Network · XB Field Notes

The SYN backlog holds incomplete handshakes

Fri, 24 Mar 2028 00:00:00 +0000

A listening TCP socket separates incomplete handshakes from established connections waiting for accept(). The real setting is tcp_max_syn_backlog; this article retains its historical URL spelling. It concerns remembered incomplete requests, whereas the listen() backlog concerns the accept queue. Diagnose which stage is under pressure before choosing a remedy.

SYN cookies provide a fallback when normal handshake state cannot be retained. They do not make servers immune to overload, guarantee delivery, or remove the need to understand the SYN queue. Packet loss, filtering, allocation failures and accept-side pressure can still prevent connections with cookies enabled.

The SYN queue holds incomplete handshakes; the accept queue holds established connections awaiting accept(). With listen backlog configured as 8192 and somaxconn as 4096, the accept-side cap is 4096. Buffering more waiting work does not itself increase processing rate. The source article remains held/pending. Whole article remains held/pending; this diagram does not endorse its disputed claims.

The backlog argument is the accept queue

Linux changed the listen() backlog meaning in 2.2. Its configured value is capped by somaxconn; with arguments 8192 and 4096 respectively, that cap is 4096. This is a configuration example, not a measurement of exact admission count. Read the actual listener and namespace rather than assuming defaults or inferring capacity from a short burst.

Kernel documentation describes tcp_max_syn_backlog as a per-listener limit on remembered requests in SYN_RECV. Its initial value depends on memory and kernel implementation. Old man-page memory thresholds should not be treated as the current host’s configuration. Neither queue length alone identifies the application’s processing rate.

SYN cookies remain a fallback

With kernel support, tcp_syncookies=1 enables the overflow fallback; value 2 is a testing mode that sends cookies unconditionally. The listen manual’s statement that cookies remove the logical bound describes stateless admission beyond remembered requests. It does not mean unlimited memory, CPU, bandwidth or established sockets. The kernel documentation still recommends considering SYN-backlog tuning for legitimate overload, alongside the application’s ability to drain work.

Do not promise that every cookie connection loses SACK and window scaling. The pinned Linux v6.12 implementation can encode these options in timestamp bits when timestamps are negotiated. Which options survive depends on implementation and negotiation. That qualified behavior does not turn an emergency mechanism into a capacity plan, and disabling cookies is not a general fix.

The accept queue is where the pressure lands

Accept-side pressure can coexist with SYN-side pressure. In Linux v6.12’s ordinary handshake path, failure to create a child socket can reach an overflow branch: with tcp_abort_on_overflow disabled, the server can retain the request rather than immediately reset it. A client may already consider the connection established while application traffic stalls. This is a possible state mismatch, not a guarantee that every connect() succeeds.

A larger queue absorbs a finite burst and may increase waiting time. It does not establish higher steady-state service capacity. Measure arrival rate, accept latency and application completion together; there is no measured 20,000-connections-per-second result in this article.

When it breaks

Rising overflow counters justify investigation, but do not uniquely blame a worker thread. Accept-loop scheduling, resource exhaustion, other listeners in the same network namespace and a burst between samples can change the interpretation. Historical nonzero totals are not evidence of a current incident.

SYN loss also occurs with cookies enabled. Client retry timing depends on kernel version, retry settings, socket behavior and application deadlines; 67 or 131 seconds is not a universal timeout contract. A successful TCP connection likewise does not prove that the application request completed.

Check it quickly

Use the following observation exercise only on an authorized Linux system with an existing listener on port 8443, in its network namespace. It requires ss, nstat and sysctl already installed. Do not start listeners, generate overload, change settings or elevate privileges for this exercise. These commands were not run in this review.

ss -lnt 'sport = :8443'
nstat -az TcpExtListenOverflows TcpExtListenDrops TcpExtTCPReqQFullDrop TcpExtTCPReqQFullDoCookies
sysctl net.core.somaxconn net.ipv4.tcp_max_syn_backlog net.ipv4.tcp_syncookies net.ipv4.tcp_abort_on_overflow

Take two snapshots around an already-approved ordinary workload. For a listening TCP socket, Recv-Q reports queued established connections and Send-Q the effective backlog limit. Empty output means no matching visible listener, not a zero-length queue. A changed sysctl does not retroactively prove how an existing listener was configured.

nstat -az shows absolute counters, including zeros, and may update its local history; compare deltas over the interval. The named counters separate useful overflow, request-drop and cookie-fallback signals, but they are namespace-wide and are not mutually exclusive per-listener verdicts. Record kernel version, listener context and request outcomes before proposing tuning. Missing tools, access or an isolated test environment leave the runtime conclusion unresolved.

