED
TCP        R2DUO:microsoft-ds  ESTABLISHED
TCP        R2DUO:5009     TIME_WAIT            again 50 entries are there



These all are the knowledge which I know as of now ,,first 5009 in listening mode then it will establish coonection.But after that suddenly it goes TIME_WAIT, then establish connection and again goes timewait ,finally it establish connection with two other systems in the LAN. Can any body guide me any thing wrong in the system setup.Or do I need to check any network related stuff. I would like to know the logic behind this sequence in netstat shown below First it will be then it will be then it is ethernetIp:portnumber finally it will be with ipaddress of system entered in the host file and other two machines etc..

  • You don't set IP addresses in the hosts file; it associates IP addresses with hostnames. – adaptr Mar 20 '12 at 13:49
  • yes, i have used ip - hostname entry there – michale Mar 20 '12 at 16:58
up vote 1 down vote accepted

Update based on the comment; Check that the service is not conflicting with some underlying MS service;
Service Name and Transport Protocol Port Number Registry

winfs 5009 tcp Microsoft Windows Filesystem [Simon_Skaria] 2006-01
winfs 5009 udp Microsoft Windows Filesystem [Simon_Skaria] 2006-01

I think that you might be interested to read the wikipedia article on TCP connection handshaking, and the connection life-cycle, if you were very interested in understanding the netstat information. Also, you mentioned the state of the connection, which relates to TCP socket programming, but you can actually ignore all that, because its actually pretty simple. (well...;-)

When you call netstat -a you are asking for ALL connections both listening and connected.

Basically the LISTENING line indicates that there is some process listening on TCP port 5009, which is good because this is your application...

TCP           R2DUO:0        LISTENING

However, when some remote process makes a connection to the TCP socket 5009, the programme controlling 5009 normally forks off another process or thread to handle the connection, so you actually end up with netstat -a like this;

TCP           R2DUO:0        LISTENING
TCP         R2DUO:49519    ESTABLISHED

which is the originally listener, plus the connected remote process. i.e. this is your client programme connecting to the server.

Further connections create additional lines like so;

TCP           R2DUO:0        LISTENING
TCP         R2DUO:49519    ESTABLISHED


There is a pretty good explanation of the TIME_WAIT state in this answer here;

TCP       R2DUO:5009     TIME_WAIT
TCP        YYYTO:5009     TIME_WAIT
TCP        RXXXO:5009     TIME_WAIT
TCP        XXTXX:5009     TIME_WAIT
...many more...

TIME_WAIT is a status that arises at the end of the connection on the client side, where the client has actively closed the connection by sending an ACK to a FIN, but as is possible that there is still packets coming from the other side of the connection, hence the client connection sits in TIME_WAIT status which is always longer than the packet TTL, see this and that for very in depth discussion of the TIME_WAIT TCP status.

Port 5009 appears to be registered the Microsoft Windows Filesystem (winfs) service, so you would have to provide further details of your services and setup, and what the problem is other than what you have seen on the netstat output.

Loads of TIME_WAIT connections

TCP       R2DUO:5009     TIME_WAIT
TCP        YYYTO:5009     TIME_WAIT
TCP        RXXXO:5009     TIME_WAIT
TCP        XXTXX:5009     TIME_WAIT
...many more...

Basically, you client is connecting, and then immediately disconnecting, many times over, so something earlier on in the application such as authentication, or application protocol mismatch, or something not related to the underlying TCP.

I think this suggests that there is some problem with configuration, in such a way that the client cannot continue once connected, hence the client closes the connection to the server. The result being lots of connections that are quickly closed. hence you see these are TIME_WAIT

Some possibilities for this, are some sort of password problem between the client and server, or some other application misconfiguration which would cause an abrupt close from the client.

  • what basis you are telling winfs is registered? – michale Mar 20 '12 at 18:33
  • its listed in the IANA database "Service Name and Transport Protocol Port Number Registry" servwinfs 5009 tcp Microsoft Windows Filesystem [Simon_Skaria] 2006-01 winfs 5009 udp Microsoft Windows Filesystem [Simon_Skaria] 2006-01 – Tom H Mar 20 '12 at 18:40
  • upvotes and accepted answers are often a good way to indicate helpful answers.... ;-) – Tom H Mar 21 '12 at 2:14
  • one more doubt here, i suspect some firewall issues is going on which blocks port 5009, how i can check whether firewall blocking this port or UAC in windows2008R2 or not any idea? – michale Mar 21 '12 at 9:33
  • TIME_WAIT and ESTABLISH are both status that occur after the initial 3-way TCP handshake, hence the firewall is definitely NOT blocking (from your example netstat output,, on port 5009 – Tom H Mar 21 '12 at 11:16

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.