Network · XB Field Notes

The TCP backlog holds connections that are still syncing

Fri, 24 Mar 2028 00:00:00 +0000

A listening TCP socket has two queues, not one, and the sysctl this article is named after governs the queue that almost never drops anything. The backlog passed to listen(2) is the accept queue, holding connections that finished the handshake and await the application; the SYN queue holds half-open requests. Confusing them produces the wrong fix.

That matters because the famous advice, raise tcp_max_syn_backlog, is largely obsolete: tcp_syncookies defaults to 1, and as listen(2) puts it, with syncookies enabled there is no logical maximum length and that setting is ignored. What actually bites is the accept queue and how fast the application calls accept().

The backlog argument is the accept queue

listen(2) is explicit that the behaviour changed with Linux 2.2: backlog now specifies the queue length for completely established sockets waiting to be accepted, not the number of incomplete requests. The incomplete queue is bounded separately by /proc/sys/net/ipv4/tcp_max_syn_backlog. And if the backlog argument exceeds /proc/sys/net/core/somaxconn it is silently capped to that value, 4096 since Linux 5.4 and 128 before. So listen(8192) on a default host gives you 4096, and nothing logs it.

tcp(7) describes tcp_max_syn_backlog as the maximum number of queued requests that have not received an acknowledgement, defaulting to 256, raised to 1024 when memory is at least 128 MB, cut to 128 below 32 MB. ip-sysctl adds the qualifications: it is a per-listener limit, each half-open request costs about 304 bytes, and tcp_syncookies defaults to 1, sending a cookie on overflow instead of dropping.

With syncookies on, the SYN queue stops mattering

ip-sysctl documents tcp_syncookies as a fallback that must not be used to help a loaded server stand against legal connection throughput, and says syncookies seriously violate the protocol, disallow TCP extensions, and can degrade services. listen(2) goes further: with syncookies enabled there is no logical maximum length and tcp_max_syn_backlog is ignored. tcp(7) still describes the same knob as dropping requests once exceeded, which is the syncookies-off behaviour. Both pages are right about different configurations.

The honest reading is therefore: leave syncookies at 1 and stop tuning the SYN queue. The cost is that the fallback loses TCP options such as window scaling and SACK on the connections it rescues, which is a throughput problem rather than a connectivity one. If you see SYN-flood warnings while the traffic is legitimate, ip-sysctl’s own advice is to tune the other knobs, not to disable syncookies.

The accept queue is where the pressure lands

With the SYN queue neutralised, the queue that fills is the accept queue, sized by min(listen(backlog), somaxconn). Overflow behaviour depends on tcp_abort_on_overflow, default FALSE: ip-sysctl says the default lets a connection recover if the overflow was a burst, and warns that enabling the abort option can harm clients. The mechanism is the surprise: by default the kernel silently discards the final ACK, so connect() succeeds and the failure only surfaces when the first request stalls or is reset.

A bigger backlog is a delay line, not capacity. In the model, listen(128) and listen(65535) accept the same 20,000 connections in a second; the larger backlog only postpones the overflow, because the accept rate is set by the worker count.

When it breaks

The first failure is the silent one, and it is the default. A service whose accept loop is too slow overflows the accept queue, the kernel drops the final ACKs, and clients see connections that establish and then hang. Nothing is refused, so a client connection pool fills with dead sockets and the error surfaces as timeouts somewhere unrelated. Watch TcpExtListenOverflows and TcpExtListenDrops: those counters climbing while the accept rate is flat means the handler is the limit.

The second failure is the dropped SYN, which needs syncookies off to happen. A full SYN queue then drops the request and the client retransmits on a schedule whose documented endpoints are 67 seconds to the last retransmission and 131 seconds to the final timeout, so the user-visible symptom is a connect that hangs for over two minutes and then fails. Raising tcp_max_syn_backlog is a real fix in that configuration, and turning syncookies back on is a better one, if you accept the loss of TCP extensions.

Check it quickly

ss -lnt 'sport = :8443'
nstat -az TcpExtListenOverflows TcpExtListenDrops TcpExtTCPReqQFullDrop TcpExtTCPReqQFullDoCookies
sysctl net.core.somaxconn net.ipv4.tcp_max_syn_backlog net.ipv4.tcp_syncookies net.ipv4.tcp_abort_on_overflow

In ss -lnt, Send-Q is the backlog the socket was created with and Recv-Q is how many established connections are queued and unaccepted, so Recv-Q sitting at Send-Q is the queue being full. The nstat counters should be zero or near it: TcpExtListenOverflows and TcpExtListenDrops are accept-queue events, while TcpExtTCPReqQFullDrop is a dropped SYN and TcpExtTCPReqQFullDoCookies is the fallback doing its job. The sysctl line shows what the kernel will honour, and if somaxconn is smaller than your listen() argument then that smaller number is your real backlog.

Sources

Kernel ip-sysctl documentation, somaxconn, tcp_max_syn_backlog, tcp_abort_on_overflow and the syncookies warning, checked 2026-09-16.
Linux listen(2), the accept queue since Linux 2.2, the silent somaxconn cap, and syncookies removing the SYN-queue bound, checked 2026-09-16.
Linux tcp(7), tcp_max_syn_backlog defaults by memory size and the syncookies caveats, checked 2026-09-16.

Network namespaces isolate networking; their names do not own every process

Sat, 19 Feb 2028 00:00:00 +0000

A Linux network namespace separates networking resources such as interfaces, routes, neighbor tables, socket ports, and packet-filter rules. It shares the kernel with other namespaces; it is not a separate operating system. A process normally inherits its parent’s network namespace, and tools can execute a process in another one. The resulting isolation covers networking resources, not every aspect of process identity or filesystem access.

When it breaks

Running ip netns exec does not automatically provide the full isolation of a container. PID namespaces, user namespaces, and hostname isolation are separate mechanisms. An application may see different routes while still sharing ordinary files and a hostname with its parent environment. Treating one network namespace as a complete sandbox can therefore assign it guarantees that were never configured.

A new namespace also does not automatically receive useful external connectivity. Interfaces need deliberate placement and configuration, and local loopback may need to be brought up. Moving an interface changes which namespace manages it; the old context will no longer list that device as its own. A configuration command executed from the wrong namespace can report a missing interface even though the intended device still exists elsewhere.

Namespace names have their own lifecycle. ip netns conventionally exposes handles beneath /run/netns, commonly also reachable through /var/run/netns. Deleting a name removes that handle, but a process or another reference can keep the namespace alive. Cleanup that equates disappearance from the named list with termination of every service can leave networking resources and a running process behind.

Check it quickly

Save this as check-network-namespace.py and run python3 check-network-namespace.py with Docker. The pinned environment uses Python 3.11.16 and iproute2 6.1.0. NET_ADMIN and SYS_ADMIN permit nested namespace operations inside a disposable container. A temporary proc mount supports namespace-local network settings; no host interface is moved and no host port is published:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 iputils-ping=3:20221126-1+deb12u1 nftables=1.0.6-2+deb12u2 tcpdump=4.99.3-1 traceroute=1:2.1.2-1 procps=2:4.0.2-3 && rm -rf /var/lib/apt/lists/*\nCMD ["python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,select,signal,subprocess,time

def run(*args,check=True,input=None,timeout=8):
 result=subprocess.run(args,input=input,capture_output=True,text=True,timeout=timeout)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def ns(name,*args,**kwargs):return run('ip','netns','exec',name,*args,**kwargs)
def ip(name,*args,**kwargs):return ns(name,'ip',*args,**kwargs)
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=2)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=2)
def line(process,timeout=3):
 assert select.select([process.stdout],[],[],timeout)[0],'child response deadline exceeded'
 value=process.stdout.readline();assert value,'child exited without a response'
 return value
def spawn(stack,command):
 process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);return process
@contextmanager
def lab(names):
 with TemporaryDirectory(prefix='net-path-') as directory,ExitStack() as stack:
 root=Path(directory);proc=root/'proc';proc.mkdir();run('mount','-t','proc','proc',str(proc))
 stack.callback(run,'umount',str(proc))
 for name in names:
 run('ip','netns','add',name);stack.callback(run,'ip','netns','delete',name,check=False)
 ip(name,'link','set','lo','up')
 def setting(name,key,value):
 assert name in names
 path=proc/'sys'/key.replace('.','/')
 return ns(name,'python3','-c',f'from pathlib import Path; p=Path({str(path)!r}); p.write_text({str(value)!r}); print(p.read_text().strip())').stdout.strip()
 yield root,stack,setting
def wire(left,left_if,right,right_if,left_addresses,right_addresses):
 run('ip','link','add',left_if,'type','veth','peer','name',right_if)
 for name,interface,addresses in [(left,left_if,left_addresses),(right,right_if,right_addresses)]:
 run('ip','link','set',interface,'netns',name)
 for address in addresses:ip(name,'address','add',address,'dev',interface,*(['nodad'] if ':' in address else []))
 ip(name,'link','set',interface,'up')
def nft(name,script):return ns(name,'nft','-f','-',input=script)
def counters(name):
 data=json.loads(ns(name,'nft','-j','list','ruleset').stdout);found={}
 for entry in data['nftables']:
 rule=entry.get('rule',{})
 if 'comment' in rule:
 for expression in rule['expr']:
 if 'counter' in expression:found[rule['comment']]=expression['counter']['packets']
 return found

def server(stack,name,address,port=18080,label='server'):
 code=r'''
from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer
import json,socket,sys
address,port,label=sys.argv[1],int(sys.argv[2]),sys.argv[3]
class Handler(BaseHTTPRequestHandler):
 def do_GET(self):
 body=json.dumps({'server':label,'peer':self.client_address,'path':self.path}).encode()
 self.send_response(200);self.send_header('Content-Length',str(len(body)));self.end_headers();self.wfile.write(body)
 def log_message(self,*args):pass
class Server(ThreadingHTTPServer):
 address_family=socket.AF_INET6 if ':' in address else socket.AF_INET
 def server_bind(self):
 if self.address_family==socket.AF_INET6:self.socket.setsockopt(socket.IPPROTO_IPV6,socket.IPV6_V6ONLY,1)
 super().server_bind()
service=Server((address,port),Handler);print('ready',flush=True);service.serve_forever()
'''
 process=spawn(stack,['ip','netns','exec',name,'python3','-u','-c',code,address,str(port),label])
 assert line(process).strip()=='ready';return process
def request(name,address,port=18080):
 code=r'''
import http.client,json,sys
client=http.client.HTTPConnection(sys.argv[1],int(sys.argv[2]),timeout=.7)
try:
 client.request('GET','/lab-visible-message');response=client.getresponse();body=json.loads(response.read())
 assert response.status==200;print(json.dumps({'ok':True,'status':response.status,'body':body}))
except OSError as error:print(json.dumps({'ok':False,'type':type(error).__name__,'errno':error.errno}))
finally:client.close()
'''
 return json.loads(ns(name,'python3','-c',code,address,str(port)).stdout)

with lab(['blue','green']) as (root,stack,setting):
 probe='import json,os,socket;print(json.dumps({"net":os.readlink("/proc/self/ns/net"),"pid":os.readlink("/proc/self/ns/pid"),"hostname":socket.gethostname()}))'
 parent=json.loads(run('python3','-c',probe).stdout)
 views={name:json.loads(ns(name,'python3','-c',probe).stdout) for name in ['blue','green']}
 assert len({parent['net'],views['blue']['net'],views['green']['net']})==3
 assert all(v['pid']==parent['pid'] and v['hostname']==parent['hostname'] for v in views.values())
 for name in ['blue','green']:
 ip(name,'link','add','dummy0','type','dummy');ip(name,'addr','add','192.0.2.10/24','dev','dummy0');ip(name,'link','set','dummy0','up')
 ip('blue','route','add','203.0.113.0/24','dev','dummy0')
 assert json.loads(ip('blue','-j','route','show','203.0.113.0/24').stdout)
 assert not json.loads(ip('green','-j','route','show','203.0.113.0/24').stdout)
 setting('blue','net.ipv4.ip_forward',0);setting('green','net.ipv4.ip_forward',1)
 forwarding={name:ns(name,'sysctl','-n','net.ipv4.ip_forward').stdout.strip() for name in ['blue','green']};assert forwarding=={'blue':'0','green':'1'}
 marker=root/'shared.txt';marker.write_text('shared filesystem')
 assert ns('blue','cat',str(marker)).stdout==ns('green','cat',str(marker)).stdout=='shared filesystem'
 daemon=server(stack,'blue','192.0.2.10',label='blue')
 named=request('blue','192.0.2.10');assert named['ok'] and named['body']['server']=='blue'
 run('ip','netns','delete','blue');assert not Path('/run/netns/blue').exists()
 assert daemon.poll() is None and os.readlink(f'/proc/{daemon.pid}/ns/net')==views['blue']['net']
 by_pid=run('nsenter','-t',str(daemon.pid),'-n','python3','-c',
 'import http.client,json; c=http.client.HTTPConnection("192.0.2.10",18080,timeout=1);c.request("GET","/");r=c.getresponse();print(json.dumps({"status":r.status,"body":json.loads(r.read())}));c.close()')
 surviving=json.loads(by_pid.stdout);assert surviving['status']==200 and surviving['body']['server']=='blue'
 print(json.dumps({'parent':parent,'namespace_views':views,'blue_only_route':True,'forwarding':forwarding,
 'same_file_visible':True,'before_name_deleted':named,'name_deleted_process_alive':True,'after_name_deleted':surviving}))
"""
name='xbcatm-netpath-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN','--cap-add','SYS_ADMIN',
 '--memory','256m','--pids-limit','128',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The parent, blue, and green report three different network namespace identifiers. Their PID namespace identifiers and hostnames remain equal. A marker file created by the parent is also readable in both children. Those positive observations establish the intended scope: networking has changed, while these particular process and filesystem properties remain shared in the fixture.

Each child creates its own dummy0 with address 192.0.2.10/24. The identical names and addresses coexist because they belong to different networking contexts. Only blue receives a route for 203.0.113.0/24. Querying green’s routes confirms that it has no corresponding entry. The example verifies separate effective tables rather than merely printing the two namespace names.

The program explicitly sets IPv4 forwarding to zero in blue and one in green, then reads the values back through each namespace. This is a setting-isolation check, not a packet-forwarding demonstration. The local dummy interfaces have no physical peer. Configured addresses and routes can be inspected without implying that either namespace can reach an external service.

