Netstat output when running ping: what do various numeric states mean?

Ask Fedora
1

Having looked at man netstat and various online sources, I gather that states basically follow the list

State Description
LISTEN accepting connections
ESTABLISHED connection up and passing data
SYN_SENT TCP; session has been requested by us; waiting for reply from remote endpoint
SYN_RECV TCP; session has been requested by a remote endpoint for a socket on which we were listening
LAST_ACK TCP; our socket is closed; remote endpoint has also shut down; we are waiting for a final acknowledgement
CLOSE_WAIT TCP; remote endpoint has shut down; the kernel is waiting for the application to close the socket
TIME_WAIT TCP; socket is waiting after closing for any packets left on the network
CLOSED socket is not being used (FIXME. What does mean?)
CLOSING TCP; our socket is shut down; remote endpoint is shut down; not all data has been sent
FIN_WAIT1 TCP; our socket has closed; we are in the process of tearing down the connection
FIN_WAIT2 TCP; the connection has been closed; our socket is waiting for the remote endpoint to shut down

But when I run ping in the background and check netstat I see state 7 in its output:

"raw 0 0 0.0.0.0:1 0.0.0.0:* 7 0 119358 22513/ping "

and that is not on the list. It also contradicts man where it says that in RAW or UDP modes the value may be left blank. My question is not even what 7 means but what else is to expect from netstat?

2

Just a heads up netstat is deprecated and replaced with the ip and ss command etc.

I found this explaining the replacement commands: linux - alternative to "netstat -s" - Unix & Linux Stack Exchange

You will find that the new commands are a lot faster then the old ones. Especially when you have lots of TCP connections on a host.

3

If I could use new commands I would have.

4

You can use them, they are all installed by default on Fedora.

5

No. Not allowed to.

6

Oh you have you employer forcing you to use old tools.

7

Not allowed to?
As in the system will not allow you to run the ip command? or as in your employer requires that you use only the specified commands?

8

You spend so much effort interrogating me of inconsequential things and so little trying to help that it is clear that help will not be provided. Sad.

9

It is hardly inconsequential when you say you are not allowed to use the newer commands and refuse to explain why that is the case.

If you have fedora installed then those commands are installed and available by default. We can get much more meaningful results from the newer commands and since netstat is deprecated and soon to be retired it is certainly not worth my time and effort to assist in your specific question.

Your attitude and attacking those who ask questions for purposes of better understanding of the problems and limitations does not bode well for obtaining helpful answers.

2 Likes
10

This doesn’t look like a Fedora specific question, so it is better to ask it on Stack Exchange: UNIX & LINUX or a similar place.

Keep in mind that understanding some undocumented functionality typically requires to study the relevant source code.