Networking interview question · Most asked
Walk through the TCP three-way handshake and connection teardown. What is TIME_WAIT and why can it cause problems?
Summary
The client sends SYN, the server replies SYN-ACK and the client sends ACK; both sides then agree on initial sequence numbers. To close, each side sends FIN and acknowledges the other's FIN. The side that closes first stays in TIME_WAIT (60 s on Linux) so late packets aren't mistaken for a new connection. Clients that open and close many short connections can run out of ephemeral ports while sockets sit in TIME_WAIT.
Longer Answer
Each new connection costs a round trip before data flows (plus TLS). Connection pools and keep-alive avoid both the latency and the TIME_WAIT build-up. Tuning such as tcp_tw_reuse helps outbound connections, but the real fix is reusing connections. Behind NAT, the same pattern exhausts NAT ports to one destination.
Key Points
- SYN, SYN-ACK, ACK.
- FIN in each direction to close.
- TIME_WAIT holds the 4-tuple for a while.
- Many short connections exhaust ports; reuse connections.
Deep dive: Networking Tutorial: TCP
Explanation
What interviewers look for
Linking TIME_WAIT to ephemeral port exhaustion and to connection reuse as the fix.
Follow-up questions
- Which side ends up in TIME_WAIT?
- How does this interact with NAT gateways?
More most-asked Networking questions
- What happens, at the network level, when you type a URL into a browser and press Enter?
- How does NAT work, and what are its limits?
- What is CIDR notation? How many usable addresses are in a /26, and in an AWS /26 subnet?
- How does DNS resolution work, and what does a record's TTL control?
- What does TLS provide, and how does certificate validation work?
- What's the difference between TCP and UDP, and when would you choose UDP?
- What do 502, 503 and 504 errors from a load balancer usually mean?
- What's the difference between stateful and stateless firewalls? Give cloud examples.