Sources

Kernel ip-sysctl documentation, SYN request limits, cookie modes and overload guidance; earlier check retained 2026-09-16, checked 2026-10-19.
Linux listen(2), accept backlog semantics and the configured somaxconn cap; earlier check retained 2026-09-16, checked 2026-10-19.
Linux tcp(7), version-sensitive settings and retry behavior; earlier check retained 2026-09-16, checked 2026-10-19.
Linux v6.12 cookie implementation, timestamp encoding of SACK and window scaling, checked 2026-10-19.
Linux v6.12 handshake implementation, conditional listen_overflow behavior, checked 2026-10-19.
iproute2 nstat manual, absolute-counter and zero-value options, checked 2026-10-19.

Network namespaces isolate networking; their names do not own every process

Sat, 19 Feb 2028 00:00:00 +0000

A Linux network namespace separates networking resources such as interfaces, routes, neighbor tables, socket ports, and packet-filter rules. It shares the kernel with other namespaces; it is not a separate operating system. A process normally inherits its parent’s network namespace, and tools can execute a process in another one. The resulting isolation covers networking resources, not every aspect of process identity or filesystem access.

When it breaks

Running ip netns exec does not automatically provide the full isolation of a container. PID namespaces, user namespaces, and hostname isolation are separate mechanisms. An application may see different routes while still sharing ordinary files and a hostname with its parent environment. Treating one network namespace as a complete sandbox can therefore assign it guarantees that were never configured.

A new namespace also does not automatically receive useful external connectivity. Interfaces need deliberate placement and configuration, and local loopback may need to be brought up. Moving an interface changes which namespace manages it; the old context will no longer list that device as its own. A configuration command executed from the wrong namespace can report a missing interface even though the intended device still exists elsewhere.

Namespace names have their own lifecycle. ip netns conventionally exposes handles beneath /run/netns, commonly also reachable through /var/run/netns. Deleting a name removes that handle, but a process or another reference can keep the namespace alive. Cleanup that equates disappearance from the named list with termination of every service can leave networking resources and a running process behind.

Networking scopes differ while selected context stays shared. Name deletion can leave an owned process reference alive; current runtime remains held.

Check it quickly

These are historical article reports; no raw integration logs were recovered and no privileged operations were rerun.

Save as check-network-namespace.py and run python3 check-network-namespace.py only in an authorized disposable VM with Docker and enabled Python assertions. Pinned Python 3.11.16/iproute2 6.1.0 packages must remain available. NET_ADMIN and SYS_ADMIN are prerequisites, not guarantees against other security restrictions. Do not weaken host protections. A temporary proc mount supports namespace-local settings; host interfaces and published ports are untouched:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 iputils-ping=3:20221126-1+deb12u1 nftables=1.0.6-2+deb12u2 tcpdump=4.99.3-1 traceroute=1:2.1.2-1 procps=2:4.0.2-3 && rm -rf /var/lib/apt/lists/*\nCMD ["python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,select,signal,subprocess,time

def run(*args,check=True,input=None,timeout=8):
 result=subprocess.run(args,input=input,capture_output=True,text=True,timeout=timeout)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def ns(name,*args,**kwargs):return run('ip','netns','exec',name,*args,**kwargs)
def ip(name,*args,**kwargs):return ns(name,'ip',*args,**kwargs)
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=2)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=2)
def line(process,timeout=3):
 assert select.select([process.stdout],[],[],timeout)[0],'child response deadline exceeded'
 value=process.stdout.readline();assert value,'child exited without a response'
 return value
def spawn(stack,command):
 process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);return process
@contextmanager
def lab(names):
 with TemporaryDirectory(prefix='net-path-') as directory,ExitStack() as stack:
 root=Path(directory);proc=root/'proc';proc.mkdir();run('mount','-t','proc','proc',str(proc))
 stack.callback(run,'umount',str(proc))
 for name in names:
 run('ip','netns','add',name);stack.callback(run,'ip','netns','delete',name,check=False)
 ip(name,'link','set','lo','up')
 def setting(name,key,value):
 assert name in names
 path=proc/'sys'/key.replace('.','/')
 return ns(name,'python3','-c',f'from pathlib import Path; p=Path({str(path)!r}); p.write_text({str(value)!r}); print(p.read_text().strip())').stdout.strip()
 yield root,stack,setting
def wire(left,left_if,right,right_if,left_addresses,right_addresses):
 run('ip','link','add',left_if,'type','veth','peer','name',right_if)
 for name,interface,addresses in [(left,left_if,left_addresses),(right,right_if,right_addresses)]:
 run('ip','link','set',interface,'netns',name)
 for address in addresses:ip(name,'address','add',address,'dev',interface,*(['nodad'] if ':' in address else []))
 ip(name,'link','set',interface,'up')
def nft(name,script):return ns(name,'nft','-f','-',input=script)
def counters(name):
 data=json.loads(ns(name,'nft','-j','list','ruleset').stdout);found={}
 for entry in data['nftables']:
 rule=entry.get('rule',{})
 if 'comment' in rule:
 for expression in rule['expr']:
 if 'counter' in expression:found[rule['comment']]=expression['counter']['packets']
 return found

