I write a buggy server to leak socket fd, which listen on 5000, and as expected there were CLOSE-WAIT left when client is closed
$ ss -ntpa | grep 5000
LISTEN 0 50 :::5000 :::* users:(("java",14586,92))
CLOSE-WAIT 79 0 ::ffff:127.0.0.1:5000 ::ffff:127.0.0.1:55804 users:(("java",14586,96))
CLOSE-WAIT 79 0 ::ffff:127.0.0.1:5000 ::ffff:127.0.0.1:59235 users:(("java",14586,93))
CLOSE-WAIT 5 0 ::ffff:127.0.0.1:5000 ::ffff:127.0.0.1:55803 users:(("java",14586,95))
CLOSE-WAIT 150 0 ::ffff:127.0.0.1:5000 ::ffff:127.0.0.1:59236 users:(("java",14586,94))