pftop states

[Doug Hardie]

pftop shows the TCP states as two numbers separated by a :. Most of the time the two numbers are identical and the state is obvious. However, what does it mean when they are different (e.g., 9:4 or 4:9)?

-- Doug

[Oliver Peter]

On Mon, Aug 04, 2025 at 10:07:19PM -0700, Doug Hardie wrote:
> pftop shows the TCP states as two numbers separated by a :. Most of the time the two numbers are identical and the state is obvious. However, what does it mean when they are different (e.g., 9:4 or 4:9)?

That’s a feature of pftop: when the terminal window is too narrow, it
shows TCP states as numbers (from tcp_fsm.h) instead of names like
ESTABLISHED. So 9:4 means one side is in state 9 (FIN_WAIT_2), the other
in 4 (ESTABLISHED). Widen the window, and you’ll see the full names again.


--
Oliver Peter oli...@gfuzz.de 0x456D688F

[Doug Hardie]

Thanks. Which number is the local side? I am presuming the first, but that might be wrong. I find it surprising that the two sides could be out of sync. Perhaps that is due to packet loss?

-- Doug

[Oliver Peter]

There is no "local" - it's source:destination.

[Doug Hardie]

Thanks. It would be nice if that were in the man page.

-- Doug