def server(stack,name,address,port=18080,label='server'):
 code=r'''
from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer
import json,socket,sys
address,port,label=sys.argv[1],int(sys.argv[2]),sys.argv[3]
class Handler(BaseHTTPRequestHandler):
 def do_GET(self):
 body=json.dumps({'server':label,'peer':self.client_address,'path':self.path}).encode()
 self.send_response(200);self.send_header('Content-Length',str(len(body)));self.end_headers();self.wfile.write(body)
 def log_message(self,*args):pass
class Server(ThreadingHTTPServer):
 address_family=socket.AF_INET6 if ':' in address else socket.AF_INET
 def server_bind(self):
 if self.address_family==socket.AF_INET6:self.socket.setsockopt(socket.IPPROTO_IPV6,socket.IPV6_V6ONLY,1)
 super().server_bind()
service=Server((address,port),Handler);print('ready',flush=True);service.serve_forever()
'''
 process=spawn(stack,['ip','netns','exec',name,'python3','-u','-c',code,address,str(port),label])
 assert line(process).strip()=='ready';return process
def request(name,address,port=18080):
 code=r'''
import http.client,json,sys
client=http.client.HTTPConnection(sys.argv[1],int(sys.argv[2]),timeout=.7)
try:
 client.request('GET','/lab-visible-message');response=client.getresponse();body=json.loads(response.read())
 assert response.status==200;print(json.dumps({'ok':True,'status':response.status,'body':body}))
except OSError as error:print(json.dumps({'ok':False,'type':type(error).__name__,'errno':error.errno}))
finally:client.close()
'''
 return json.loads(ns(name,'python3','-c',code,address,str(port)).stdout)

with lab(['blue','green']) as (root,stack,setting):
 probe='import json,os,socket;print(json.dumps({"net":os.readlink("/proc/self/ns/net"),"pid":os.readlink("/proc/self/ns/pid"),"hostname":socket.gethostname()}))'
 parent=json.loads(run('python3','-c',probe).stdout)
 views={name:json.loads(ns(name,'python3','-c',probe).stdout) for name in ['blue','green']}
 assert len({parent['net'],views['blue']['net'],views['green']['net']})==3
 assert all(v['pid']==parent['pid'] and v['hostname']==parent['hostname'] for v in views.values())
 for name in ['blue','green']:
 ip(name,'link','add','dummy0','type','dummy');ip(name,'addr','add','192.0.2.10/24','dev','dummy0');ip(name,'link','set','dummy0','up')
 ip('blue','route','add','203.0.113.0/24','dev','dummy0')
 assert json.loads(ip('blue','-j','route','show','203.0.113.0/24').stdout)
 assert not json.loads(ip('green','-j','route','show','203.0.113.0/24').stdout)
 setting('blue','net.ipv4.ip_forward',0);setting('green','net.ipv4.ip_forward',1)
 forwarding={name:ns(name,'sysctl','-n','net.ipv4.ip_forward').stdout.strip() for name in ['blue','green']};assert forwarding=={'blue':'0','green':'1'}
 marker=root/'shared.txt';marker.write_text('shared filesystem')
 assert ns('blue','cat',str(marker)).stdout==ns('green','cat',str(marker)).stdout=='shared filesystem'
 daemon=server(stack,'blue','192.0.2.10',label='blue')
 named=request('blue','192.0.2.10');assert named['ok'] and named['body']['server']=='blue'
 run('ip','netns','delete','blue');assert not Path('/run/netns/blue').exists()
 assert daemon.poll() is None and os.readlink(f'/proc/{daemon.pid}/ns/net')==views['blue']['net']
 by_pid=run('nsenter','-t',str(daemon.pid),'-n','python3','-c',
 'import http.client,json; c=http.client.HTTPConnection("192.0.2.10",18080,timeout=1);c.request("GET","/");r=c.getresponse();print(json.dumps({"status":r.status,"body":json.loads(r.read())}));c.close()')
 surviving=json.loads(by_pid.stdout);assert surviving['status']==200 and surviving['body']['server']=='blue'
 print(json.dumps({'parent':parent,'namespace_views':views,'blue_only_route':True,'forwarding':forwarding,
 'same_file_visible':True,'before_name_deleted':named,'name_deleted_process_alive':True,'after_name_deleted':surviving}))
"""
name='xbcatm-netpath-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN','--cap-add','SYS_ADMIN',
 '--memory','256m','--pids-limit','128',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The parent, blue, and green report three different network namespace identifiers. Their PID namespace identifiers and hostnames remain equal. A marker file created by the parent is also readable in both children. Those positive observations establish the intended scope: networking has changed, while these particular process and filesystem properties remain shared in the fixture.