A real HTTP server starts in blue on 192.0.2.10. A normal named-namespace request receives status 200 and identity blue. The script then deletes the blue name and confirms its handle is absent, while the server process and its network namespace identifier remain. The process has not been killed by removing the naming reference.

Using that known server PID, nsenter executes another client in the surviving network namespace. It again receives status 200 and identity blue. This establishes continued application operation after name deletion, not just the presence of a proc entry. The fixture finally stops its own process and removes remaining named resources through its cleanup stack and container lifetime.

Keep naming, process ownership, and connectivity separate

Record both a service’s process ownership and the networking context used for management. Namespace identifiers help compare currently live contexts; do not turn an ephemeral identifier into a permanent inventory identity. If a name disappears unexpectedly, inspect the relevant owned process before concluding that its networking state has vanished or creating a replacement with assumed empty state.

For ordinary configuration files, ip netns exec can create a mount namespace and bind namespace-specific files into their conventional locations. This supports arrangements such as per-namespace resolver configuration; it does not establish a private copy of every filesystem object. Document those additional choices when reproducing a client’s environment so that DNS settings and route isolation are not confused.

Build connectivity through explicit virtual links, routes, forwarding, and filtering as required. A network namespace supplies a boundary for those resources, while their configuration determines communication. During teardown, stop the processes and release references owned by the service before expecting the namespace to disappear completely. Name deletion is one management operation within that lifecycle, not a universal process-termination command.

Sources

Linux network_namespaces(7), network resources isolated by a namespace, checked 2026-09-12.
Linux ip-netns(8), named handles, execution and deletion while processes remain, checked 2026-09-12.
Linux ip-link(8), interface creation and namespace placement, checked 2026-09-12.

AAAA records publish IPv6 addresses without proving reachability

Thu, 30 Dec 2027 00:00:00 +0000

An AAAA resource record contains one 128-bit IPv6 address. An A record contains an IPv4 address. A name may have either type, both types, or several addresses within each type. These are separate RRsets, so A and AAAA can have different TTLs. Publishing AAAA makes an address discoverable through DNS; it does not create an interface, route, listener, or working application.

When it breaks

A successful AAAA lookup can lead to a failed connection. The published address may be obsolete, the service may listen only on IPv4, or the path may lack usable IPv6 routing. Firewall rules and TLS configuration can also differ between families. An IPv4-only availability check can miss the problem while dual-stack users experience delays or failures through the advertised IPv6 path.

Happy Eyeballs reduces some dual-stack connection delays by coordinating address discovery and connection attempts. It is a client algorithm, not a DNS guarantee that every client implements. Fallback behavior, deadlines, and application protocols still matter. Publishing a broken AAAA is therefore not automatically harmless merely because a particular browser quickly succeeds through an A record during one test.

Missing AAAA also needs precise language. An authoritative A-only name can produce a successful DNS response with no AAAA data, commonly called NODATA. That differs from NXDOMAIN, which reports a nonexistent name. An A-only service is not categorically unreachable from every IPv6-only network: DNS64 can synthesize AAAA answers for use with NAT64 translation when that infrastructure and its requirements are present.

Check it quickly

Save the script as check-aaaa.py and run python3 check-aaaa.py with Docker available. The pinned environment uses BIND 9.18.49 and dnspython 2.3.0. Its isolated network contains working IPv6 loopback but no external route. The program starts a real HTTP listener on ::1 and performs both DNS queries and a separate IPv6 connection:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries
from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer
import http.client,socket,threading
records='dual 17 IN A 127.0.0.1\ndual 29 IN AAAA ::1\nv4-only 17 IN A 127.0.0.1\nbroken 29 IN AAAA 2001:db8::1234'
class Handler(BaseHTTPRequestHandler):
 def log_message(self,*args):pass
 def do_GET(self):
 body=b'IPv6 response';self.send_response(200);self.send_header('Content-Length',str(len(body)));self.end_headers();self.wfile.write(body)
class V6Server(ThreadingHTTPServer):address_family=socket.AF_INET6
with lab(records) as (_,update,cache,queries),V6Server(('::1',0),Handler) as server:
 thread=threading.Thread(target=server.serve_forever,daemon=True);thread.start()
 try:
 a=query('dual.lab.test.','A');aaaa=query('dual.lab.test.','AAAA')
 assert values(a)==['127.0.0.1'] and values(aaaa,'AAAA')==['::1']
 assert a.answer[0].ttl==17 and aaaa.answer[0].ttl==29
 address=values(aaaa,'AAAA')[0];assert len(socket.inet_pton(socket.AF_INET6,address))==16
 client=http.client.HTTPConnection(address,server.server_port,timeout=2)
 client.request('GET','/');reply=client.getresponse();body=reply.read();client.close()
 assert reply.status==200 and body==b'IPv6 response'
 only_a=query('v4-only.lab.test.');assert values(only_a)==['127.0.0.1']
 missing=query('v4-only.lab.test.','AAAA');assert missing.rcode()==0 and missing.answer==[]
 assert len(missing.authority)==1 and missing.authority[0].rdtype==dns.rdatatype.SOA
 broken=query('broken.lab.test.','AAAA');assert values(broken,'AAAA')==['2001:db8::1234']
 unreachable=socket.socket(socket.AF_INET6);unreachable.settimeout(.3)
 try:unreachable.connect(('2001:db8::1234',server.server_port));raise AssertionError('documentation address unexpectedly reachable')
 except OSError as error:failure=type(error).__name__
 finally:unreachable.close()
 print(json.dumps({'A':show(a),'AAAA_over_IPv4_DNS':show(aaaa),'IPv6_HTTP_status':reply.status,
 'AAAA_wire_address_bytes':16,'A_only_AAAA_query':show(missing),'published_but_unreachable':{'answer':show(broken),'connect_error':failure}},sort_keys=True))
 finally:server.shutdown();thread.join(timeout=2)
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The name dual.lab.test returns A 127.0.0.1 with TTL 17 and AAAA ::1 with TTL 29. Both DNS queries travel to an IPv4 DNS socket at 127.0.0.1. Receiving AAAA over that socket demonstrates that the address family described by the record is independent of the transport carrying the DNS question and answer.

The program converts the AAAA text into its packed form and checks that it occupies 16 bytes. It then uses the returned IPv6 address to request the local HTTP service. The recorded response is status 200 with the expected body. This verifies a usable IPv6 loopback connection for the selected address, rather than treating the existence of an AAAA record as the application test.

Querying AAAA for v4-only.lab.test returns NOERROR, no answer RRset, and an SOA in the authority section. The name still has its A record. Meanwhile, broken.lab.test successfully returns the documentation address 2001:db8::1234; connecting to it fails in this isolated environment. The result deliberately separates positive DNS data from transport success without sending test traffic to a real external host.

Check each advertised family through the service

Before publishing an IPv6 address, establish the listener, route, access rules, and application behavior. Test the hostname with its normal identity and test the individual advertised endpoints. A raw-address HTTP success does not validate hostname-based TLS or virtual-host routing. The example verifies local HTTP only; it neither demonstrates public IPv6 connectivity nor evaluates a client’s Happy Eyeballs implementation.

Keep both RRsets in monitoring and deployment records. Removing AAAA stops new authoritative answers but does not invalidate addresses already cached by clients. Existing connections have their own lifetimes. During a move, retain the old IPv6 service for the intended overlap and compare authoritative data with the recursive resolver used by affected clients before attributing every old connection to a stale DNS answer.

Finally, AAAA is forward address data, despite occasional descriptions calling it an IPv6 pointer. Reverse lookup uses PTR records under ip6.arpa, with reversed hexadecimal nibbles derived from the address. Publishing forward AAAA does not automatically publish that reverse record. Treat forward lookup, reverse naming, address selection, and successful application traffic as related checks with distinct configurations and observable outcomes.

Sources

RFC 3596 DNS extensions for IPv6, AAAA address data, transport independence, and ip6.arpa reverse names, checked 2026-09-12.
RFC 6147 DNS64, synthesized AAAA records for access to IPv4 servers, checked 2026-09-12.
RFC 8305 Happy Eyeballs version 2, client address selection and connection attempts, checked 2026-09-12.

TCP slow start grows with acknowledged data, not merely with elapsed time

Tue, 28 Dec 2027 00:00:00 +0000

Slow start grows a TCP sender’s congestion window while it learns how much outstanding data the path can support. With enough data and suitable acknowledgments, the classic behavior is approximately exponential growth across round trips. “Doubles every RTT” is a useful simplified pattern, not an unconditional timer rule. The window changes in response to transport feedback and the implementation’s growth conditions.

When it breaks

Waiting after connect does not automatically warm up the congestion window. If the application sends nothing, there are no data acknowledgments to support that growth. A very small exchange may also finish without using the existing flight budget. Expecting every short request to display a large doubling sequence mistakes an application-limited transfer for a continuously backlogged sender.

The initial window is not universally one or two segments on modern systems. RFC 6928 describes an experimental extension allowing a larger initial window, and the tested Linux sender begins with ten segments. The relevant unit matters too: Linux TCP_INFO reports snd_cwnd in segments, whereas many protocol explanations express congestion windows in bytes. Compare it with the sender’s MSS before reasoning about outstanding data volume.

Slow start does not always continue until a first loss, followed by a universal collapse. The slow-start threshold helps select between startup growth and congestion avoidance, and implementations may use additional startup detection. Recovery from a retransmission timeout differs from fast recovery. Applying one cartoon curve to every algorithm, loss signal, and workload can produce an incorrect diagnosis from otherwise valid measurements.

Check it quickly

Save this as check-slow-start.py and run python3 check-slow-start.py with Docker. The disposable environment uses Python 3.11.16 and iproute2 6.1.0, tested on Linux 6.12.76. NET_ADMIN and SYS_ADMIN support nested namespaces. A new veth joins client and target; netem adds ten milliseconds of egress delay in each direction, with all changes confined to those virtual endpoints:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 iputils-ping=3:20221126-1+deb12u1 nftables=1.0.6-2+deb12u2 tcpdump=4.99.3-1 traceroute=1:2.1.2-1 procps=2:4.0.2-3 && rm -rf /var/lib/apt/lists/*\nCMD ["python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,select,signal,subprocess,time

def run(*args,check=True,input=None,timeout=8):
 result=subprocess.run(args,input=input,capture_output=True,text=True,timeout=timeout)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def ns(name,*args,**kwargs):return run('ip','netns','exec',name,*args,**kwargs)
def ip(name,*args,**kwargs):return ns(name,'ip',*args,**kwargs)
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=2)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=2)
def line(process,timeout=3):
 assert select.select([process.stdout],[],[],timeout)[0],'child response deadline exceeded'
 value=process.stdout.readline();assert value,('child exited without a response',process.stderr.read())
 return value
def spawn(stack,command):
 process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);return process
@contextmanager
def lab(names):
 with TemporaryDirectory(prefix='net-path-') as directory,ExitStack() as stack:
 root=Path(directory);proc=root/'proc';proc.mkdir();run('mount','-t','proc','proc',str(proc))
 stack.callback(run,'umount',str(proc))
 for name in names:
 run('ip','netns','add',name);stack.callback(run,'ip','netns','delete',name,check=False)
 ip(name,'link','set','lo','up')
 def setting(name,key,value):
 assert name in names
 path=proc/'sys'/key.replace('.','/')
 return ns(name,'python3','-c',f'from pathlib import Path; p=Path({str(path)!r}); p.write_text({str(value)!r}); print(p.read_text().strip())').stdout.strip()
 yield root,stack,setting
def wire(left,left_if,right,right_if,left_addresses,right_addresses):
 run('ip','link','add',left_if,'type','veth','peer','name',right_if)
 for name,interface,addresses in [(left,left_if,left_addresses),(right,right_if,right_addresses)]:
 run('ip','link','set',interface,'netns',name)
 for address in addresses:ip(name,'address','add',address,'dev',interface,*(['nodad'] if ':' in address else []))
 ip(name,'link','set',interface,'up')
def nft(name,script):return ns(name,'nft','-f','-',input=script)
def counters(name):
 data=json.loads(ns(name,'nft','-j','list','ruleset').stdout);found={}
 for entry in data['nftables']:
 rule=entry.get('rule',{})
 if 'comment' in rule:
 for expression in rule['expr']:
 if 'counter' in expression:found[rule['comment']]=expression['counter']['packets']
 return found


info_code=r'''
import struct
def tcp_info(stream):
 raw=stream.getsockopt(socket.IPPROTO_TCP,socket.TCP_INFO,104);assert len(raw)==104
 offsets={'snd_mss':16,'unacked':24,'rtt_us':68,'snd_ssthresh':76,'snd_cwnd':80,'total_retrans':100}
 return {'ca_state':raw[1],**{key:struct.unpack_from('=I',raw,offset)[0] for key,offset in offsets.items()}}
'''
with lab(['client','target']) as (root,stack,setting):
 wire('client','c0','target','t0',['192.0.2.1/30'],['192.0.2.2/30'])
 for name,interface in [('client','c0'),('target','t0')]:
 ns(name,'tc','qdisc','add','dev',interface,'root','netem','delay','10ms','limit','10000')
 server_code=r'''
import socket,json,hashlib,sys
size=int(sys.argv[1]);listener=socket.socket();listener.setsockopt(socket.SOL_SOCKET,socket.SO_REUSEADDR,1)
listener.bind(('192.0.2.2',18080));listener.listen();print('listening',flush=True)
with listener.accept()[0] as connection:
 connection.settimeout(6);remaining=size;digest=hashlib.sha256()
 while remaining:
 chunk=connection.recv(min(65536,remaining));assert chunk;remaining-=len(chunk);digest.update(chunk)
 assert digest.hexdigest()==hashlib.sha256(b'x'*size).hexdigest()
 connection.sendall((digest.hexdigest()+'\n').encode())
'''
 client_code=info_code+r'''
import socket,json,time,threading,sys,hashlib
size=int(sys.argv[1]);stream=socket.socket();stream.settimeout(6)
stream.setsockopt(socket.IPPROTO_TCP,socket.TCP_CONGESTION,b'reno');stream.connect(('192.0.2.2',18080))
initial=tcp_info(stream);time.sleep(.06);idle=tcp_info(stream);assert idle['snd_cwnd']==initial['snd_cwnd']
done=threading.Event();errors=[];samples=[initial,idle];reply=[]
def transfer():
 try:
 stream.sendall(b'x'*size)
 with stream.makefile('rb') as incoming:reply.append(incoming.readline().decode().strip())
 except BaseException as error:errors.append(repr(error))
 finally:done.set()
worker=threading.Thread(target=transfer);worker.start();deadline=time.monotonic()+7
while not done.wait(.005):
 assert time.monotonic()<deadline,'transfer deadline exceeded'
 snapshot=tcp_info(stream)
 if snapshot!=samples[-1]:samples.append(snapshot)
worker.join(timeout=1);assert not worker.is_alive() and not errors,errors
samples.append(tcp_info(stream));assert reply==[hashlib.sha256(b'x'*size).hexdigest()]
assert all(row['total_retrans']==0 for row in samples),samples
if size>1:assert max(row['snd_cwnd'] for row in samples)>initial['snd_cwnd']*2,samples
else:assert max(row['snd_cwnd'] for row in samples)==initial['snd_cwnd'],samples
print(json.dumps({'bytes':size,'algorithm':stream.getsockopt(socket.IPPROTO_TCP,socket.TCP_CONGESTION,16).split(b'\0')[0].decode(),
 'before_data':initial,'after_idle_without_data':idle,'samples':samples,'sha256':reply[0]}));stream.close()
'''
 results={}
 for label,size in [('short',1),('bulk',1048576)]:
 service=spawn(stack,['ip','netns','exec','target','python3','-u','-c',server_code,str(size)]);assert line(service).strip()=='listening'
 results[label]=json.loads(ns('client','python3','-c',client_code,str(size),timeout=10).stdout)
 service.wait(timeout=2);assert service.returncode==0
 print(json.dumps({'egress_delay_each_direction_ms':10,'transfers':results}))
"""
name='xbcatm-tcpflow-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN','--cap-add','SYS_ADMIN',
 '--memory','256m','--pids-limit','128',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The client explicitly selects Reno so the experiment is not silently comparing different default congestion controllers. It records TCP_INFO before sending, waits sixty milliseconds without data, and records it again. The window stays at ten segments in both observations. That directly tests the mistaken expectation that simply leaving a new connection open makes its congestion budget grow on a clock.

