TCP connection owned by pid zero

Question

I'm trying to ensure that a Windows service program (running on top of .NET) is properly releasing its network connections.

When running the service locally I know that it will create a lot of HTTP connections to localhost on port 57300. I'm using netstat to monitor whether they are released properly.

I was suprised to see that many connections to this port are owned by the "System Idle process" (PID=0).

Here we can see that only three of those connections are owned by the service program (PID=5012). All the others are owned by PID 0.

My main questions are: Why is this happening? and Do I need to care?

But I'd also like to know:

• Does this mean that the service program did release the connection properly, or not?

• Will such connections be reused if needed?

• Do such a connection "reserve a slot" in the .NET ServicePointManager?

Answer 1

After a TCP connection closes, it goes into the TIME_WAIT state for a fixed period. This is to ensure that any packets related to the connection that might still be queued up in the network won't interfere with new connections.

Since this has to happen even if the original process has exited, I'm guessing that Windows automatically transfers ownership to the system process.

So, I believe the answers to your last four questions are:

• No, you probably don't need to worry about this.

• Yes, the service program released the connection properly.

• The TIME_WAIT connections will be closed early if the system runs out of TCBs. In the default configuration this will happen before you run out of ports, so in effect, yes, the connections will be reused if they are needed.

• I'm not familiar with the service point manager, but there's no reason for it to track connections in the TIME_WAIT state, so probably no.

On Windows XP, the default value for the TIME_WAIT delay was two minutes. I can't find more recent information, but it seems likely that it hasn't been changed since then.