Each child creates its own dummy0 with address 192.0.2.10/24. The identical names and addresses coexist because they belong to different networking contexts. Only blue receives a route for 203.0.113.0/24. Querying green’s routes confirms that it has no corresponding entry. The example verifies separate effective tables rather than merely printing the two namespace names.

The program explicitly sets IPv4 forwarding to zero in blue and one in green, then reads the values back through each namespace. This is a setting-isolation check, not a packet-forwarding demonstration. The local dummy interfaces have no physical peer. Configured addresses and routes can be inspected without implying that either namespace can reach an external service.

A real HTTP server starts in blue on 192.0.2.10. A normal named-namespace request receives status 200 and identity blue. The script then deletes the blue name and confirms its handle is absent, while the server process and its network namespace identifier remain. The process has not been killed by removing the naming reference.

Using that known server PID, nsenter executes another client in the surviving network namespace. It again receives status 200 and identity blue. This establishes continued application operation after name deletion, not just the presence of a proc entry. Cleanup attempts to stop its process and remove named resources; interruption can leave work unfinished.

Keep naming, process ownership, and connectivity separate

Record both a service’s process ownership and the networking context used for management. Namespace identifiers help compare currently live contexts; do not turn an ephemeral identifier into a permanent inventory identity. If a name disappears unexpectedly, inspect the relevant owned process before concluding that its networking state has vanished or creating a replacement with assumed empty state.

For ordinary configuration files, ip netns exec can create a mount namespace and bind namespace-specific files into their conventional locations. This supports arrangements such as per-namespace resolver configuration; it does not establish a private copy of every filesystem object. Document those additional choices when reproducing a client’s environment so that DNS settings and route isolation are not confused.

Build connectivity through explicit virtual links, routes, forwarding, and filtering as required. A network namespace supplies a boundary for those resources, while their configuration determines communication. During teardown, stop the processes and release references owned by the service before expecting the namespace to disappear completely. Name deletion is one management operation within that lifecycle, not a universal process-termination command.

Sources

Linux network_namespaces(7), network resources isolated by a namespace, checked 2026-09-12.
Linux ip-netns(8), named handles, execution and deletion while processes remain, checked 2026-09-12.
Linux ip-link(8), interface creation and namespace placement, checked 2026-09-12.

AAAA records publish IPv6 addresses without proving reachability

Thu, 30 Dec 2027 00:00:00 +0000

An AAAA resource record contains one 128-bit IPv6 address. An A record contains an IPv4 address. A name may have either type, both types, or several addresses within each type. These are separate RRsets, so A and AAAA can have different TTLs. Publishing AAAA makes an address discoverable through DNS; it does not create an interface, route, listener, or working application.

AAAA publishes IPv6 data independently of DNS query transport. The article fixture demonstrates local HTTP reachability separately; it proves neither public IPv6 connectivity nor hostname TLS.

When it breaks

A successful AAAA lookup can lead to a failed connection. The published address may be obsolete, the service may listen only on IPv4, or the path may lack usable IPv6 routing. Firewall rules and TLS configuration can also differ between families. An IPv4-only availability check can miss the problem while dual-stack users experience delays or failures through the advertised IPv6 path.

Happy Eyeballs reduces some dual-stack connection delays by coordinating address discovery and connection attempts. It is a client algorithm, not a DNS guarantee that every client implements. Fallback behavior, deadlines, and application protocols still matter. Publishing a broken AAAA is therefore not automatically harmless merely because a particular browser quickly succeeds through an A record during one test.

Missing AAAA also needs precise language. An authoritative A-only name can produce a successful DNS response with no AAAA data, commonly called NODATA. That differs from NXDOMAIN, which reports a nonexistent name. An A-only service is not categorically unreachable from every IPv6-only network: DNS64 can synthesize AAAA answers for use with NAT64 translation when that infrastructure and its requirements are present.