The first transfer sends one byte and receives a digest from the server. Samples include one segment outstanding and then none, while the congestion window remains ten. Successful delivery therefore does not require visible exponential growth for this workload. There was already enough permitted flight size for the entire request, so its limited application data does not exercise a bulk startup ramp.

The second transfer sends one mebibyte. A separate thread performs the blocking exchange while the main thread samples socket state, avoiding loss of observations while sendall waits. The captured progression includes ten, twenty, forty, and eighty segments, followed by less tidy values as acknowledgment grouping and transfer progress interact. The test requires substantial growth, not one exact sample sequence or one sample per RTT.

Both server and client verify the payload through SHA-256, and all sampled retransmission totals remain zero. The threshold is much larger than the observed window in this run. These observations support an ACK-driven startup demonstration without deliberately testing loss recovery or measuring a shared bottleneck. The artificial delay makes progress observable; it does not establish a real WAN’s capacity or fairness.

Interpret a growth trace in its workload context

Record algorithm, MSS, congestion window, threshold, outstanding data, RTT, and retransmission evidence together. A window larger than the current unacknowledged count is possible because the application or receiver can impose another limit. Treat a sampled window as the sender’s current allowance, not as a promise that exactly that many segments are continuously occupying the path.

Sampling also affects the picture. A userspace observer can miss intermediate changes, and its five-millisecond interval is not synchronized with ACK arrivals. Delayed acknowledgments, offload behavior, and scheduling can alter the visible progression. The fixture checks relationships supported by the data rather than declaring that an omitted intermediate value proves a broken congestion controller.

For short operations, reducing unnecessary new connections may avoid repeatedly starting with a fresh congestion budget, where the application protocol permits reuse. A reused connection can still restart with a reduced window after an idle period, depending on its restart policy. For bulk performance, test representative RTT, loss, receive behavior, and competing traffic before changing startup settings. This experiment separates idle time, a tiny successful exchange, and sustained data, providing a concrete basis for deciding whether slow start is relevant to the observed delay.

Sources

RFC 5681 Congestion Control, ACK-driven slow start, congestion avoidance, threshold transitions and idle restart, checked 2026-09-12.
RFC 6928 Initial Window, the experimental extension allowing a larger initial congestion window, checked 2026-09-12.
Linux 6.12.76 TCP_INFO fields, congestion window, threshold, unacknowledged segments and retransmissions, checked 2026-09-12.

The listen backlog holds connections waiting for accept

Mon, 25 Oct 2027 00:00:00 +0000

On Linux TCP sockets, the listen() backlog concerns established connections waiting for the application to accept them. The incomplete-handshake queue is a separate concept. Calling accept() removes a pending connection and returns a connected socket for application use. That accepted connection no longer occupies the listener’s accept queue, even if it remains open and busy for a long time.

When it breaks

If connections arrive faster than the application accepts them, the pending queue can fill. New clients may then encounter retransmission delays or timeouts, depending on kernel behavior and settings. Existing accepted requests can still look healthy. A process being alive, or some requests succeeding, does not prove that its listener is accepting new connections quickly enough.

The requested backlog is also constrained by net.core.somaxconn; increasing only a larger application value cannot exceed that cap. The exact observable queue boundary is implementation-dependent, however, so treating the integer as a portable promise of precisely that many successful simultaneous connects is unsafe. Measure the deployed kernel rather than converting one small experiment into a universal off-by-one rule.

Queue counters need context. ListenOverflows and ListenDrops are network-namespace counters, not automatically per-service explanations. Other listeners can contribute to them, and a client timeout can have causes outside the accept queue. Correlate queue occupancy, acceptance progress, and counters before attributing production failures to a particular backlog setting or declaring that a larger queue will fix them.

Check it quickly

Save this as check-listen-backlog.py and run it with host Python, Docker, and the pinned Python image available. The actual socket operations run inside a disposable Linux container with networking disabled except loopback. The recorded kernel was 6.12.76-linuxkit. The script reads relevant settings without modifying them and requires tcp_abort_on_overflow=0 for its timeout observation:

import json,subprocess
image='python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84'
program=r'''
from contextlib import ExitStack
from pathlib import Path
import json,platform,socket
def counters():
 lines=Path('/proc/net/netstat').read_text().splitlines()
 for index,line in enumerate(lines):
 if line.startswith('TcpExt:'):
 return dict(zip(line.split()[1:],map(int,lines[index+1].split()[1:])))
def queued(port):
 for line in Path('/proc/net/tcp').read_text().splitlines()[1:]:
 fields=line.split()
 if fields[3]=='0A' and int(fields[1].split(':')[1],16)==port:
 return int(fields[4].split(':')[1],16)
 raise AssertionError('listener missing')
with ExitStack() as stack:
 def fresh():
 s=stack.enter_context(socket.socket());s.settimeout(.25);return s
 def listener(backlog):
 s=fresh();s.bind(('127.0.0.1',0));s.listen(backlog);return s
 somaxconn=int(Path('/proc/sys/net/core/somaxconn').read_text())
 abort=int(Path('/proc/sys/net/ipv4/tcp_abort_on_overflow').read_text());assert abort==0
 small=listener(1);address=small.getsockname();before=counters();clients=[];timed_out=False
 for _ in range(8):
 client=fresh()
 try:client.connect(address)
 except TimeoutError:timed_out=True;client.close();break
 clients.append(client)
 depth=queued(address[1]);after=counters()
 assert timed_out and depth==len(clients) and 1<=depth<8,(depth,len(clients))
 changes={name:after[name]-before[name] for name in ['ListenOverflows','ListenDrops']}
 assert changes['ListenOverflows']>0 and changes['ListenDrops']>0,changes
 accepted=[]
 for client in clients:
 server,_=small.accept();stack.enter_context(server);accepted.append(server);server.sendall(b'ready')
 reader=stack.enter_context(client.makefile('rb'));assert reader.read(5)==b'ready'
 assert queued(address[1])==0
 for _ in range(4):
 client=fresh();client.connect(address);server,_=small.accept();stack.enter_context(server)
 server.sendall(b'ready');reader=stack.enter_context(client.makefile('rb'));assert reader.read(5)==b'ready'
 accepted.append(server);clients.append(client)
 assert len(accepted)>1 and all(s.fileno()>=0 for s in accepted)
 larger=listener(16)
 for _ in range(6):client=fresh();client.connect(larger.getsockname())
 assert queued(larger.getsockname()[1])==6
 print(json.dumps({'kernel':platform.release(),'somaxconn':somaxconn,'tcp_abort_on_overflow':abort,
 'requested_small_backlog':1,'queued_before_accept':depth,'next_connect_timed_out':timed_out,
 'counter_changes':changes,'accepted_connections_still_open':len(accepted),'larger_backlog_queued':6},sort_keys=True))
'''
result=subprocess.run(['docker','run','--rm','-i','--network','none',image,'python','-'],
 input=program,capture_output=True,text=True,timeout=30)
assert result.returncode==0,result.stderr
record=json.loads(result.stdout);print(json.dumps(record,sort_keys=True))

The first listener requests backlog one and deliberately does not accept connections. In the recorded environment, two client connects complete and /proc/net/tcp reports two queued connections. The next connect exceeds the client’s 250-millisecond timeout. The script records the observed depth rather than asserting that every Linux version must admit exactly two under this setting.

During that controlled overflow, both ListenOverflows and ListenDrops increase by one. Because the experiment has its own network namespace and only these loopback listeners, the observation can be associated with its deliberately stalled listener. No global kernel setting is changed, and the example does not manufacture failure by altering the shared Docker VM’s networking policy.

The application then accepts the queued connections and sends a short acknowledgement over each returned socket. The clients read the complete acknowledgement, and the listener queue falls to zero. Four more connections are created and promptly accepted while the previous accepted sockets remain open. Six accepted connections coexist despite the original requested backlog of one.

A second listener requests backlog sixteen. Six clients connect before any acceptance, and its queue reports six pending connections. This demonstrates that a larger queue can absorb this particular arrival burst while the application is paused. It does not show higher processing throughput, prove those clients received application responses, or establish that increasing a backlog solves sustained overload.

Tune acceptance and waiting capacity together

The recorded somaxconn value is 4096, comfortably above both requested backlogs. That value is an observation of the test environment, not a recommendation to copy into another host. Inspect the application’s actual listen argument, its accept loop, and the kernel cap together. A high system limit cannot enlarge a small backlog the application deliberately requests.

Separate incomplete handshakes from established connections awaiting acceptance. SYN-queue controls and SYN-cookie behavior answer different questions from the accept queue shown here. Likewise, tcp_abort_on_overflow changes overflow handling; enabling resets is not an increase in service capacity. This experiment leaves it disabled and demonstrates the client-visible timeout under that existing policy.

Finally, investigate why acceptance falls behind. Event-loop stalls, descriptor exhaustion, dispatch bottlenecks, and deliberate pauses can affect it differently from slow work on already accepted sockets. A larger queue buys waiting room, which must fit client deadlines and memory budgets. If sustained arrivals exceed the rate the service can accept and handle, additional waiting only postpones the capacity failure.

Sources

Linux listen(2), established connections waiting for accept and the somaxconn cap, checked 2026-09-12.
Linux accept(2), removing a pending connection and returning a connected socket, checked 2026-09-12.
Linux IP sysctl documentation, somaxconn, SYN backlog, and tcp_abort_on_overflow, checked 2026-09-12.

IPv6 routers report oversized packets; sources decide how to fit the path

Wed, 06 Oct 2027 00:00:00 +0000

An IPv6 router does not fragment a packet while forwarding it toward its destination. If the packet is too large for the next link, the router normally discards it and sends ICMPv6 Packet Too Big feedback. The source can then adjust its packet size or, where appropriate, send fragments using the IPv6 Fragment header. Reassembly of those fragments takes place at the destination.

When it breaks

Assuming a router will split an oversized IPv6 packet hides a size-dependent failure. A small echo request can work while a larger one fails, even when both use the same addresses and route. The endpoint’s local interface may support the original size while an intermediate link does not. Check the entire path constraint rather than concluding that a configured 1500-byte interface guarantees that size end to end.

Missing Packet Too Big feedback makes it harder for classic discovery to learn that constraint. Fragment filtering or losing one fragment can also prevent successful reassembly. The ability to generate a Fragment header does not establish that every network policy will permit the resulting packets. Avoid treating source fragmentation as a universal substitute for correct path sizing and the required control traffic.

The reverse direction has its own path estimate. Learning the request path’s MTU does not automatically teach the responder how to size a large reply. A two-way echo test therefore needs both directions understood. TCP segmentation is also distinct from IP fragmentation: a TCP sender can form smaller segments after learning a path constraint without fragmenting each IP packet.

