Why does file descriptor remain after TCP connection is CLOSED?

Question

When I run lsof I see many entries with TCP <HOST>:<PORT> -> <IP>:https (CLOSED).

Is this a marker showing that a descriptor once existed or does the open file still exist?

Assuming it's not a marker, why does the file descriptor still exist?

After waiting several minutes, the CLOSED entries are still shown in the output. I only see them go away when the process exits.

Answer 1

The (CLOSED) note from lsof tells you that the TCP connection is in the closed state (has been shut down), probably due to the remote end closing the connection. The fact that lsof lists the file descriptor means the file descriptor is still open, referring to the closed TCP connection. There is no file involved to still exisit, only the local end of the socket.

The file descriptor will persist until the process closes it, which can happen with a close system call, or will happen automatically when the process exits.

Closing a file descriptor and closing a connection are only tangentially related. When you close a file descriptor, if it is the last reference to one end of a connection, then the connection will be closed (if it is not already closed -- either by the other end being closed, or by being closed explicitly with a shutdown system call)