Check it quickly

Save the script as check-aaaa.py and run python3 check-aaaa.py with Docker available. The pinned environment uses BIND 9.18.49 and dnspython 2.3.0. Its isolated network contains working IPv6 loopback but no external route. The program starts a real HTTP listener on ::1 and performs both DNS queries and a separate IPv6 connection:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries
from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer
import http.client,socket,threading
records='dual 17 IN A 127.0.0.1\ndual 29 IN AAAA ::1\nv4-only 17 IN A 127.0.0.1\nbroken 29 IN AAAA 2001:db8::1234'
class Handler(BaseHTTPRequestHandler):
 def log_message(self,*args):pass
 def do_GET(self):
 body=b'IPv6 response';self.send_response(200);self.send_header('Content-Length',str(len(body)));self.end_headers();self.wfile.write(body)
class V6Server(ThreadingHTTPServer):address_family=socket.AF_INET6
with lab(records) as (_,update,cache,queries),V6Server(('::1',0),Handler) as server:
 thread=threading.Thread(target=server.serve_forever,daemon=True);thread.start()
 try:
 a=query('dual.lab.test.','A');aaaa=query('dual.lab.test.','AAAA')
 assert values(a)==['127.0.0.1'] and values(aaaa,'AAAA')==['::1']
 assert a.answer[0].ttl==17 and aaaa.answer[0].ttl==29
 address=values(aaaa,'AAAA')[0];assert len(socket.inet_pton(socket.AF_INET6,address))==16
 client=http.client.HTTPConnection(address,server.server_port,timeout=2)
 client.request('GET','/');reply=client.getresponse();body=reply.read();client.close()
 assert reply.status==200 and body==b'IPv6 response'
 only_a=query('v4-only.lab.test.');assert values(only_a)==['127.0.0.1']
 missing=query('v4-only.lab.test.','AAAA');assert missing.rcode()==0 and missing.answer==[]
 assert len(missing.authority)==1 and missing.authority[0].rdtype==dns.rdatatype.SOA
 broken=query('broken.lab.test.','AAAA');assert values(broken,'AAAA')==['2001:db8::1234']
 unreachable=socket.socket(socket.AF_INET6);unreachable.settimeout(.3)
 try:unreachable.connect(('2001:db8::1234',server.server_port));raise AssertionError('documentation address unexpectedly reachable')
 except OSError as error:failure=type(error).__name__
 finally:unreachable.close()
 print(json.dumps({'A':show(a),'AAAA_over_IPv4_DNS':show(aaaa),'IPv6_HTTP_status':reply.status,
 'AAAA_wire_address_bytes':16,'A_only_AAAA_query':show(missing),'published_but_unreachable':{'answer':show(broken),'connect_error':failure}},sort_keys=True))
 finally:server.shutdown();thread.join(timeout=2)
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The name dual.lab.test returns A 127.0.0.1 with TTL 17 and AAAA ::1 with TTL 29. Both DNS queries travel to an IPv4 DNS socket at 127.0.0.1. Receiving AAAA over that socket demonstrates that the address family described by the record is independent of the transport carrying the DNS question and answer.

The program converts the AAAA text into its packed form and checks that it occupies 16 bytes. It then uses the returned IPv6 address to request the local HTTP service. The recorded response is status 200 with the expected body. This verifies a usable IPv6 loopback connection for the selected address, rather than treating the existence of an AAAA record as the application test.

Querying AAAA for v4-only.lab.test returns NOERROR, no answer RRset, and an SOA in the authority section. The name still has its A record. Meanwhile, broken.lab.test successfully returns the documentation address 2001:db8::1234; connecting to it fails in this isolated environment. The result deliberately separates positive DNS data from transport success without sending test traffic to a real external host.

Check each advertised family through the service

Before publishing an IPv6 address, establish the listener, route, access rules, and application behavior. Test the hostname with its normal identity and test the individual advertised endpoints. A raw-address HTTP success does not validate hostname-based TLS or virtual-host routing. The example verifies local HTTP only; it neither demonstrates public IPv6 connectivity nor evaluates a client’s Happy Eyeballs implementation.

Keep both RRsets in monitoring and deployment records. Removing AAAA stops new authoritative answers but does not invalidate addresses already cached by clients. Existing connections have their own lifetimes. During a move, retain the old IPv6 service for the intended overlap and compare authoritative data with the recursive resolver used by affected clients before attributing every old connection to a stale DNS answer.

Finally, AAAA is forward address data, despite occasional descriptions calling it an IPv6 pointer. Reverse lookup uses PTR records under ip6.arpa, with reversed hexadecimal nibbles derived from the address. Publishing forward AAAA does not automatically publish that reverse record. Treat forward lookup, reverse naming, address selection, and successful application traffic as related checks with distinct configurations and observable outcomes.

Sources

RFC 3596 DNS extensions for IPv6, AAAA address data, transport independence, and ip6.arpa reverse names, checked 2026-09-12.
RFC 6147 DNS64, synthesized AAAA records for access to IPv4 servers, checked 2026-09-12.
RFC 8305 Happy Eyeballs version 2, client address selection and connection attempts, checked 2026-09-12.

TCP slow start grows with acknowledged data, not merely with elapsed time

Tue, 28 Dec 2027 00:00:00 +0000

Slow start grows a TCP sender’s congestion window while it learns how much outstanding data the path can support. With enough data and suitable acknowledgments, the classic behavior is approximately exponential growth across round trips. “Doubles every RTT” is a useful simplified pattern, not an unconditional timer rule. The window changes in response to transport feedback and the implementation’s growth conditions.

