Why is the same socket in TIME_WAIT many times?

Question

I have read other threads regarding sockets in TIME_WAIT, but I am clearly still missing something.

Below is a few lines from a "netstat -an". How could it get into this situation? If I understood the descriptions I found, we should not have more than one instance of the socket 63444 ... but after the one listed as "LISTEN" there are about 50 individual socket connections with one end at 63444, all in "TIME_WAIT". How could this happen, and how can I fix it?

tcp 0 0 0.0.0.0:63444 0.0.0.0:* LISTEN
tcp 0 0 169.254.7.228:63444 169.254.66.84:35391 TIME_WAIT
tcp 0 0 169.254.7.228:63444 169.254.66.84:35283 TIME_WAIT
tcp 0 0 169.254.7.228:63444 169.254.66.84:35352 TIME_WAIT
tcp 0 0 169.254.7.228:63444 169.254.66.84:35431 TIME_WAIT

Answer 1

Why is the same socket in TIME_WAIT many times?

It isn't the same socket. Look at the remote address. It's the same local IP address and port every time, but the remote addresses are all different.

I have read other threads regarding sockets in TIME_WAIT, but I am clearly still missing something. Below is a few lines from a "netstat -an". How could it get into this situation?

The server accepted some connections and later closed them.

If I understood the descriptions I found, we should not have more than one instance of the socket 63444 ...

That's nonsense, wherever you read it. Otherwise TCP servers couldn't work at all.

but after the one listed as "LISTEN" there are about 50 individual socket connections with one end at 63444, all in "TIME_WAIT". How could this happen, and how can I fix it?

This is perfectly normal. There is nothing here that needs fixing.

When a connection is accepted, a new socket is created with the same local IP address and port, and the source IP address:port set to those of the client. When the server closes this socket it transitions through various states as the close handshake proceeds, ending in TIME_WAIT for two minutes, and then it disappears.

Answer 2

I'm not sure what descriptions you've found, but that's nonsense. A web server may have dozens of connections to port 80 active at once and many others in the process of shutting down. They all have the same local endpoint.

Each of these TIME_WAIT lines represent a different connection to port 63444 that is in the process of closing. The machine at 169.254.66.84 made a bunch of connections to this machine, and several of them are now in TIME_WAIT state. There's nothing unusual about that.

Answer 3

Connections are uniquely (generally) identified by the source port, source address, dest port and dest address. If any of those is different it's a different connection. In each of the lines you show there is a different port on the "other" side, so each is a different connection.