Ok here's the situation

We have an application that our users log into over the network to one of our unix boxes (Solaris 8). I had this situation occur the other day where an user claimed that he totally shutdown the app because it froze up and wasn't able to log back in.

I performed a netstat on the port and I could see that he wasn't getting back in because the original connection (frozen app) was still established and I could see time_waits for the new attempts to login (the time_waits are because we're not allowing the user to log back in because technically he's still logged in).

after a while I saw the ESTABLISHED switch to FIN_WAIT_2, I never seen this state before (can someone explain what it means in laymens terms and give an example of a situation it might occur).

Anyway the user wanted an explanation and I have never seen this before, usually when a user closes the app the connection will drop but this time it stayed established. Is it possible that the session level processes were still running on the Windows 2000 server pc he was using?? even though everything on the desktop said the app was closed??

Anyway, I would greatly appreciate any info you could spare on this situation and also is there a website or reference somewhere that could explain real life situations where certain netstat states would occur??

thanks in advance

The local program did a shutdown() or a close() on the socket in question. This sent a FIN packet to the remote system and put the socket in FIN_WAIT_1. The remote system ACKED the FIN packet and the local system got the ACK. That moved the socket to FIN_WAIT_2.

The idea is that at some point the remote system will close() or shutdown() its side on the socket. When that happens, the remote system will send a FIN. The local system will then ACK that FIN and move the socket to TIME_WAIT.

But if the remote system had a hung program, the remote system's kernel will still ACK the first FIN. Then if the remote system is rebooted, things will hang forever.

FIN_STATE_2 happens a lot when the remote systems are pc's. You must not run netstat very much.