Re: pftop states

> On Aug 6, 2025, at 22:37, Oliver Peter <oliver@gfuzz.de> wrote:
> 
> On Wed, Aug 06, 2025 at 03:34:55PM -0700, Doug Hardie wrote:
>>> On Aug 6, 2025, at 14:51, Oliver Peter <oliver@gfuzz.de> wrote:
>>> 
>>> On Mon, Aug 04, 2025 at 10:07:19PM -0700, Doug Hardie wrote:
>>>> pftop shows the TCP states as two numbers separated by a :.  Most of the time the two numbers are identical and the state is obvious.  However, what does it mean when they are different (e.g., 9:4 or 4:9)?
>>> 
>>> That’s a feature of pftop: when the terminal window is too narrow, it
>>> shows TCP states as numbers (from tcp_fsm.h) instead of names like
>>> ESTABLISHED. So 9:4 means one side is in state 9 (FIN_WAIT_2), the other
>>> in 4 (ESTABLISHED). Widen the window, and you’ll see the full names again.
>> 
>> Thanks.  Which number is the local side?  I am presuming the first, but that might be wrong.  I find it surprising that the two sides could be out of sync.  Perhaps that is due to packet loss?
> 
> There is no "local" - it's source:destination.

Thanks.  It would be nice if that were in the man page.

-- Doug