Check it quickly

Save this as check-ipv6-fragmentation.py and run python3 check-ipv6-fragmentation.py with Docker. The disposable environment uses Python 3.11.16, iproute2 6.1.0, iputils ping, and tcpdump 4.99.3, tested on Linux 6.12.76. NET_ADMIN and SYS_ADMIN support four nested namespaces. Two routers and two endpoints use newly created veth links without modifying host interfaces or routes:

from pathlib import Path
from tempfile import TemporaryDirectory
import subprocess,json,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 iputils-ping=3:20221126-1+deb12u1 nftables=1.0.6-2+deb12u2 tcpdump=4.99.3-1 traceroute=1:2.1.2-1 procps=2:4.0.2-3 && rm -rf /var/lib/apt/lists/*\nCMD ["python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,select,signal,subprocess,time
def run(*args,check=True,input=None,timeout=8):
 result=subprocess.run(args,input=input,capture_output=True,text=True,timeout=timeout)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def ns(name,*args,**kwargs):return run('ip','netns','exec',name,*args,**kwargs)
def ip(name,*args,**kwargs):return ns(name,'ip',*args,**kwargs)
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=2)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=2)
def spawn(stack,command):
 process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);return process
def line(process,timeout=3):
 assert select.select([process.stdout],[],[],timeout)[0],'child response deadline exceeded'
 value=process.stdout.readline();assert value,process.stderr.read();return value
@contextmanager
def lab():
 with TemporaryDirectory(prefix='mtu-path-') as directory,ExitStack() as stack:
 root=Path(directory);proc=root/'proc';proc.mkdir();run('mount','-t','proc','proc',str(proc));stack.callback(run,'umount',str(proc))
 for name in ['client','r1','r2','target']:
 run('ip','netns','add',name);stack.callback(run,'ip','netns','delete',name,check=False);ip(name,'link','set','lo','up')
 def setting(name,key,value):
 assert name in ['client','r1','r2','target']
 path=proc/'sys'/key.replace('.','/')
 ns(name,'python3','-c',f'from pathlib import Path; p=Path({str(path)!r});p.write_text({str(value)!r});assert p.read_text().strip()=={str(value)!r}')
 yield root,stack,setting
def topology(setting,ipv6=False):
 links=[('client','c0','r1','a0',1,2,1,1500),('r1','a1','r2','b0',2,1,2,1280),('r2','b1','target','t0',3,1,2,1500)]
 for left,left_if,right,right_if,network,left_host,right_host,mtu in links:
 run('ip','link','add',left_if,'type','veth','peer','name',right_if)
 for name,interface,host in [(left,left_if,left_host),(right,right_if,right_host)]:
 run('ip','link','set',interface,'netns',name);ip(name,'link','set',interface,'mtu',str(mtu))
 address=f'2001:db8:{network}::{host}/64' if ipv6 else f'10.210.{network}.{host}/30'
 ip(name,'addr','add',address,'dev',interface,*(['nodad'] if ipv6 else []));ip(name,'link','set',interface,'up')
 family='-6' if ipv6 else '-4'
 for name in ['r1','r2']:setting(name,'net.ipv6.conf.all.forwarding' if ipv6 else 'net.ipv4.ip_forward',1)
 routes=[('client','default','2001:db8:1::1' if ipv6 else '10.210.1.1'),('target','default','2001:db8:3::1' if ipv6 else '10.210.3.1'),
 ('r1','2001:db8:3::/64' if ipv6 else '10.210.3.0/30','2001:db8:2::2' if ipv6 else '10.210.2.2'),
 ('r2','2001:db8:1::/64' if ipv6 else '10.210.1.0/30','2001:db8:2::1' if ipv6 else '10.210.2.1')]
 for name,destination,gateway in routes:ip(name,family,'route','add',destination,'via',gateway)
 if ipv6:
 deadline=time.monotonic()+4
 while any('tentative' in ip(name,'-6','address','show').stdout for name in ['client','r1','r2','target']):
 assert time.monotonic()<deadline,'IPv6 link-local DAD did not finish';time.sleep(.02)
def nft(name,script):return ns(name,'nft','-f','-',input=script)
def counters(name):
 result={}
 for item in json.loads(ns(name,'nft','-j','list','ruleset').stdout)['nftables']:
 rule=item.get('rule',{})
 if 'comment' in rule:
 for expression in rule['expr']:
 if 'counter' in expression:result[rule['comment']]=expression['counter']['packets']
 return result
def capture(stack,root,name,interface,expression,label):
 path=root/(label+'.pcap')
 process=subprocess.Popen(['ip','netns','exec',name,'tcpdump','--immediate-mode','-Z','root','-U','-n','-i',interface,'-w',str(path),expression],stdout=subprocess.DEVNULL,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);deadline=time.monotonic()+3
 while time.monotonic()<deadline:
 assert process.poll() is None,'capture exited'
 if select.select([process.stderr],[],[],.1)[0] and 'listening on' in process.stderr.readline():return process,path
 raise AssertionError('capture did not become ready')
def captured(process,path):
 process.send_signal(signal.SIGINT);_,diagnostic=process.communicate(timeout=3);assert process.returncode==0,diagnostic
 return run('tcpdump','-nn','-vv','-r',str(path)).stdout

with lab() as (root,stack,setting):
 topology(setting,ipv6=True);target='2001:db8:3::2'
 small=ns('client','ping','-6','-n','-c','1','-W','1','-s','32',target);assert small.returncode==0
 tap,path=capture(stack,root,'client','c0','ip6','too-big')
 large=ns('client','ping','-6','-n','-M','do','-s','1400','-c','1','-W','1',target,check=False)
 feedback=captured(tap,path);assert large.returncode!=0 and 'too big' in feedback.lower(),(large.stdout,large.stderr,feedback)
 route=ip('client','-6','route','get',target).stdout;assert 'mtu 1280' in route,route
 reverse=ns('target','ping','-6','-n','-M','do','-s','1400','-c','1','-W','1','2001:db8:1::2',check=False)
 reverse_route=ip('target','-6','route','get','2001:db8:1::2').stdout
 assert reverse.returncode!=0 and 'mtu 1280' in reverse_route,(reverse.stdout,reverse.stderr,reverse_route)
 tap,path=capture(stack,root,'client','c0','ip6 and src 2001:db8:1::2','source-fragments')
 fragmented=ns('client','ping','-6','-n','-M','dont','-s','2000','-c','1','-W','2',target,check=False)
 trace=captured(tap,path);assert fragmented.returncode==0,(fragmented.stdout,fragmented.stderr,trace)
 assert 'frag (' in trace and trace.count('frag (')>=2,trace
 refused=ns('client','ping','-6','-n','-M','do','-s','2000','-c','1','-W','1',target,check=False)
 assert refused.returncode!=0 and 'too long' in (refused.stdout+refused.stderr).lower(),(refused.stdout,refused.stderr)
 print(json.dumps({'small_echo':small.stdout,'oversize_before_learning':{'stdout':large.stdout,'stderr':large.stderr,'returncode':large.returncode},
 'packet_too_big_capture':feedback,'learned_route':route,'reverse_path_learning':reverse.stdout+reverse.stderr,'reverse_route':reverse_route,'source_fragmented_echo':fragmented.stdout,
 'source_side_fragment_capture':trace,'dont_fragment_after_learning':{'returncode':refused.returncode,'stdout':refused.stdout,'stderr':refused.stderr}}))
"""
name='xbcatm-mtupath-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN','--cap-add','SYS_ADMIN','--memory','256m','--pids-limit','128',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The endpoint links have MTU 1500 and the intermediate router link has MTU 1280. Static global addresses use nodad, while setup explicitly waits for automatically generated link-local addresses to leave the tentative state. That readiness check avoids mistaking initial address setup delays for a forwarding or MTU failure. The experiment does not claim to test the Duplicate Address Detection algorithm itself.

A small echo exchange succeeds first. An echo payload of 1400 bytes, sent with the do policy, then creates a 1448-byte IPv6 packet after its base and ICMPv6 headers are included. It fits the source interface but not the middle link. The capture shows the original request and a router Packet Too Big message reporting MTU 1280; the client route lookup records that learned value.

The target performs the corresponding oversized probe toward the client and learns MTU 1280 for the reverse path. This explicit step prepares its large echo reply rather than assuming that one endpoint’s cache covers both directions. Both failed discovery probes remain in the output, with their router feedback and route state, so the setup conditions behind later success are visible.

The client next sends a 2000-byte echo payload with the dont policy, allowing source fragmentation under the learned limit. A capture on the client interface, restricted to the client’s source address, shows two fragments with the same identification before either router processes them. Their displayed data offsets are zero and 1232 bytes, and their fragment data lengths sum to 2008, including the ICMPv6 header.

That echo succeeds after destination reassembly and a correctly sized return exchange. Repeating the same payload with do instead reports a local message-too-long error and MTU 1280. The results distinguish a router reporting an unknown bottleneck, source-generated fragments after discovery, and a local refusal once the smaller path limit is known. They are different failure and delivery stages.

Diagnose size and direction before recommending fragmentation

Include all relevant headers when calculating packet size. A fragment adds its own header, and the IPv6 Fragment Offset field uses eight-byte units even though diagnostic tools may display byte offsets. Use consistent units when reconstructing ranges. The script’s two source fragments provide concrete evidence; the absence of a fragment from an unrelated capture would require more context to interpret.

An IPv6 router can still act as the source of its own packets, which is separate from fragmenting transit traffic. Keep that role distinction when reading captures from routers or tunnel endpoints. Also distinguish the path’s minimum link MTU from a particular application’s chosen payload size: they are related by protocol overhead and the sender’s packetization policy.

Prefer application and transport behavior that fits the known path where possible, and verify any required fragment handling with actual traffic. This exercise proves source placement, feedback, route learning, and a successful fragmented echo. It does not validate arbitrary extension-header chains, fragment-filtering policies, or every transport’s behavior under missing control messages.

Sources

RFC 8200 IPv6, source fragmentation, Fragment headers and destination reassembly, checked 2026-09-12.
RFC 8201 IPv6 Path MTU Discovery, Packet Too Big feedback and directional path estimates, checked 2026-09-12.
Linux ping(8), payload sizing and do/dont path-MTU policies, checked 2026-09-12.

TCP keepalive probes idle connections

Tue, 05 Oct 2027 00:00:00 +0000

TCP keepalive asks whether the other TCP endpoint still responds after a quiet period. It does not ask whether an HTTP handler, database query, or worker is making progress. A peer’s kernel can acknowledge traffic while its application is stalled. Treat transport reachability and useful application responses as different observations.

A transport probe, not an application heartbeat

Keepalive can expose a connection whose remote state disappeared or whose path silently stopped delivering traffic. The implementation sends probes after sufficient inactivity and eventually reports failure after its configured unanswered-probe policy. A single lost probe is not proof of a dead peer; transient loss must not be mistaken for certainty.

These probes are handled below the application’s byte stream. They are not HTTP requests, database pings, or WebSocket heartbeats. If a proxy terminates the TCP connection, the peer being probed is that proxy, not the origin behind it. Probes may affect some middlebox tracking, but cannot be assumed to refresh an application’s idle timer or preserve every NAT mapping.

Already outstanding data has its own retransmission and failure rules. Do not translate a keepalive setting into a universal deadline for busy connections. A FIN, reset, application timeout, and silent network loss are different events and may require different recovery decisions.

Configure the socket you actually use

RFC 1122 requires an optional keepalive mechanism to default off, with a configurable default idle interval of at least two hours. Applications and libraries can explicitly enable it and choose shorter intervals; Go’s dialer is one example. Therefore kernel defaults alone do not establish an application’s effective behavior.

On Linux, tcp_keepalive_time, tcp_keepalive_intvl, and tcp_keepalive_probes describe idle seconds, probe spacing, and the unanswered-probe limit. The documented defaults are 7200, 75, and 9. Per-socket TCP_KEEPIDLE, TCP_KEEPINTVL, and TCP_KEEPCNT can specialize the policy when SO_KEEPALIVE is enabled. These names and interfaces are not universal macOS or Windows settings.

Choose intervals against detection needs, connection count, transient-loss tolerance, and intermediary policies. An idle-plus-probe arithmetic estimate is not a hard real-time guarantee. Prefer scoped socket configuration over changing machine-wide defaults for unrelated services, and check setter errors and the actual enabled state.

When it breaks

A supposedly protected request may hang because only keepalive was configured, with no application read deadline. Conversely, an application deadline can expire while the TCP connection remains usable. Neither result proves that the peer process died. Retrying a write after a local timeout can duplicate work that the peer has already received.

A lower idle timeout at a proxy can still close a connection regardless of the endpoint’s keepalive policy. Excessively frequent probes also add traffic and power cost across large fleets. Diagnose the actual terminating hop and failure signal before changing all three timers together.

Check it quickly

Save this as keepalive_probe.go and run go run keepalive_probe.go with Go 1.23 or newer on macOS or Linux. The SO_KEEPALIVE inspection uses a Unix socket API; this exact program is not a Windows recipe. It creates only loopback sockets and changes no sysctl, firewall, or shared service.

package main

import (
 "errors"
 "fmt"
 "io"
 "net"
 "os"
 "runtime"
 "syscall"
 "time"
)

func must(err error) {
 if err != nil {
 panic(err)
 }
}

func check(ok bool, message string) {
 if !ok {
 panic(message)
 }
}

func keepalive(connection *net.TCPConn) int {
 raw, err := connection.SyscallConn()
 must(err)
 var value int
 var optionError error
 must(raw.Control(func(fd uintptr) {
 value, optionError = syscall.GetsockoptInt(int(fd), syscall.SOL_SOCKET, syscall.SO_KEEPALIVE)
 }))
 must(optionError)
 return value
}

func main() {
 listener, err := net.ListenTCP("tcp4", &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1)})
 must(err)
 defer listener.Close()
 must(listener.SetDeadline(time.Now().Add(2 * time.Second)))
 dialer := net.Dialer{Timeout: 2 * time.Second, KeepAlive: -1}
 connection, err := dialer.Dial("tcp4", listener.Addr().String())
 must(err)
 client := connection.(*net.TCPConn)
 defer client.Close()
 peer, err := listener.AcceptTCP()
 must(err)
 defer peer.Close()

 check(keepalive(client) == 0, "keepalive must start disabled")
 must(client.SetKeepAliveConfig(net.KeepAliveConfig{
 Enable: true, Idle: 30 * time.Second,
 Interval: 10 * time.Second, Count: 3,
 }))
 enabled := keepalive(client)
 check(enabled != 0, "SO_KEEPALIVE must be enabled")
 fmt.Printf("SO_KEEPALIVE: 0 -> %d (enabled); per-socket configuration accepted\n", enabled)

 must(client.SetWriteDeadline(time.Now().Add(2 * time.Second)))
 n, err := client.Write([]byte("ping"))
 must(err)
 check(n == 4, "request must be fully written")
 must(client.SetReadDeadline(time.Now().Add(200 * time.Millisecond)))
 reply := make([]byte, 4)
 n, err = client.Read(reply)
 check(n == 0 && errors.Is(err, os.ErrDeadlineExceeded), "silent application must reach read deadline")
 fmt.Println("read deadline fired while the peer application was silent")

 must(peer.SetDeadline(time.Now().Add(2 * time.Second)))
 request := make([]byte, 4)
 _, err = io.ReadFull(peer, request)
 must(err)
 check(string(request) == "ping", "the original request is still queued")
 n, err = peer.Write([]byte("pong"))
 must(err)
 check(n == 4, "reply must be fully written")
 must(client.SetReadDeadline(time.Now().Add(2 * time.Second)))
 _, err = io.ReadFull(client, reply)
 must(err)
 check(string(reply) == "pong", "same connection must deliver the reply")
 fmt.Println("after resetting the read deadline, the original connection returns pong")
 fmt.Println(runtime.Version(), runtime.GOOS)
}

The dialer first disables keepalive. Explicit socket configuration then enables it, and getsockopt must return a nonzero value; enabled need not equal one. The checked macOS Go 1.27.0 run returned eight. The peer application deliberately leaves the four-byte request unread while the client’s 200-millisecond read deadline expires.

Afterward, the peer reads the original ping and writes pong. Resetting the client’s read deadline permits that reply on the same connection, without reconnecting or resending. The timeout bounded a local wait; it did not withdraw queued bytes or cancel remote work.

