TCP Half Closed and TCP Time Wait Timers
Table of Contents
TCP Half Closed and TCP Time Wait Timers
The TCP connection termination procedure uses a TCP
Half Closed timer, which is triggered by the first FIN the firewall
sees for a session. The timer is named TCP Half Closed because only
one side of the connection has sent a FIN. A second timer, TCP Time
Wait, is triggered by the second FIN or a RST.
If the firewall were to have only one timer triggered by the
first FIN, a setting that was too short could prematurely close
the half-closed sessions. Conversely, a setting that was too long
would make the session table grow too much and possibly use up all
of the sessions. Two timers allow you to have a relatively long
TCP Half Closed timer and a short TCP Time Wait timer, thereby quickly
aging fully closed sessions and controlling the size of the session
table.
The following figure illustrates when the firewall’s two timers
are triggered during the TCP connection termination procedure.
The TCP Time Wait timer should be set to a value less than the
TCP Half Closed timer for the following reasons:
- The longer time allowed after the first FIN is seen gives the opposite side of the connection time to fully close the session.
- The shorter Time Wait time is because there is no need for the session to remain open for a long time after the second FIN or a RST is seen. A shorter Time Wait time frees up resources sooner, yet still allows time for the firewall to see the final ACK and possible retransmission of other datagrams.
If you configure a TCP Time Wait timer to a value greater than
the TCP Half Closed timer, the commit will be accepted, but in practice
the TCP Time Wait timer will not exceed the TCP Half Closed value.
The timers can be set globally or per application. The global
settings are used for all applications by default. If you configure
TCP wait timers at the application level, they override the global
settings.