In Windows network forensics,netstat -anois commonly used to correlateTCP connection stateswithprocess identifiers (PIDs)to understand which application created or used a connection. When Tor Browser is actively communicating, outbound circuits typically appear asESTABLISHEDconnections to Tor relays (entry/guard nodes) or local loopback endpoints used by Tor components. After the browser is closed and the application tears down connections, Windows TCP/IP behavior often leaves recently closed sockets inTIME_WAIT.

TIME_WAITis a normal TCP state that appears after a connection has been actively closed. It exists to ensure delayed packets from the old session are not misinterpreted as belonging to a new session and to allow proper retransmission of the final ACK if needed. From an investigative standpoint, seeing Tor-related endpoints transition from ESTABLISHED toTIME_WAITstrongly indicates the sessions were terminated and the application is no longer maintaining live network traffic.

By contrast,CLOSE_WAITusually means the remote side has closed but the local application has not fully closed its socket yet,LISTENINGindicates a service waiting for inbound connections, andESTABLISHEDmeans the session is still active. Therefore,TIME_WAIT (B)best indicates Tor Browser connections have been closed.