All assertions passed. This short experiment checks socket configuration and application-deadline behavior, not actual keepalive probes: the configured first-probe idle interval is thirty seconds. It neither drops packets nor measures failure detection through a NAT. Those require a separately controlled network test with packet evidence and recovery checks.

Sources

RFC 1122: Requirements for Internet Hosts, section 4.2.3.6: optional keepalive, inactivity, and lost probes, checked 2026-09-09.
Linux tcp(7), keepalive defaults, socket options, and shorter intermediary timeouts, checked 2026-09-09.
Go net, KeepAliveConfig, socket configuration, and deadline semantics, checked 2026-09-09.

A default route matches broadly; it does not rescue every failed path

Tue, 14 Sep 2027 00:00:00 +0000

An IPv4 default route is the prefix 0.0.0.0/0: it matches every IPv4 destination, with the least possible specificity. In a selected routing table, a longer matching prefix normally takes precedence. The default is not a procedure that retries whenever a more specific route fails. Routing policy selects relevant tables, and the chosen route describes a forwarding decision rather than promising that the entire round trip will succeed.

When it breaks

A machine without a default can still reach destinations covered by connected or explicit routes. Conversely, adding a default does not prove internet access. The next hop needs to be reachable, forwarding and filtering must permit the traffic, and replies need a return path. A displayed gateway is only one part of that contract; application communication supplies the evidence that the configured path works.

A more specific rejection route wins over a working default. Linux route types such as unreachable intentionally stop forwarding for matching destinations. A failed neighbor lookup through a selected gateway also does not mean the kernel will automatically search for a healthier, less specific path. Static route preference and metrics are not a service-health monitoring or failover system.

Return-path errors are particularly misleading. The client can select the expected gateway and send traffic toward a listening server, yet fail because the server cannot route replies to the client. Repeatedly changing the client’s default may damage working destinations without repairing that missing reverse path. Inspect both directions and the actual source address before attributing every connection timeout to the sender’s gateway.

Check it quickly

Save this as check-default-route.py and run python3 check-default-route.py with Docker. Python 3.11.16 and iproute2 6.1.0 build a client–router–target topology inside one disposable Linux container. NET_ADMIN and SYS_ADMIN support its nested namespaces and temporary proc mount. All interfaces are newly created veth devices, and no port or route is published on the host:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 iputils-ping=3:20221126-1+deb12u1 nftables=1.0.6-2+deb12u2 tcpdump=4.99.3-1 traceroute=1:2.1.2-1 procps=2:4.0.2-3 && rm -rf /var/lib/apt/lists/*\nCMD ["python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,select,signal,subprocess,time

def run(*args,check=True,input=None,timeout=8):
 result=subprocess.run(args,input=input,capture_output=True,text=True,timeout=timeout)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def ns(name,*args,**kwargs):return run('ip','netns','exec',name,*args,**kwargs)
def ip(name,*args,**kwargs):return ns(name,'ip',*args,**kwargs)
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=2)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=2)
def line(process,timeout=3):
 assert select.select([process.stdout],[],[],timeout)[0],'child response deadline exceeded'
 value=process.stdout.readline();assert value,'child exited without a response'
 return value
def spawn(stack,command):
 process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);return process
@contextmanager
def lab(names):
 with TemporaryDirectory(prefix='net-path-') as directory,ExitStack() as stack:
 root=Path(directory);proc=root/'proc';proc.mkdir();run('mount','-t','proc','proc',str(proc))
 stack.callback(run,'umount',str(proc))
 for name in names:
 run('ip','netns','add',name);stack.callback(run,'ip','netns','delete',name,check=False)
 ip(name,'link','set','lo','up')
 def setting(name,key,value):
 assert name in names
 path=proc/'sys'/key.replace('.','/')
 return ns(name,'python3','-c',f'from pathlib import Path; p=Path({str(path)!r}); p.write_text({str(value)!r}); print(p.read_text().strip())').stdout.strip()
 yield root,stack,setting
def wire(left,left_if,right,right_if,left_addresses,right_addresses):
 run('ip','link','add',left_if,'type','veth','peer','name',right_if)
 for name,interface,addresses in [(left,left_if,left_addresses),(right,right_if,right_addresses)]:
 run('ip','link','set',interface,'netns',name)
 for address in addresses:ip(name,'address','add',address,'dev',interface,*(['nodad'] if ':' in address else []))
 ip(name,'link','set',interface,'up')
def nft(name,script):return ns(name,'nft','-f','-',input=script)
def counters(name):
 data=json.loads(ns(name,'nft','-j','list','ruleset').stdout);found={}
 for entry in data['nftables']:
 rule=entry.get('rule',{})
 if 'comment' in rule:
 for expression in rule['expr']:
 if 'counter' in expression:found[rule['comment']]=expression['counter']['packets']
 return found

def server(stack,name,address,port=18080,label='server'):
 code=r'''
from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer
import json,socket,sys
address,port,label=sys.argv[1],int(sys.argv[2]),sys.argv[3]
class Handler(BaseHTTPRequestHandler):
 def do_GET(self):
 body=json.dumps({'server':label,'peer':self.client_address,'path':self.path}).encode()
 self.send_response(200);self.send_header('Content-Length',str(len(body)));self.end_headers();self.wfile.write(body)
 def log_message(self,*args):pass
class Server(ThreadingHTTPServer):
 address_family=socket.AF_INET6 if ':' in address else socket.AF_INET
 def server_bind(self):
 if self.address_family==socket.AF_INET6:self.socket.setsockopt(socket.IPPROTO_IPV6,socket.IPV6_V6ONLY,1)
 super().server_bind()
service=Server((address,port),Handler);print('ready',flush=True);service.serve_forever()
'''
 process=spawn(stack,['ip','netns','exec',name,'python3','-u','-c',code,address,str(port),label])
 assert line(process).strip()=='ready';return process
def request(name,address,port=18080):
 code=r'''
import http.client,json,sys
client=http.client.HTTPConnection(sys.argv[1],int(sys.argv[2]),timeout=.7)
try:
 client.request('GET','/lab-visible-message');response=client.getresponse();body=json.loads(response.read())
 assert response.status==200;print(json.dumps({'ok':True,'status':response.status,'body':body}))
except OSError as error:print(json.dumps({'ok':False,'type':type(error).__name__,'errno':error.errno}))
finally:client.close()
'''
 return json.loads(ns(name,'python3','-c',code,address,str(port)).stdout)

def routed(setting):
 wire('client','c0','router','r0',['10.201.1.2/30'],['10.201.1.1/30'])
 wire('router','r1','target','t0',['10.201.2.1/30'],['10.201.2.2/30'])
 setting('router','net.ipv4.ip_forward',1)
 ip('client','route','add','default','via','10.201.1.1')
 ip('target','route','add','default','via','10.201.2.1')
with lab(['client','router','target']) as (root,stack,setting):
 routed(setting);ip('client','route','delete','default')
 ip('target','addr','add','198.51.100.9/32','dev','lo');ip('router','route','add','198.51.100.9/32','via','10.201.2.2')
 daemon=server(stack,'target','198.51.100.9')
 connected=ns('client','ping','-n','-c','1','-W','1','10.201.1.1');assert connected.returncode==0
 missing=request('client','198.51.100.9');assert not missing['ok'] and missing['errno']==101
 ip('client','route','add','default','via','10.201.1.1')
 chosen=json.loads(ip('client','-j','route','get','198.51.100.9').stdout)[0];assert chosen['gateway']=='10.201.1.1'
 healthy=request('client','198.51.100.9');assert healthy['ok']
 ip('client','route','add','unreachable','198.51.100.9/32')
 specific=request('client','198.51.100.9');assert not specific['ok'] and specific['errno']==113
 ip('client','route','delete','unreachable','198.51.100.9/32')
 recovered=request('client','198.51.100.9');assert recovered['ok']
 ip('target','route','delete','default')
 bad_return=request('client','198.51.100.9');assert not bad_return['ok'] and bad_return['type']=='TimeoutError'
 assert json.loads(ip('client','-j','route','get','198.51.100.9').stdout)[0]['gateway']=='10.201.1.1'
 ip('target','route','add','default','via','10.201.2.1')
 final=request('client','198.51.100.9');assert final['ok']
 print(json.dumps({'connected_ping_without_default':0,'no_default':missing,'chosen_route':chosen,'with_default':healthy,
 'specific_unreachable_route':specific,'specific_removed':recovered,'missing_return_route':bad_return,'return_route_restored':final}))
"""
name='xbcatm-netpath-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN','--cap-add','SYS_ADMIN',
 '--memory','256m','--pids-limit','128',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The client uses 10.201.1.2, with router neighbor 10.201.1.1. The target sits behind the router on another link and owns service address 198.51.100.9 on loopback. The router has a specific route to that service, and the target initially has a return default. The documentation address is used only within this isolated topology; no public server is contacted.

With the client’s default removed, pinging its directly connected router succeeds. An HTTP connection to the remote service fails with Linux ENETUNREACH, errno 101. Adding a default through 10.201.1.1 changes the route lookup to that gateway, and an actual HTTP request returns status 200. This demonstrates both the narrower connectivity that already existed and the additional path enabled by the default.

An unreachable /32 route is then installed for 198.51.100.9. The same connection now fails with EHOSTUNREACH, errno 113, despite the default still being present. Removing that specific route restores HTTP success. The kernel honored the more specific rejection; it did not treat the error as an invitation to fall back to the default gateway.

Next, the script removes only the target’s default route. The client’s lookup still names 10.201.1.1, but a new HTTP attempt reaches its timeout. Restoring the target’s default restores communication. This controlled comparison isolates the return-path dependency while leaving the client’s choice unchanged, providing stronger evidence than a one-sided route listing or an unexplained failed ping.

Inspect the exact flow before editing defaults

Record source address, destination, relevant policy rules, chosen interface, and gateway. A machine with several interfaces or routing tables can make different decisions for different sources, marks, or routing domains. Run diagnostic lookups with the application’s relevant inputs. The fixture uses ordinary destination-based routing and does not claim to reproduce every policy-routing or multipath configuration.

Check the next hop’s link reachability, the router’s forwarding decision, and the target’s route back to the actual source. NAT or a proxy may change which source the target sees. Error classes can guide this work: immediate local network-unreachable errors differ from an explicitly unreachable host route and from a deadline expiring while a reply cannot return. Keep those distinctions in incident evidence.

Defaults are useful because they summarize destinations whose individual routes the host need not know. Configure them deliberately, verify exceptions, and test representative round trips after changes. If automatic failover is required, use a mechanism that observes the relevant path and updates routing appropriately. A second configured gateway or a preferred metric alone does not establish that behavior.

Sources

Linux ip-route(8), default routes, route lookup and unreachable route types, checked 2026-09-12.
RFC 4632 CIDR, longest-prefix matching and route specificity, checked 2026-09-12.
RFC 1812 IPv4 router requirements, IPv4 forwarding and destination reachability, checked 2026-09-12.

A subnet prefix shapes connected routes; the routing table chooses the path

Mon, 13 Sep 2027 00:00:00 +0000

An IPv4 prefix length says how many leading address bits identify a network. For 192.0.2.5/24, the network is 192.0.2.0/24 and the ordinary broadcast address is 192.0.2.255. Configuring that interface commonly installs a connected route, but the prefix is not the entire routing algorithm. The kernel consults routing policy and route tables to select a path for each destination.

When it breaks

A prefix that is too short can make the host treat remote destinations as directly connected. Keeping address 192.0.2.5 but changing /24 to /16 includes 192.0.3.9 in the connected range. On a real Ethernet segment, that mistaken choice may lead to neighbor resolution for a destination that is not present on the link. An address that looks correct can therefore coexist with a broken next-hop decision.

“Outside my subnet means use the default gateway” is also incomplete. A more specific route can select a different gateway or interface. Within a selected routing table, a longer matching prefix takes precedence over a shorter one. An explicit host route can even override the ordinary connected route for a destination inside the interface’s subnet. Diagnose the actual lookup rather than reconstructing it from the address alone.

Address-count shortcuts need context. An ordinary /24 has network and directed-broadcast addresses that are not usual host assignments, but subtracting two is not universal. RFC 3021 permits both addresses of a /31 point-to-point link as endpoints. A /32 identifies one address. Those cases describe address semantics, not proof that two configured endpoints can exchange packets through the current physical topology.

Check it quickly

Save this as check-subnet.py and run python3 check-subnet.py with Docker. It builds the pinned Python image with iproute2 6.1.0, then grants NET_ADMIN only to a disposable container with no external network attachment. The program creates a dummy interface and changes that container’s routes. It does not alter host interfaces, routes, or a production gateway:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid

recipe='''FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84
RUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 && rm -rf /var/lib/apt/lists/*
'''
program=r'''
from ipaddress import IPv4Address,IPv4Interface,IPv4Network
import json,subprocess
def ip(*args):
 result=subprocess.run(['ip',*args],capture_output=True,text=True,timeout=3)
 assert result.returncode==0,result.stderr
 return result.stdout
def route(address):return json.loads(ip('-j','route','get',address))[0]
interface=IPv4Interface('192.0.2.5/24');network=interface.network
assert str(network.network_address)=='192.0.2.0' and str(network.broadcast_address)=='192.0.2.255'
assert IPv4Address('192.0.2.77') in network and IPv4Address('192.0.3.9') not in network
try:IPv4Network('192.0.2.5/24');raise AssertionError('host bits accepted in strict network')
except ValueError:strict_rejected=True
point_to_point=[str(a) for a in IPv4Network('192.0.2.0/31').hosts()]
assert point_to_point==['192.0.2.0','192.0.2.1']
ip('link','add','lab0','type','dummy');ip('link','set','lab0','up')
ip('address','add','192.0.2.5/24','dev','lab0');ip('route','add','default','via','192.0.2.1','dev','lab0')
ip('route','add','203.0.113.0/24','via','192.0.2.2','dev','lab0')
direct=route('192.0.2.77');specific=route('203.0.113.9');default=route('198.51.100.9');before=route('192.0.3.9')
assert direct['dev']=='lab0' and 'gateway' not in direct
assert specific['gateway']=='192.0.2.2' and default['gateway']==before['gateway']=='192.0.2.1'
ip('route','add','192.0.2.77/32','via','192.0.2.1','dev','lab0');overridden=route('192.0.2.77')
assert overridden['gateway']=='192.0.2.1'
ip('address','del','192.0.2.5/24','dev','lab0');ip('address','add','192.0.2.5/16','dev','lab0')
ip('route','replace','default','via','192.0.2.1','dev','lab0');wrong=route('192.0.3.9')
assert wrong['dev']=='lab0' and 'gateway' not in wrong
print(json.dumps({'interface':str(interface),'network':str(network),'broadcast':str(network.broadcast_address),
 'strict_host_bits_rejected':strict_rejected,'point_to_point_31_hosts':point_to_point,
 'connected':direct,'more_specific_route':specific,'default':default,'host_route_overrides_subnet':overridden,
 'destination_before_widening':before,'destination_after_wrong_16':wrong,'iproute_version':ip('-V').strip()}))
'''
name='xbcatm-subnet-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN',
 '--memory','128m','--pids-limit','64',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

Python distinguishes the interface 192.0.2.5/24 from its network 192.0.2.0/24. Strict network parsing rejects the former because host bits are set. The /31 example enumerates both 192.0.2.0 and 192.0.2.1 as usable endpoints. This calculation establishes the address set; the fixture does not configure a working point-to-point link or test forwarding between those two addresses.

