Lots of TIME_WAIT: usually not a problem

ss -tan | grep TIME-WAIT | wc -l shows tens of thousands and looks alarming.

TIME_WAIT exists only on the side that closed first, and lasts 2MSL — a hardcoded 60 seconds on Linux. It keeps late packets from wandering into a new connection and lets the final ACK be retransmitted. It is a normal state, not a leak.

The real failure is port exhaustion: about 28000 ephemeral ports, so more than that many new outbound connections in 60 seconds gives Cannot assign requested address.

tcp_tw_reuse=1 lets new outbound connections reuse TIME_WAIT ports and is reasonably safe. tcp_tw_recycle was removed in 4.12 — stop copying it from old blog posts.