Lots of TIME_WAIT in netstat on apache server

Question

What would be the reason for many TIME_WAIT here? Even we have very few ESTABLISHED, SYN connection.

[root@www ~]# netstat -natp | grep "210.XX.XX.XX:80" | awk '{print $6}' | sort | uniq -c
      1 ESTABLISHED
     12 FIN_WAIT2
   9903 TIME_WAIT 

Solution

In order to explain this you need to have a good understanding of TCP/IP communications. In the simplest form, when someone connects to your web server, your server assumes the connection will last for a while and allocates a port for that communication and sets a timeout for that communication channel. The channel or the port as you see from netstat output, goes into TIME_WAIT state, if the person on the other end, i.e. the client, stops communicating. Maybe all he or she needed, was to look at one page and that was done. But your server can not know that. It is operating under the assumption that this is going to be a long time taking communication.

Why it does that, is mainly because, it is costlier (resource-wise) to establish a new comm channel than keeping an existing one, especially if, the client is going to make multiple requests from your server. If you want to geek out and learn about it deeper, there is a pretty good write-up about it here: http://www.serverframework.com/asynchronousevents/2011/01/time-wait-and-its-design-implications-for-protocols-and-scalable-servers.html

If all you are interested in how you can get rid of them or prevent them happening so often and why they happen in a summary form, here is another page you might want to glance thru: http://www.fromdual.com/huge-amount-of-time-wait-connections