The dummy interface receives 192.0.2.5/24 and a default route through 192.0.2.1. A specific route for 203.0.113.0/24 uses 192.0.2.2. Actual ip route get results choose no gateway for 192.0.2.77, gateway 192.0.2.2 for 203.0.113.9, and the default gateway for 198.51.100.9. The output also records the selected interface and preferred source address.

Adding a /32 route for 192.0.2.77 through 192.0.2.1 changes that destination’s lookup to the gateway, despite its membership in the connected /24. This deliberate override demonstrates why subnet membership and final route selection must be kept separate. The selected table has a more specific instruction for that one destination; there is no requirement to rewrite the interface address to express it.

Before widening the interface prefix, 192.0.3.9 uses the default gateway. After replacing /24 with /16 while keeping 192.0.2.5, the lookup selects the dummy interface directly and no longer includes a gateway. The test asserts this change in the real kernel’s decision. It does not claim successful delivery, an observed ARP failure, or a functioning router beyond the dummy interface.

Check the route before changing the mask

Inspect the effective address and prefix, relevant policy rules, and a route lookup for the exact failing destination. On multihomed systems, include the intended source and other policy inputs when reproducing the lookup. A simple destination-only check can differ from the application’s path when source routing, marks, or separate routing domains are in use. Keep the diagnostic context with the result.

On Ethernet, distinguish resolving the destination’s link address from resolving the selected gateway’s link address. A gateway must be reachable according to the configured link and routing rules; a plausible number in a route file is insufficient. Compare actual neighbor state and packet delivery after confirming the route, rather than treating a displayed next hop as proof that forwarding works.

Plan prefix changes with the connected routes and affected destinations they create or remove. Validate representative local, specifically routed, and default-routed traffic after the change. A mask is an input to routing and address interpretation, not an independent reachability promise. This distinction explains both accidental on-link expansion and legitimate exceptions created by more specific routes.

Sources

RFC 4632 CIDR, classless prefixes and longest-match forwarding, checked 2026-09-12.
RFC 3021 point-to-point /31 links, the two usable endpoint addresses of a /31 link, checked 2026-09-12.
Linux ip-route(8), route lookup, next hops and explicit host routes, checked 2026-09-12.
Python 3.11 ipaddress, interface, network and host-address distinctions, checked 2026-09-12.

BGP is the Internet routing table

Sun, 12 Sep 2027 00:00:00 +0000

BGP is the only protocol that stitches tens of thousands of independently operated networks into one forwarding table. It carries reachability, but what it really carries is policy: each network says which prefixes it originates, which neighbours it learned them from, and — through filters — which ones it is willing to pass on.

The tension is that this table is built on trust between parties who have no contract with each other. Nothing validates an announcement before it propagates, so a typo or a misconfigured filter is global within minutes and stays that way until a human notices.

The AS path is a loop check and a policy signal at once

On egress an eBGP speaker prepends its own AS number, and a receiver drops any update whose AS_PATH already contains its own AS. That is the entire loop-prevention mechanism, and it is why a route cannot be re-imported around a circle. iBGP does not prepend, which is why an iBGP-learned route carries the same AS_PATH as the eBGP route that brought it into the AS, and why an AS needs a full iBGP mesh or route reflectors to distribute it.

The same field does two more jobs. Operators filter on it — reject anything containing a peer’s AS, accept only routes whose path ends in a customer’s AS — and path selection compares its length. One field, three responsibilities, and they conflict: prepending to make a path less attractive also makes it look like a route your filters should reject.

Why the table is about a million prefixes

The real numbers, from the CIDR Report snapshot taken for this article: 1,080,189 IPv4 prefixes, or 597,258 if you collapse everything that can be aggregated. Amazon alone originates 18,025 prefixes, of which 15,759 are more-specifics of larger blocks. Roughly half the table is more-specifics of address space that is already announced.

That is a policy artifact, not a topology artifact. Multihoming creates a more-specific per provider, traffic engineering creates them per path, and a customer who wants their own routing decisions creates one more. Aggregation would halve the table, and nobody does it, because every one of those more-specifics is doing a job.

Path selection is a fixed order, not a distance

BGP picks a path by walking a list and stopping at the first step that breaks the tie: highest weight, then highest local preference, then locally originated, then shortest AS path, then lowest origin type, then lowest MED, then eBGP over iBGP, then lowest IGP cost to the next hop, then lowest router ID. Weight and local preference are local to one router or one AS and never travel in an update.

Running that over four candidate paths for one prefix: the decision lands on weight, because a weight of 100 beats 0 before anything else is read. Remove the weights and the decision moves to local preference. Remove local preference as well and it moves to AS-path length, where a two-AS path beats a three-AS path. The shortest path is step four of nine, which is why “BGP picks the shortest route” is not a useful statement.

When it breaks

The classic incident shape is a leaked more-specific that hijacks traffic. An unrelated AS originates 198.51.100.128/25 inside someone else’s 198.51.100.0/24, and longest-prefix-match hands it exactly half the victim’s address space — 128 of 256 addresses — with no withdrawal, no error, and the legitimate /24 still sitting in every table. It presents as partial unreachability and traffic appearing somewhere unexpected, and it is the shape documented in RFC 7908. RPKI origin validation is the mitigation, but it only answers whether an AS is allowed to originate a prefix; a ROA’s maxLength must cover the more-specific, and a forged AS path with a valid origin still validates.

The second failure is the table outgrowing the hardware. A device with 1,000,000 IPv4 FIB entries is already 80,189 prefixes short of today’s table; at 1,200,000 it fits. When a FIB fills, the router keeps the sessions up and stops installing routes — some prefixes move to software forwarding, others are dropped, and the blast radius is that unrelated destinations stop working while BGP looks perfectly healthy.

Check it quickly

Confirm what your router actually believes about a prefix:

show bgp ipv4 unicast summary
show bgp ipv4 unicast 198.51.100.0/24
show bgp ipv4 unicast 198.51.100.0/24 longer-prefixes
show ip route 198.51.100.200

The first prints the total prefix count, which is how you notice a peer dumping routes at you. The second and third together show whether a more-specific exists and who originates it — a /25 you do not recognise is the whole incident. The fourth is the verdict the forwarding engine reached, and if it disagrees with what you expected from the first three, the hijack is already live.

Sources

RFC 4271 BGP-4, the decision process and AS path loop detection, checked 2026-09-16.
RFC 6811 prefix origin validation, what RPKI validation does and does not prove, checked 2026-09-16.
RFC 7908 route leaks, the problem statement for leaked announcements, checked 2026-09-16.
CIDR Report, current IPv4 table size and per-AS more-specific counts, checked 2026-09-16.

The TCP handshake establishes sequence spaces, not synchronized clocks

Fri, 10 Sep 2027 00:00:00 +0000

The TCP three-way handshake establishes the two directions of a byte stream. Each endpoint supplies an initial sequence number and acknowledges the other endpoint’s number. Those are independent sequence spaces, not a shared wall clock. Applications do not need synchronized machine clocks to connect. Later sequence numbers identify bytes and support ordering, duplicate handling, acknowledgments, and retransmission within that connection.

When it breaks

A client sends SYN with its initial sequence number. The server returns SYN-ACK containing its own initial number and acknowledging the client’s SYN. The client acknowledges that response. SYN consumes one position in sequence space, so its acknowledgment advances by one even when the segment contains no application data. Treating these values as timestamps produces incorrect packet interpretations and can send an investigation toward unrelated clock synchronization.

The two endpoints do not change state at exactly the same instant. A client’s connect call can succeed after receiving SYN-ACK while its final acknowledgment is lost before reaching the server. The server can remain in SYN-RECEIVED, displayed as SYN-RECV by Linux tools. Subsequent data carrying an appropriate acknowledgment can also complete the exchange, so a missing standalone third packet does not inevitably cause permanent failure.

Successful TCP setup establishes neither application health nor peer authentication. A service might accept connections but never produce a valid response. A proxy may complete one TCP connection while failing to establish its separate upstream connection. Likewise, sequence-number selection helps protect connection incarnations and resist prediction attacks, but it is not an authentication protocol and does not encrypt the stream.

Check it quickly

Save this as check-tcp-handshake.py and run python3 check-tcp-handshake.py with Docker. The disposable container uses Python 3.11.16, iproute2 6.1.0, nftables 1.0.6, and tcpdump 4.99.3, tested with Linux 6.12.76. NET_ADMIN and SYS_ADMIN support its nested network namespaces. A newly created veth joins the client and target, with no host interfaces or published ports involved:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 iputils-ping=3:20221126-1+deb12u1 nftables=1.0.6-2+deb12u2 tcpdump=4.99.3-1 traceroute=1:2.1.2-1 procps=2:4.0.2-3 && rm -rf /var/lib/apt/lists/*\nCMD ["python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,select,signal,subprocess,time

def run(*args,check=True,input=None,timeout=8):
 result=subprocess.run(args,input=input,capture_output=True,text=True,timeout=timeout)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def ns(name,*args,**kwargs):return run('ip','netns','exec',name,*args,**kwargs)
def ip(name,*args,**kwargs):return ns(name,'ip',*args,**kwargs)
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=2)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=2)
def line(process,timeout=3):
 assert select.select([process.stdout],[],[],timeout)[0],'child response deadline exceeded'
 value=process.stdout.readline();assert value,('child exited without a response',process.stderr.read())
 return value
def spawn(stack,command):
 process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);return process
@contextmanager
def lab(names):
 with TemporaryDirectory(prefix='net-path-') as directory,ExitStack() as stack:
 root=Path(directory);proc=root/'proc';proc.mkdir();run('mount','-t','proc','proc',str(proc))
 stack.callback(run,'umount',str(proc))
 for name in names:
 run('ip','netns','add',name);stack.callback(run,'ip','netns','delete',name,check=False)
 ip(name,'link','set','lo','up')
 def setting(name,key,value):
 assert name in names
 path=proc/'sys'/key.replace('.','/')
 return ns(name,'python3','-c',f'from pathlib import Path; p=Path({str(path)!r}); p.write_text({str(value)!r}); print(p.read_text().strip())').stdout.strip()
 yield root,stack,setting
def wire(left,left_if,right,right_if,left_addresses,right_addresses):
 run('ip','link','add',left_if,'type','veth','peer','name',right_if)
 for name,interface,addresses in [(left,left_if,left_addresses),(right,right_if,right_addresses)]:
 run('ip','link','set',interface,'netns',name)
 for address in addresses:ip(name,'address','add',address,'dev',interface,*(['nodad'] if ':' in address else []))
 ip(name,'link','set',interface,'up')
def nft(name,script):return ns(name,'nft','-f','-',input=script)
def counters(name):
 data=json.loads(ns(name,'nft','-j','list','ruleset').stdout);found={}
 for entry in data['nftables']:
 rule=entry.get('rule',{})
 if 'comment' in rule:
 for expression in rule['expr']:
 if 'counter' in expression:found[rule['comment']]=expression['counter']['packets']
 return found


