title: what is tcp socket timers unkn-4 as shown by netstat
body: <pre><code>[root@:/]# netstat -eont
  Active Internet connections (w/o servers)
  Proto Recv-Q Send-Q Local Address  Foreign Address   State  User   Timer
  tcp   0   0  10.99.92.201:2000  10.99.92.82:63407  ESTABLISHED 0
          keepalive (2.28/0/0)
  tcp   0  29200 10.99.92.201:2004 10.99.92.82:63408 ESTABLISHED 0   
          unkn-4 (50.92/0/0)
  
  [root@:/]# netstat -eont
  Active Internet connections (w/o servers)
  Proto Recv-Q Send-Q Local Address Foreign Address  State  User  Inode   Timer
  tcp   0   0  10.99.92.201:2000  10.99.92.82:63407  ESTABLISHED 0  385  
            keepalive (0.35/0/0)
  tcp   0  29201 10.99.92.201:2004 10.99.92.82:63408 FIN_WAIT1   0  0    
           unkn-4 (33.99/0/0)
  
  
  [root@:/]# netstat -es
  Ip:
      195 total packets received
      0 forwarded
      0 incoming packets discarded
      194 incoming packets delivered
      260 requests sent out
  Icmp:
      0 ICMP messages received
      0 input ICMP message failed.
      ICMP input histogram:
      0 ICMP messages sent
      0 ICMP messages failed
      ICMP output histogram:
  Tcp:
      0 active connections openings
      2 passive connection openings
      0 failed connection attempts
      0 connection resets received
      1 connections established
      131 segments received
      255 segments send out
      1 segments retransmited
      0 bad segments received.
      0 resets sent
  Udp:
      10 packets received
      0 packets to unknown port received.
      0 packet receive errors
      4 packets sent
      RcvbufErrors: 0
      SndbufErrors: 0
  
  [root@:/]#
  </code></pre>
  
  <p>I have an Linux (2.6.33) application running on ARM embedded system. The TCP socket is 
  showing the with "netstat" are pasted above.</p>
  
  <p>What is the meaning of unkn-4 state for timer( in this state the Send-Q is showing 29200 
  and socket is ESTABLISHED. But after some time socket goes to FIN WAIT 1 state but and 
  Send-Q is increased by 1 packet. I expect that this packet is sent with RST flag.</p>
  
  <p>But i didn't see this RST captured with tcpdump which is running in background.</p>
  
  <p>Please help me to find out what is happening here which puts socket from ESTABLISh state
  to FIN  wait 1 state. I guess the RST is sent out from application but it is not sent out 
  on ethernet interface and lying in the tcp OUT Send-Q buffer. So i was not able to capture. 
  Is this correct &amp; how to verify this?</p>
  
  <p>Followed the reference but still didn't get the answer.</p>
  
  <pre><code>http://vzkernel.blogspot.in/
  </code></pre>