Slow start needs data and suitable ACK feedback. The source’s Reno observations illustrate workload dependence; they do not promise doubling on every RTT or certify WAN performance.

When it breaks

Waiting after connect does not automatically warm up the congestion window. If the application sends nothing, there are no data acknowledgments to support that growth. A very small exchange may also finish without using the existing flight budget. Expecting every short request to display a large doubling sequence mistakes an application-limited transfer for a continuously backlogged sender.

The initial window is not universally one or two segments on modern systems. RFC 6928 describes an experimental extension allowing a larger initial window, and the tested Linux sender begins with ten segments. The relevant unit matters too: Linux TCP_INFO reports snd_cwnd in segments, whereas many protocol explanations express congestion windows in bytes. Compare it with the sender’s MSS before reasoning about outstanding data volume.

Slow start does not always continue until a first loss, followed by a universal collapse. The slow-start threshold helps select between startup growth and congestion avoidance, and implementations may use additional startup detection. Recovery from a retransmission timeout differs from fast recovery. Applying one cartoon curve to every algorithm, loss signal, and workload can produce an incorrect diagnosis from otherwise valid measurements.

Check it quickly

Save this as check-slow-start.py and run python3 check-slow-start.py with Docker. The disposable environment uses Python 3.11.16 and iproute2 6.1.0, tested on Linux 6.12.76. NET_ADMIN and SYS_ADMIN support nested namespaces. A new veth joins client and target; netem adds ten milliseconds of egress delay in each direction, with all changes confined to those virtual endpoints:

The environment and numerical outcomes below are inherited article reports, not independently reproduced here. The image does not pin the host kernel or package availability.

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 iputils-ping=3:20221126-1+deb12u1 nftables=1.0.6-2+deb12u2 tcpdump=4.99.3-1 traceroute=1:2.1.2-1 procps=2:4.0.2-3 && rm -rf /var/lib/apt/lists/*\nCMD ["python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,select,signal,subprocess,time

def run(*args,check=True,input=None,timeout=8):
 result=subprocess.run(args,input=input,capture_output=True,text=True,timeout=timeout)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def ns(name,*args,**kwargs):return run('ip','netns','exec',name,*args,**kwargs)
def ip(name,*args,**kwargs):return ns(name,'ip',*args,**kwargs)
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=2)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=2)
def line(process,timeout=3):
 assert select.select([process.stdout],[],[],timeout)[0],'child response deadline exceeded'
 value=process.stdout.readline();assert value,('child exited without a response',process.stderr.read())
 return value
def spawn(stack,command):
 process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);return process
@contextmanager
def lab(names):
 with TemporaryDirectory(prefix='net-path-') as directory,ExitStack() as stack:
 root=Path(directory);proc=root/'proc';proc.mkdir();run('mount','-t','proc','proc',str(proc))
 stack.callback(run,'umount',str(proc))
 for name in names:
 run('ip','netns','add',name);stack.callback(run,'ip','netns','delete',name,check=False)
 ip(name,'link','set','lo','up')
 def setting(name,key,value):
 assert name in names
 path=proc/'sys'/key.replace('.','/')
 return ns(name,'python3','-c',f'from pathlib import Path; p=Path({str(path)!r}); p.write_text({str(value)!r}); print(p.read_text().strip())').stdout.strip()
 yield root,stack,setting
def wire(left,left_if,right,right_if,left_addresses,right_addresses):
 run('ip','link','add',left_if,'type','veth','peer','name',right_if)
 for name,interface,addresses in [(left,left_if,left_addresses),(right,right_if,right_addresses)]:
 run('ip','link','set',interface,'netns',name)
 for address in addresses:ip(name,'address','add',address,'dev',interface,*(['nodad'] if ':' in address else []))
 ip(name,'link','set',interface,'up')
def nft(name,script):return ns(name,'nft','-f','-',input=script)
def counters(name):
 data=json.loads(ns(name,'nft','-j','list','ruleset').stdout);found={}
 for entry in data['nftables']:
 rule=entry.get('rule',{})
 if 'comment' in rule:
 for expression in rule['expr']:
 if 'counter' in expression:found[rule['comment']]=expression['counter']['packets']
 return found