def capture(stack,root,name,interface,expression,label):
 path=root/(label+'.pcap')
 process=subprocess.Popen(['ip','netns','exec',name,'tcpdump','--immediate-mode','-Z','root','-U','-n','-i',interface,'-w',str(path),expression],
 stdout=subprocess.DEVNULL,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process)
 deadline=time.monotonic()+3
 while time.monotonic()<deadline:
 assert process.poll() is None,'tcpdump exited before listening'
 if select.select([process.stderr],[],[],.1)[0] and 'listening on' in process.stderr.readline():return process,path
 raise AssertionError('tcpdump did not become ready')
def packets(process,path):
 import struct,socket
 process.send_signal(signal.SIGINT);_,diagnostic=process.communicate(timeout=3)
 assert process.returncode==0,diagnostic
 raw=path.read_bytes();assert raw[:4]==bytes.fromhex('d4c3b2a1') and struct.unpack_from('<I',raw,20)[0]==1
 offset=24;result=[]
 while offset<len(raw):
 seconds,micros,size,original=struct.unpack_from('<IIII',raw,offset);offset+=16
 frame=raw[offset:offset+size];offset+=size
 if frame[12:14]!=b'\x08\x00' or frame[23]!=6:continue
 ihl=(frame[14]&15)*4;length=struct.unpack_from('!H',frame,16)[0];tcp=14+ihl
 sport,dport,seq,ack=struct.unpack_from('!HHII',frame,tcp);header=(frame[tcp+12]>>4)*4
 opts={};cursor=tcp+20
 while cursor<tcp+header:
 kind=frame[cursor]
 if kind==0:break
 if kind==1:cursor+=1;continue
 option_length=frame[cursor+1];data=frame[cursor+2:cursor+option_length];assert option_length>=2
 if kind==2:opts['mss']=struct.unpack('!H',data)[0]
 elif kind==3:opts['wscale']=data[0]
 elif kind==4:opts['sack_ok']=True
 elif kind==5:opts['sack']=[list(pair) for pair in struct.iter_unpack('!II',data)]
 cursor+=option_length
 body=frame[tcp+header:14+length]
 result.append({'t':seconds+micros/1e6,'src':socket.inet_ntoa(frame[26:30]),'dst':socket.inet_ntoa(frame[30:34]),
 'sport':sport,'dport':dport,'seq':seq,'ack':ack,'flags':frame[tcp+13],'window':struct.unpack_from('!H',frame,tcp+14)[0],
 'length':len(body),'options':opts,'preview':body[:24].hex()})
 return result
with lab(['client','target']) as (root,stack,setting):
 wire('client','c0','target','t0',['192.0.2.1/30'],['192.0.2.2/30'])
 server_code=r'''
import socketserver
class Handler(socketserver.StreamRequestHandler):
 def handle(self):
 data=self.rfile.readline();self.wfile.write(b'echo:'+data);self.wfile.flush()
class Server(socketserver.ThreadingTCPServer):allow_reuse_address=True;daemon_threads=True
server=Server(('192.0.2.2',18080),Handler);print('ready',flush=True);server.serve_forever()
'''
 service=spawn(stack,['ip','netns','exec','target','python3','-u','-c',server_code]);assert line(service).strip()=='ready'
 tap,path=capture(stack,root,'client','c0','tcp port 18080','handshake')
 normal=ns('client','python3','-c',
 'import socket; s=socket.socket();s.settimeout(2);s.bind(("192.0.2.1",40100));s.connect(("192.0.2.2",18080));s.sendall(b"normal\\n");print(s.makefile("rb").readline().decode().strip());s.close()')
 assert normal.stdout.strip()=='echo:normal'
 nft('client','''table ip missing_ack {
 chain output { type filter hook output priority 0; policy accept;
 tcp dport 18080 tcp flags & (syn|ack|rst|fin) == ack counter drop comment "missing_final_ack"
 }
}
''')
 client_code=r'''
import json,socket,sys
s=socket.socket();s.settimeout(.25);s.bind(('192.0.2.1',40101));s.connect(('192.0.2.2',18080))
print(json.dumps({'connect_returned':True}),flush=True);s.sendall(b'deferred\n')
try:s.recv(64);raise AssertionError('unexpected application response')
except TimeoutError:print(json.dumps({'application_timeout':True}),flush=True)
assert sys.stdin.readline().strip()=='restore';s.settimeout(5)
received=b''
while not received.endswith(b'\n'):
 chunk=s.recv(64);assert chunk,'premature EOF';received+=chunk
assert received==b'echo:deferred\n',received
print(json.dumps({'recovered':received.decode().strip()}),flush=True);s.close()
'''
 client=spawn(stack,['ip','netns','exec','client','python3','-u','-c',client_code])
 connected=json.loads(line(client));failure=json.loads(line(client));assert connected['connect_returned'] and failure['application_timeout']
 pending=ns('target','ss','-nHt','state','syn-recv').stdout;assert '192.0.2.1:40101' in pending,pending
 blocked=counters('client');assert blocked['missing_final_ack']>0
 nft('client','delete table ip missing_ack');client.stdin.write('restore\n');client.stdin.flush()
 recovery=json.loads(line(client,6));assert recovery['recovered']=='echo:deferred'
 client.wait(timeout=2);assert client.returncode==0
 observed=packets(tap,path);flow=[p for p in observed if 40100 in (p['sport'],p['dport'])]
 syn=next(p for p in flow if p['flags']&0x12==0x02)
 synack=next(p for p in flow if p['flags']&0x12==0x12)
 third=next(p for p in flow if p['sport']==40100 and p['flags']&0x12==0x10)
 assert synack['ack']==(syn['seq']+1)%2**32
 assert third['seq']==(syn['seq']+1)%2**32 and third['ack']==(synack['seq']+1)%2**32
 print(json.dumps({'three_messages':[syn,synack,third],'normal_reply':normal.stdout.strip(),
 'client_connect_returned':connected['connect_returned'],'application_timeout':failure['application_timeout'],
 'server_still_syn_recv':pending.strip(),'drop_counters':blocked,'after_ack_filter_removed':recovery}))
"""
name='xbcatm-tcpflow-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN','--cap-add','SYS_ADMIN',
 '--memory','256m','--pids-limit','128',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The first connection uses client port 40100 and target port 18080. It sends a newline-terminated request and receives the expected echo. A packet capture supplies the actual SYN, SYN-ACK, and final ACK values. Assertions check that SYN-ACK acknowledges the client’s sequence plus one and that the third message acknowledges the server’s sequence plus one, using modulo arithmetic for the 32-bit sequence space.

The second connection uses client port 40101. An output filter in the client namespace drops ACK-bearing packets without SYN, FIN, or RST, including the final acknowledgment and subsequent data. Blocking that data matters: otherwise a later data segment could acknowledge the SYN-ACK and repair the intentionally missing third message. The example therefore makes the intended asymmetric state observable instead of relying on a narrow timing accident.

The client reports that connect returned successfully, but its application read reaches a deadline. At the same point, the server’s socket listing shows that exact client tuple in SYN-RECV. A rule counter confirms dropped packets. These independent observations establish the distinction between the client’s local API result, the server’s protocol state, and the failed application exchange.

Removing the filter lets the same connection finish the exchange and deliver the queued request. The client receives echo:deferred; it does not create a replacement socket to hide the original failure. Framed reads accumulate the response rather than assuming one recv call always returns the entire application message. The test verifies both the temporary failure and recovery after its controlled cause is removed.

Diagnose setup separately from useful service

Record the four-tuple, namespace, capture point, and state on each endpoint. A reset, repeated SYN, repeated SYN-ACK, and a completed handshake followed by an application timeout suggest different next checks. Capture both directions when possible: an outgoing acknowledgment visible locally is not proof that the remote endpoint received it. The fixture’s counter and remote socket state supply that missing context.

For service validation, follow the transport connection with a meaningful request and inspect its response. For identity and confidentiality, use the appropriate authenticated protocol above TCP. This exercise covers an ordinary connection without Fast Open or simultaneous open, and does not claim every valid connection begins with exactly three separately visible packets. Its central check is the sequence and state relationship, not a simplistic packet-count rule.

Sources

RFC 9293 TCP, sequence numbers, connection states and the three-way handshake, checked 2026-09-12.
Linux tcp(7), TCP socket behavior and Linux-specific controls, checked 2026-09-12.
Linux ss(8), examining established and SYN-RECV sockets, checked 2026-09-12.

DHCP lends the address until it expires

Tue, 07 Sep 2027 00:00:00 +0000

DHCP hands out leases with a duration, not perpetual ownership. The lifetime drives renewal and lets the server reclaim addresses the device no longer uses.

Borrow a number, not own it

DHCP does not give a device a permanent address; it lends one for a bounded time. On joining, a client broadcasts to discover a server, and the server offers an address with a lease lifetime defined by the network’s configured lease time. Because the assignment is temporary, the server always knows which addresses are valid and can track them in a pool without guessing. That temporary nature is what makes a large, frequently-changing network manageable: addresses are currency the server can hand out, extend, and take back, rather than addresses a host keeps forever.

Renewal keeps the lease alive

Before the lease expires, the client asks to renew it — first at roughly half the lease interval, again if needed — so a healthy device keeps the same address indefinitely without human intervention. This half-life renewal keeps the address stable across reboots and sessions, which matters for things like voice and some VPN clients that would be disrupted by an address change. The configured lease time is a governance knob: a shorter lease recycles addresses faster but forces more renewal traffic; a longer one keeps addresses stable longer but ties up numbers on devices that left long ago.

Reclaim what is not used

When a lease expires without renewal, the server reclaims the address and can hand it to another host. That is how a laptop that left the building days ago stops holding an address a new device needs. A client that abandoned a lease gets a new address on its next join — fine for transient use, hostile to services that expect a fixed identity. Tuning the lease balances churn against availability: short leases for a crowded or transient network, long ones for a stable internal pool where identifiers matter.

When it breaks

Exhaustion looks like silence. With no free address, a new DISCOVER gets no OFFER or its REQUEST draws a NAK, and the laptop falls back to a 169.254.x.x link-local address. Fix capacity, not retries: enlarge the pool, shorten leases on transient networks, and clear bindings flagged as abandoned after conflicts.

The opposite error is a lease so short it becomes a storm. A five-minute lease in a large office drives half the fleet through T1 renewal every few minutes, with stragglers rebroadcasting at T2, so any server restart meets a synchronized flood. Keep the RFC 2131 defaults of T1 at half and T2 at seven-eighths, lengthen the lease first, and stagger booting clients.

A rogue server wins by answering first. A stray router or malicious host offers a plausible address with the wrong gateway or DNS and steers traffic through itself. Symptoms wander: some leases work, resolution looks strange, and the victims change with each race. Pin the legitimate server identifier, enable DHCP snooping so only trusted ports may answer, and remove the intruder.

Clock skew breaks the quiet contract. Lifetimes travel as relative seconds, but absolute expiry timestamps or a laptop asleep past T1 and T2 can expire early or hold too long. The sleeper wakes still configured with an address the server already gave to someone else. Treat long sleep as a rebind, watch NTP alongside DHCP logs, and keep conflict detection with DECLINE and RELEASE handling.

Check it quickly

Save the following as dhcp_lease_sim.py and run python3 dhcp_lease_sim.py. It uses only the standard library and a virtual clock with no network, and models DISCOVER, OFFER, REQUEST, and ACK with T1 unicast renewal and T2 broadcast rebinding.

"""Simulate a DHCP lease lifecycle on a virtual clock (stdlib only)."""
from __future__ import annotations

LEASE_TIME = 100
T1 = LEASE_TIME // 2 # 50: unicast renewal (RFC 2131 default)
T2 = int(LEASE_TIME * 0.875) # 87: broadcast rebinding (RFC 2131 default)


class DHCPServer:
 def __init__(self, pool):
 self.pool = list(pool)
 self.leases: dict[str, dict] = {} # ip -> {"client": id, "expiry": int}
 self.now = 0

 def _free_ip(self):
 for ip in self.pool:
 lease = self.leases.get(ip)
 if lease is None or lease["expiry"] <= self.now:
 return ip
 return None

 def discover_offer(self, client_id):
 """DISCOVER -> OFFER (no state change)."""
 ip = self._free_ip()
 assert ip is not None, f"t={self.now}: pool exhausted, no OFFER for {client_id}"
 return ip

 def request_ack(self, client_id, ip):
 """REQUEST -> ACK and bind the lease."""
 lease = self.leases.get(ip)
 assert lease is None or lease["expiry"] <= self.now or lease["client"] == client_id, \
 f"t={self.now}: {ip} held by another client"
 self.leases[ip] = {"client": client_id, "expiry": self.now + LEASE_TIME}
 return {"ip": ip, "lease_time": LEASE_TIME, "t1": T1, "t2": T2,
 "expiry": self.now + LEASE_TIME}

 def renew(self, client_id, ip, broadcast=False):
 """Renew at T1 (unicast) or T2 (broadcast). Returns True on ACK."""
 lease = self.leases.get(ip)
 if lease is None or lease["client"] != client_id or lease["expiry"] <= self.now:
 return False # expired: server already reclaimed
 lease["expiry"] = self.now + LEASE_TIME
 return True

 def tick(self, dt):
 self.now += dt
 # Reclaim expired leases so a new client can reuse them.
 for ip, lease in list(self.leases.items()):
 if lease["expiry"] <= self.now:
 del self.leases[ip]


def check(cond, msg):
 assert cond, msg


def main():
 server = DHCPServer(["192.168.1.10", "192.168.1.11"])
 # 1. DORA: client c1 joins.
 offered = server.discover_offer("c1")
 check(offered == "192.168.1.10", f"expected first free IP, got {offered}")
 ack = server.request_ack("c1", offered)
 check((ack["lease_time"], ack["t1"], ack["t2"]) == (100, 50, 87), f"bad timers: {ack}")
 check(ack["expiry"] == 100, f"expiry should be 0+100, got {ack['expiry']}")
 print(f"t={server.now}: c1 ACK {ack['ip']} lease=100 T1=50 T2=87 expiry=100")
 # 2. T1 unicast renewal at half lease.
 server.tick(T1) # now=50
 check(server.renew("c1", offered), "T1 renewal should be ACKed")
 check(server.leases[offered]["expiry"] == 150, "T1 must extend expiry to 50+100")
 print(f"t={server.now}: c1 T1 unicast renew OK expiry=150")
 # 3. Miss T1, rebind at T2 via broadcast.
 server.tick(T2 - T1) # now=87; T1 of current lease would be 100
 server.tick(20) # now=107: past T1 (100), before T2 (137) and expiry (150)
 check(server.renew("c1", offered, broadcast=True), "T2 rebinding should be ACKed")
 check(server.leases[offered]["expiry"] == 207, "T2 must extend expiry to 107+100")
 print(f"t={server.now}: c1 T2 broadcast rebind OK expiry=207")
 # 4. Leave without renewing: expiry reclaims the address.
 server.tick(200) # now=307 > expiry 207
 check(offered not in server.leases, "expired lease must be reclaimed")
 offered2 = server.discover_offer("c2")
 check(offered2 == offered, f"reclaimed {offered} should be reused, got {offered2}")
 ack2 = server.request_ack("c2", offered2)
 check(ack2["expiry"] == server.now + LEASE_TIME, "new lease expiry must restart")
 # Stale renewal from the departed client must fail.
 check(not server.renew("c1", offered), "stale renewal after expiry must not be ACKed")
 print(f"t={server.now}: c1 expired, c2 ACK {ack2['ip']} expiry={ack2['expiry']}")
 print("PASS: discover/offer/request/ack, T1 renew, T2 rebind, expiry reclaim")


if __name__ == "__main__":
 main()

The script asserts the first free address is offered, the ACK carries a 100-second lease with T1 at 50 and T2 at 87, each renewal extends expiry by a full lease, and the departed address is reclaimed for a second client while the stale renewal fails. Expect four timestamped lines plus a PASS line covering offer, renewal, rebinding, and reclaim.

The assertions passed with Python 3.12 on macOS. The virtual clock proves the state machine, not a production daemon: still verify the real server’s lease time, pool size, authorized server list, and NTP health.

Sources

IETF: RFC 2131 DHCP, the authoritative lease lifecycle: DISCOVER, OFFER, REQUEST, ACK with T1 and T2 renewal timers, checked 2027-08-15.
ISC: ISC DHCP, pool management, lease database, and server operation notes, checked 2027-08-15.
Wikipedia: Dynamic Host Configuration Protocol, a readable overview of the lease lifecycle, checked 2027-08-15.

MSS clamping can repair one TCP path without repairing its MTU feedback

Sun, 24 Jan 2027 00:00:00 +0000

TCP’s Maximum Segment Size option advertises the receiving endpoint’s maximum TCP data size under the option’s defined accounting rules. Each direction has its own advertisement; the two values need not match. A router can reduce those advertisements while forwarding SYN messages so later data segments fit a constrained path. That changes TCP behavior for the affected connections, not the underlying link MTU itself.

