Re: pftop states

On Wed, Aug 06, 2025 at 03:34:55PM -0700, Doug Hardie wrote:
> > On Aug 6, 2025, at 14:51, Oliver Peter <oliver@gfuzz.de> wrote:
> > 
> > On Mon, Aug 04, 2025 at 10:07:19PM -0700, Doug Hardie wrote:
> >> pftop shows the TCP states as two numbers separated by a :.  Most of the time the two numbers are identical and the state is obvious.  However, what does it mean when they are different (e.g., 9:4 or 4:9)?
> > 
> > That’s a feature of pftop: when the terminal window is too narrow, it
> > shows TCP states as numbers (from tcp_fsm.h) instead of names like
> > ESTABLISHED. So 9:4 means one side is in state 9 (FIN_WAIT_2), the other
> > in 4 (ESTABLISHED). Widen the window, and you’ll see the full names again.
> 
> Thanks.  Which number is the local side?  I am presuming the first, but that might be wrong.  I find it surprising that the two sides could be out of sync.  Perhaps that is due to packet loss?

There is no "local" - it's source:destination.


-- 
Oliver Peter       oliver@gfuzz.de       0x456D688F