info_code=r'''
import struct
def tcp_info(stream):
 raw=stream.getsockopt(socket.IPPROTO_TCP,socket.TCP_INFO,104);assert len(raw)==104
 offsets={'snd_mss':16,'unacked':24,'rtt_us':68,'snd_ssthresh':76,'snd_cwnd':80,'total_retrans':100}
 return {'ca_state':raw[1],**{key:struct.unpack_from('=I',raw,offset)[0] for key,offset in offsets.items()}}
'''
with lab(['client','target']) as (root,stack,setting):
 wire('client','c0','target','t0',['192.0.2.1/30'],['192.0.2.2/30'])
 for name,interface in [('client','c0'),('target','t0')]:
 ns(name,'tc','qdisc','add','dev',interface,'root','netem','delay','10ms','limit','10000')
 server_code=r'''
import socket,json,hashlib,sys
size=int(sys.argv[1]);listener=socket.socket();listener.setsockopt(socket.SOL_SOCKET,socket.SO_REUSEADDR,1)
listener.bind(('192.0.2.2',18080));listener.listen();print('listening',flush=True)
with listener.accept()[0] as connection:
 connection.settimeout(6);remaining=size;digest=hashlib.sha256()
 while remaining:
 chunk=connection.recv(min(65536,remaining));assert chunk;remaining-=len(chunk);digest.update(chunk)
 assert digest.hexdigest()==hashlib.sha256(b'x'*size).hexdigest()
 connection.sendall((digest.hexdigest()+'\n').encode())
'''
 client_code=info_code+r'''
import socket,json,time,threading,sys,hashlib
size=int(sys.argv[1]);stream=socket.socket();stream.settimeout(6)
stream.setsockopt(socket.IPPROTO_TCP,socket.TCP_CONGESTION,b'reno');stream.connect(('192.0.2.2',18080))
initial=tcp_info(stream);time.sleep(.06);idle=tcp_info(stream);assert idle['snd_cwnd']==initial['snd_cwnd']
done=threading.Event();errors=[];samples=[initial,idle];reply=[]
def transfer():
 try:
 stream.sendall(b'x'*size)
 with stream.makefile('rb') as incoming:reply.append(incoming.readline().decode().strip())
 except BaseException as error:errors.append(repr(error))
 finally:done.set()
worker=threading.Thread(target=transfer);worker.start();deadline=time.monotonic()+7
while not done.wait(.005):
 assert time.monotonic()<deadline,'transfer deadline exceeded'
 snapshot=tcp_info(stream)
 if snapshot!=samples[-1]:samples.append(snapshot)
worker.join(timeout=1);assert not worker.is_alive() and not errors,errors
samples.append(tcp_info(stream));assert reply==[hashlib.sha256(b'x'*size).hexdigest()]
assert all(row['total_retrans']==0 for row in samples),samples
if size>1:assert max(row['snd_cwnd'] for row in samples)>initial['snd_cwnd']*2,samples
else:assert max(row['snd_cwnd'] for row in samples)==initial['snd_cwnd'],samples
print(json.dumps({'bytes':size,'algorithm':stream.getsockopt(socket.IPPROTO_TCP,socket.TCP_CONGESTION,16).split(b'\0')[0].decode(),
 'before_data':initial,'after_idle_without_data':idle,'samples':samples,'sha256':reply[0]}));stream.close()
'''
 results={}
 for label,size in [('short',1),('bulk',1048576)]:
 service=spawn(stack,['ip','netns','exec','target','python3','-u','-c',server_code,str(size)]);assert line(service).strip()=='listening'
 results[label]=json.loads(ns('client','python3','-c',client_code,str(size),timeout=10).stdout)
 service.wait(timeout=2);assert service.returncode==0
 print(json.dumps({'egress_delay_each_direction_ms':10,'transfers':results}))
"""
name='xbcatm-tcpflow-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN','--cap-add','SYS_ADMIN',
 '--memory','256m','--pids-limit','128',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The client explicitly selects Reno so the experiment is not silently comparing different default congestion controllers. It records TCP_INFO before sending, waits sixty milliseconds without data, and records it again. The window stays at ten segments in both observations. That directly tests the mistaken expectation that simply leaving a new connection open makes its congestion budget grow on a clock.

The first transfer sends one byte and receives a digest from the server. Samples include one segment outstanding and then none, while the congestion window remains ten. Successful delivery therefore does not require visible exponential growth for this workload. There was already enough permitted flight size for the entire request, so its limited application data does not exercise a bulk startup ramp.

The second transfer sends one mebibyte. A separate thread performs the blocking exchange while the main thread samples socket state, avoiding loss of observations while sendall waits. The captured progression includes ten, twenty, forty, and eighty segments, followed by less tidy values as acknowledgment grouping and transfer progress interact. The test requires substantial growth, not one exact sample sequence or one sample per RTT.

Both server and client verify the payload through SHA-256, and all sampled retransmission totals remain zero. The threshold is much larger than the observed window in this run. These observations support an ACK-driven startup demonstration without deliberately testing loss recovery or measuring a shared bottleneck. The artificial delay makes progress observable; it does not establish a real WAN’s capacity or fairness.

Interpret a growth trace in its workload context

Record algorithm, MSS, congestion window, threshold, outstanding data, RTT, and retransmission evidence together. A window larger than the current unacknowledged count is possible because the application or receiver can impose another limit. Treat a sampled window as the sender’s current allowance, not as a promise that exactly that many segments are continuously occupying the path.