When it breaks

An intermediate bottleneck can be smaller than either endpoint interface. If classic path-MTU feedback is filtered, a connection may establish successfully and then stall on larger data. Reducing MSS can help that TCP flow avoid the oversized packets, but the missing feedback remains missing. Treating the workaround as a complete network repair leaves other protocols and traffic patterns exposed to the original limitation.

MSS is not the full IP packet size. For an IPv4 path MTU of 1280 with ordinary twenty-byte IPv4 and TCP base headers, an advertised MSS of 1240 follows the basic calculation. Actual IP or TCP options require additional allowance when forming data segments. Confusing the advertisement with a final wire-packet length can make a seemingly conservative value too large.

Direction and timing matter too. Editing only one SYN direction leaves the other endpoint’s advertisement unchanged. Updating a rule does not rewrite options already exchanged by existing connections. A clamp should reduce an excessive advertisement, not raise a peer’s already smaller limit. Scope such policy to the real bottleneck and relevant flow instead of treating one hard-coded value as suitable for every network.

Check it quickly

Save this as check-mss-clamp.py and run python3 check-mss-clamp.py with Docker. The disposable environment uses Python 3.11.16, iproute2 6.1.0, nftables 1.0.6, and tcpdump 4.99.3, tested on Linux 6.12.76. NET_ADMIN and SYS_ADMIN enable four nested namespaces. Endpoint links have MTU 1500; the link between two routers has MTU 1280:

from pathlib import Path
from tempfile import TemporaryDirectory
import subprocess,json,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 iputils-ping=3:20221126-1+deb12u1 nftables=1.0.6-2+deb12u2 tcpdump=4.99.3-1 traceroute=1:2.1.2-1 procps=2:4.0.2-3 && rm -rf /var/lib/apt/lists/*\nCMD ["python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,select,signal,subprocess,time
def run(*args,check=True,input=None,timeout=8):
 result=subprocess.run(args,input=input,capture_output=True,text=True,timeout=timeout)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def ns(name,*args,**kwargs):return run('ip','netns','exec',name,*args,**kwargs)
def ip(name,*args,**kwargs):return ns(name,'ip',*args,**kwargs)
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=2)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=2)
def spawn(stack,command):
 process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);return process
def line(process,timeout=3):
 assert select.select([process.stdout],[],[],timeout)[0],'child response deadline exceeded'
 value=process.stdout.readline();assert value,process.stderr.read();return value
@contextmanager
def lab():
 with TemporaryDirectory(prefix='mtu-path-') as directory,ExitStack() as stack:
 root=Path(directory);proc=root/'proc';proc.mkdir();run('mount','-t','proc','proc',str(proc));stack.callback(run,'umount',str(proc))
 for name in ['client','r1','r2','target']:
 run('ip','netns','add',name);stack.callback(run,'ip','netns','delete',name,check=False);ip(name,'link','set','lo','up')
 def setting(name,key,value):
 assert name in ['client','r1','r2','target']
 path=proc/'sys'/key.replace('.','/')
 ns(name,'python3','-c',f'from pathlib import Path; p=Path({str(path)!r});p.write_text({str(value)!r});assert p.read_text().strip()=={str(value)!r}')
 yield root,stack,setting
def topology(setting,ipv6=False):
 links=[('client','c0','r1','a0',1,2,1,1500),('r1','a1','r2','b0',2,1,2,1280),('r2','b1','target','t0',3,1,2,1500)]
 for left,left_if,right,right_if,network,left_host,right_host,mtu in links:
 run('ip','link','add',left_if,'type','veth','peer','name',right_if)
 for name,interface,host in [(left,left_if,left_host),(right,right_if,right_host)]:
 run('ip','link','set',interface,'netns',name);ip(name,'link','set',interface,'mtu',str(mtu))
 address=f'2001:db8:{network}::{host}/64' if ipv6 else f'10.210.{network}.{host}/30'
 ip(name,'addr','add',address,'dev',interface,*(['nodad'] if ipv6 else []));ip(name,'link','set',interface,'up')
 family='-6' if ipv6 else '-4'
 for name in ['r1','r2']:setting(name,'net.ipv6.conf.all.forwarding' if ipv6 else 'net.ipv4.ip_forward',1)
 routes=[('client','default','2001:db8:1::1' if ipv6 else '10.210.1.1'),('target','default','2001:db8:3::1' if ipv6 else '10.210.3.1'),
 ('r1','2001:db8:3::/64' if ipv6 else '10.210.3.0/30','2001:db8:2::2' if ipv6 else '10.210.2.2'),
 ('r2','2001:db8:1::/64' if ipv6 else '10.210.1.0/30','2001:db8:2::1' if ipv6 else '10.210.2.1')]
 for name,destination,gateway in routes:ip(name,family,'route','add',destination,'via',gateway)
 if ipv6:
 deadline=time.monotonic()+4
 while any('tentative' in ip(name,'-6','address','show').stdout for name in ['client','r1','r2','target']):
 assert time.monotonic()<deadline,'IPv6 link-local DAD did not finish';time.sleep(.02)
def nft(name,script):return ns(name,'nft','-f','-',input=script)
def counters(name):
 result={}
 for item in json.loads(ns(name,'nft','-j','list','ruleset').stdout)['nftables']:
 rule=item.get('rule',{})
 if 'comment' in rule:
 for expression in rule['expr']:
 if 'counter' in expression:result[rule['comment']]=expression['counter']['packets']
 return result
def capture(stack,root,name,interface,expression,label):
 path=root/(label+'.pcap')
 process=subprocess.Popen(['ip','netns','exec',name,'tcpdump','--immediate-mode','-Z','root','-U','-n','-i',interface,'-w',str(path),expression],stdout=subprocess.DEVNULL,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);deadline=time.monotonic()+3
 while time.monotonic()<deadline:
 assert process.poll() is None,'capture exited'
 if select.select([process.stderr],[],[],.1)[0] and 'listening on' in process.stderr.readline():return process,path
 raise AssertionError('capture did not become ready')
def captured(process,path):
 process.send_signal(signal.SIGINT);_,diagnostic=process.communicate(timeout=3);assert process.returncode==0,diagnostic
 return run('tcpdump','-nn','-vv','-r',str(path)).stdout


def server(stack):
 code=r'''
import socketserver,hashlib
class Handler(socketserver.StreamRequestHandler):
 def handle(self):
 self.request.settimeout(3)
 header=self.rfile.readline()
 if not header:return
 length=int(header);data=self.rfile.read(length)
 if len(data)!=length:return
 self.wfile.write(hashlib.sha256(data).hexdigest().encode()+b'\n');self.wfile.flush()
class Server(socketserver.ThreadingTCPServer):allow_reuse_address=True;daemon_threads=True
service=Server(('10.210.3.2',18080),Handler);print('ready',flush=True);service.serve_forever()
'''
 process=spawn(stack,['ip','netns','exec','target','python3','-u','-c',code]);assert line(process).strip()=='ready'
def transfer(size):
 code=r'''
import socket,json,hashlib,sys,struct
size=int(sys.argv[1]);stream=socket.socket();stream.settimeout(1.5);connected=False
try:
 stream.connect(('10.210.3.2',18080));connected=True
 stream.sendall(str(size).encode()+b'\n'+b'x'*size)
 with stream.makefile('rb') as incoming:reply=incoming.readline().decode().strip()
 assert reply==hashlib.sha256(b'x'*size).hexdigest()
 print(json.dumps({'ok':True,'connected':True,'bytes':size,'sha256':reply,'snd_mss':stream.getsockopt(socket.IPPROTO_TCP,socket.TCP_MAXSEG)}))
except OSError as error:
 stream.setsockopt(socket.SOL_SOCKET,socket.SO_LINGER,struct.pack('ii',1,0))
 print(json.dumps({'ok':False,'connected':connected,'type':type(error).__name__,'errno':error.errno}))
finally:stream.close()
'''
 return json.loads(ns('client','python3','-c',code,str(size)).stdout)
def hide_fragmentation_feedback():
 nft('r1','''table ip hidden_mtu {
 chain output { type filter hook output priority 0; policy accept;
 icmp type destination-unreachable icmp code frag-needed counter drop comment "fragmentation_feedback_dropped"
 }
}
''')
with lab() as (root,stack,setting):
 topology(setting);setting('client','net.ipv4.tcp_mtu_probing',0);server(stack);hide_fragmentation_feedback()
 failed=transfer(65536);assert failed['connected'] and not failed['ok'] and failed['type']=='TimeoutError'
 initial_counter=counters('r1')['fragmentation_feedback_dropped'];assert initial_counter>0
 nft('r1','''table ip clamp {
 chain forward { type filter hook forward priority 0; policy accept;
 tcp flags & syn == syn tcp option maxseg size > 1240 tcp option maxseg size set 1240 counter comment "mss_rewritten"
 }
}
''')
 tap,path=capture(stack,root,'client','c0','tcp port 18080','mss')
 recovered=transfer(65536);assert recovered['ok'] and recovered['snd_mss']<=1240,recovered
 trace=captured(tap,path);assert 'mss 1240' in trace,trace
 after_transfer=counters('r1');assert after_transfer['mss_rewritten']>=2 and after_transfer['fragmentation_feedback_dropped']==initial_counter,after_transfer
 large_ping=ns('client','ping','-n','-M','do','-s','1400','-c','1','-W','1','10.210.3.2',check=False)
 assert large_ping.returncode!=0 and counters('r1')['fragmentation_feedback_dropped']>initial_counter
 print(json.dumps({'before_clamp':failed,'after_clamp':recovered,'counters_after_tcp':after_transfer,
 'icmp_echo_still_fails':{'returncode':large_ping.returncode,'stdout':large_ping.stdout,'stderr':large_ping.stderr},'capture':trace}))
"""
name='xbcatm-mtupath-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN','--cap-add','SYS_ADMIN','--memory','256m','--pids-limit','128',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The first router suppresses outgoing ICMP fragmentation-needed messages. The client disables its separate TCP MTU probing feature, making this a controlled classic-discovery failure. A 65536-byte transfer establishes TCP and then reaches its application deadline. The router counter confirms feedback was suppressed. The failed socket is aborted so its remaining retransmissions cannot be mistaken for packets from the later comparison.

The script adds a forwarding rule matching SYN-bearing TCP packets whose advertised MSS exceeds 1240. It sets that option to 1240 and counts the changes. SYN-ACK also has SYN set, so the rule covers the corresponding return advertisement. The comparison uses a fresh connection because an already established stream would retain the options it received during its own setup.

The new 65536-byte transfer succeeds and verifies the returned SHA-256 digest. The capture shows the reduced MSS, and the rule counter records changes in both handshake directions. The effective sending MSS is 1228 in this run because the active TCP options consume additional space. The fragmentation-feedback drop counter does not increase during this successful transfer, showing that the previous feedback path was not needed to complete it.

An IPv4 echo probe with a 1400-byte payload and Don’t Fragment set still fails afterward. The suppressed-feedback counter increases again. This larger ICMP packet is outside the TCP MSS mechanism: reducing an option in a TCP handshake did not shrink it or repair the router’s feedback policy. The paired outcomes define the workaround’s actual scope through traffic, not just a rule listing.

Keep the workaround tied to observed packet constraints

The local capture contains offload representations that can be larger than the resulting TCP segments and can carry apparent partial checksums. Do not conclude from those records alone that MSS was ignored or that giant packets crossed the 1280-byte link. The option, socket diagnostic, counters, and verified application response provide complementary evidence at different processing stages.

Derive a suitable bound from the actual encapsulation and IP version. An IPv6 outer header or additional tunnel overhead changes the packet budget, and path changes can invalidate a previously adequate fixed value. The rule in this isolated topology uses a known bottleneck; it is not a discovery algorithm that learns every later route change automatically.

After applying a production policy, test both new connections and relevant non-TCP traffic. Preserve peer advertisements that are already smaller, and inspect both directions when transfers differ by upload versus download. Prefer correcting required feedback and path configuration where possible. MSS adjustment is useful when its constrained role is explicit and the intended TCP exchange is actually verified.

Sources

RFC 6691 TCP Options and MSS, MSS advertisement and accounting for actual header options, checked 2026-09-12.
nftables packet-header mangling, editing MSS on SYN and SYN-ACK and directional advertisements, checked 2026-09-12.
RFC 1191 Path MTU Discovery, the underlying IPv4 discovery problem that clamping does not repair, checked 2026-09-12.
Linux segmentation offloads, local offload representations versus final TCP segments, checked 2026-09-12.

Network · XB Field Notes

The TCP backlog holds connections that are still syncing

The backlog argument is the accept queue

With syncookies on, the SYN queue stops mattering

The accept queue is where the pressure lands

When it breaks

Check it quickly

Sources

Network namespaces isolate networking; their names do not own every process

When it breaks

Check it quickly

Keep naming, process ownership, and connectivity separate

Sources

AAAA records publish IPv6 addresses without proving reachability

When it breaks

Check it quickly

Check each advertised family through the service

Sources

TCP slow start grows with acknowledged data, not merely with elapsed time

When it breaks

Check it quickly

Interpret a growth trace in its workload context

Sources

The listen backlog holds connections waiting for accept

When it breaks

Check it quickly

Tune acceptance and waiting capacity together

Sources

IPv6 routers report oversized packets; sources decide how to fit the path

When it breaks

Check it quickly

Diagnose size and direction before recommending fragmentation

Sources

TCP keepalive probes idle connections

A transport probe, not an application heartbeat

Configure the socket you actually use

When it breaks

Check it quickly

Further reading

Sources

A default route matches broadly; it does not rescue every failed path

When it breaks

Check it quickly

Inspect the exact flow before editing defaults

Sources

A subnet prefix shapes connected routes; the routing table chooses the path

When it breaks

Check it quickly

Check the route before changing the mask

Sources

BGP is the Internet routing table

The AS path is a loop check and a policy signal at once

Why the table is about a million prefixes

Path selection is a fixed order, not a distance

When it breaks

Check it quickly

Sources

The TCP handshake establishes sequence spaces, not synchronized clocks

When it breaks

Check it quickly

Diagnose setup separately from useful service

Sources

DHCP lends the address until it expires

Borrow a number, not own it

Renewal keeps the lease alive

Reclaim what is not used

When it breaks

Check it quickly

Further reading

Sources

MSS clamping can repair one TCP path without repairing its MTU feedback

When it breaks

Check it quickly

Keep the workaround tied to observed packet constraints

Sources