About This Article
This article was created using an automated generation workflow utilizing generative AI. It is structured to read-only observe TCP states on Windows, based on RFC 9293 and Microsoft Learn's Get-NetTCPConnection.Verification Status: 📘 Confirmed with RFC and Microsoft official specifications, unverified on actual Windows hardware
TCP connections do not always disappear from the list the exact moment communication ends. By counting current states in PowerShell,ESTABLISHED and TIME_WAIT can be visually confirmed as part of the "connection state machine."
Try This First
Count currently visible TCP connections by state without requiring administrator privileges.
Get-NetTCPConnection |
Group-Object State |
Sort-Object Count -Descending |
Select-Object Count, Name
States and counts will vary depending on the environment.TIME_WAIT Even if there are 0 items, it does not mean a failure.
What to Look For
For example, the following states exist:
Listen: Waiting for a connectionEstablished: TCP connection is establishedTimeWait: Maintaining state for a certain period after closing
TIME-WAIT is a standard TCP state defined in RFC 9293. The presence of TIME-WAIT does not automatically indicate an issue.
Focusing Only on TIME_WAIT
Get-NetTCPConnection -State TimeWait -ErrorAction SilentlyContinue |
Select-Object -First 10 LocalAddress, LocalPort, RemoteAddress, RemotePort, State
Zero items simply means "it could not be observed at this exact moment." Because states change over time, do not expect a fixed value.
stateDiagram-v2
[*] --> ESTABLISHED: 接続成立
ESTABLISHED --> FIN_WAIT: active close側の例
FIN_WAIT --> TIME_WAIT: close処理が進む
TIME_WAIT --> [*]: 待機後に終了
The diagram does not cover all states; it is a simplified flow for this observation.
Change One Thing
Run the same aggregation again after performing a few HTTPS requests using a browser or curl.
1..3 | ForEach-Object {
curl.exe -sS -o NUL https://example.com/
}
Get-NetTCPConnection |
Group-Object State |
Sort-Object Count -Descending |
Select-Object Count, Name
Connection reuse and OS timing mean that increases will not always follow the same pattern. The important thing is toobserve the state distribution before and after communication.
Why TIME_WAIT Persists
Because TCP provides a reliable byte stream, the close operation also involves state transitions. TIME-WAIT plays a role in handling delayed segments and similar scenarios.
Therefore, before thinking, "TIME_WAIT remained even though the connection was closed; let's force-delete it," first determine whether it is a normal state transition or if a large volume of short-lived connections is occurring.
Failures and Boundary Conditions
Do not diagnose port exhaustion based on a single observation.
Do not conclude that an application is malfunctioning based solely on the count of TIME_WAIT connections.
States beyond NAT, proxies, and load balancers cannot be seen with this command.
Short-lived communications may miss the observation window.
For Professional Use
When handling inquiries such as "the web is occasionally unreachable" or "connections act up only after heavy processing," you can record the state before rushing to change settings.
Get-NetTCPConnection |
Group-Object State |
Select-Object Name, Count |
Sort-Object Name
Saving this data with timestamps to compare normal and faulty states serves as material for initial troubleshooting. Rather than allowing administrative staff to fix things themselves, it can be used asan observational tool to communicate "which states were increasing" to IT departments or vendors.
