I am by no means an HP-UX expert, so please take my explanations cum grano salis.

First: stopping/starting/monitoring the apache process: On all systems i used Apache on (various Linuxes, AIX, Solaris) Apache was started and stopped by the apachectl command. I would be astonished if this is not the case on HP-UX.

Also, the processes are usually not named "apache" but "httpd". Might it be possible that you haven't stopped the (real) Apache-processes at all and this is why all the sockets are in use?

A process uses a socket to create a connection. Once this connection is up and running, it appears in the netstat-list in the status "ESTABLISHED". When this connection is decomissioned again, it goes into the status "fin_wait" (actually there are FIN_WAIT_1 and FIN_WAIT_2 because this is a 4-way handshake process) and the socket is freed up after a certain time. This time can be configured (usually in units of half-seconds) in some kernel-tuning parameter. I don't know how to do that in HP-UX but with this information you should find it by searching the documentation.

CLOSE_WAIT is similar to FIN_WAIT in that the connection is in the process of closing. It means that the local host has received a termination request and has already acknowledged it. If you want to know more details about TCP/IP i suggest W. Richard Stevens excellent book "TCP/IP Illustrated" (3 volumes) - what is not in there isn't worth knowing.

After this little theory excursion: you can kill the processes, but do it by sending SIGTERM (kill -15) instead of the all-too-common SIGKILL (kill -9)! The difference is that SIGTERM tells a process to end, so it can clean up what it has allocated (that includes closing open connections hence freeing the sockets). SIGKILL will kill the process immediately and all this cleanup work will not be done at all.

I hope this helps.

bakunin