nf_tproxy_handle_time_wait4(9)

💅 nf_tproxy_handle_time_wait4(9) — the glow-up

okay bestie, so this is nf_tproxy_handle_time_wait4, straight out of the Kernel API Manual. yes it's a 9, yes it's kernel-internal, yes we're still reading it. sit down, hydrate, let's go 🫶

---

✨ NAME ✨

nf_tproxy_handle_time_wait4 — literally the function that handles IPv4 TCP TIME_WAIT reopen redirections. that's the whole job. that's the assignment. and she ate 💅

---

🌸 SYNOPSIS 🌸

struct sock * nf_tproxy_handle_time_wait4 (struct net *net , struct
sk_buff *skb , __be32 laddr , __be16 lport , struct sock *sk );

like, it takes a struct net *, a struct sk_buff *, a __be32, a __be16, and a struct sock *, and it gives you back a struct sock *. five in, one out. no cap, that's the signature, copy it exactly 🎀

---

🦋 ARGUMENTS 🦋

• net — the network namespace, obvi. the little universe this packet lives in 🌈
• skb — the skb being processed rn. the actual packet in question, main character energy 📦
• laddr — the IPv4 address to redirect to. or zero. that's the vibe, it's either an address or it's zero ✨
• lport — the TCP port to redirect to. or zero, same deal, zero is always welcome here 💜
• sk — the TIME_WAIT TCP socket that the lookup found. she's been sitting there in TIME_WAIT the whole time, iconic 😌

---

🔥 DESCRIPTION 🔥

okay so here's the situation, and it's kind of a big deal: SYN packets arriving to TIME_WAIT sockets have to be handled differently. we can't just reopen the connection like it's nothing — instead, if there's a listener socket present, we should redirect the new connection to the proxy. it's giving rerouting the group chat invite mid-flight 🧚

and here's the part where you gotta pay attention: nf_tproxy_handle_time_wait4 consumes the socket reference passed in. consumed. gone. eaten. don't come back looking for it. 💀

bestie pls remember: the socket reference you hand over does not survive this call. this is not a "maybe" situation, it's stated right there in the description.

---

👑 RETURN 👑

what you get back, depending on the vibe check:

• the listener socket, if there's one (slay 🌟)
• the TIME_WAIT socket, if no such listener is found (she stays, respectfully 💅)
• NULL if the TCP header is incomplete (😭 it just wasn't finished, nothing we can do)

---

⭐ SEE ALSO ⭐

• Kernel file ./include/net/netfilter/nf_tproxy.h — the source of truth, go read her 🍓
• nf_tproxy_handle_time_wait6(9) — yes she has a v6 sister, and yes she's also that girl 💖

---

and that's the whole page, bestie 🎀 this lil gem lives under ./include/net/netfilter in the kernel tree, dated October 2026, and it's page nf_tproxy_handle_time_wait4(9) of the Kernel API Manual. go forth, handle those TIME_WAIT reopen redirections, and remember: consume the reference, not your peace of mind 🦋✨