Sampling also affects the picture. A userspace observer can miss intermediate changes, and its five-millisecond interval is not synchronized with ACK arrivals. Delayed acknowledgments, offload behavior, and scheduling can alter the visible progression. The fixture checks relationships supported by the data rather than declaring that an omitted intermediate value proves a broken congestion controller.

For short operations, reducing unnecessary new connections may avoid repeatedly starting with a fresh congestion budget, where the application protocol permits reuse. A reused connection can still restart with a reduced window after an idle period, depending on its restart policy. For bulk performance, test representative RTT, loss, receive behavior, and competing traffic before changing startup settings. This experiment separates idle time, a tiny successful exchange, and sustained data, providing a concrete basis for deciding whether slow start is relevant to the observed delay.

Sources

RFC 5681 Congestion Control, ACK-driven slow start, congestion avoidance, threshold transitions and idle restart, checked 2026-09-12.
RFC 6928 Initial Window, the experimental extension allowing a larger initial congestion window, checked 2026-09-12.
Linux 6.12.76 TCP_INFO fields, congestion window, threshold, unacknowledged segments and retransmissions, checked 2026-09-12.

The listen backlog holds connections waiting for accept

Mon, 25 Oct 2027 00:00:00 +0000

On Linux TCP sockets, the listen() backlog concerns established connections waiting for the application to accept them. The incomplete-handshake queue is a separate concept. Calling accept() removes a pending connection and returns a connected socket for application use. That accepted connection no longer occupies the listener’s accept queue, even if it remains open and busy for a long time.

Backlog bounds waiting room. accept() releases a queue place, while the returned connected socket can remain active.

When it breaks

If connections arrive faster than the application accepts them, the pending queue can fill. New clients may then encounter retransmission delays or timeouts, depending on kernel behavior and settings. Existing accepted requests can still look healthy. A process being alive, or some requests succeeding, does not prove that its listener is accepting new connections quickly enough.

The requested backlog is also constrained by net.core.somaxconn; increasing only a larger application value cannot exceed that cap. The exact observable queue boundary is implementation-dependent, however, so treating the integer as a portable promise of precisely that many successful simultaneous connects is unsafe. Measure the deployed kernel rather than converting one small experiment into a universal off-by-one rule.

Queue counters need context. ListenOverflows and ListenDrops are network-namespace counters, not automatically per-service explanations. Other listeners can contribute to them, and a client timeout can have causes outside the accept queue. Correlate queue occupancy, acceptance progress, and counters before attributing production failures to a particular backlog setting or declaring that a larger queue will fix them.

Check it quickly

The current review did not rerun the Docker socket experiment; the kernel values and overflow outcomes remain earlier recorded observations.

Save this as check-listen-backlog.py and run it with host Python, Docker, and the pinned Python image available. The actual socket operations run inside a disposable Linux container with networking disabled except loopback. The recorded kernel was 6.12.76-linuxkit. Use a separately authorized disposable VM with the image already available and assertions enabled. The script reads settings and requires tcp_abort_on_overflow=0; if prerequisites differ, stop rather than change the host:

import json,subprocess
image='python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84'
program=r'''
from contextlib import ExitStack
from pathlib import Path
import json,platform,socket
def counters():
 lines=Path('/proc/net/netstat').read_text().splitlines()
 for index,line in enumerate(lines):
 if line.startswith('TcpExt:'):
 return dict(zip(line.split()[1:],map(int,lines[index+1].split()[1:])))
def queued(port):
 for line in Path('/proc/net/tcp').read_text().splitlines()[1:]:
 fields=line.split()
 if fields[3]=='0A' and int(fields[1].split(':')[1],16)==port:
 return int(fields[4].split(':')[1],16)
 raise AssertionError('listener missing')
with ExitStack() as stack:
 def fresh():
 s=stack.enter_context(socket.socket());s.settimeout(.25);return s
 def listener(backlog):
 s=fresh();s.bind(('127.0.0.1',0));s.listen(backlog);return s
 somaxconn=int(Path('/proc/sys/net/core/somaxconn').read_text())
 abort=int(Path('/proc/sys/net/ipv4/tcp_abort_on_overflow').read_text());assert abort==0
 small=listener(1);address=small.getsockname();before=counters();clients=[];timed_out=False
 for _ in range(8):
 client=fresh()
 try:client.connect(address)
 except TimeoutError:timed_out=True;client.close();break
 clients.append(client)
 depth=queued(address[1]);after=counters()
 assert timed_out and depth==len(clients) and 1<=depth<8,(depth,len(clients))
 changes={name:after[name]-before[name] for name in ['ListenOverflows','ListenDrops']}
 assert changes['ListenOverflows']>0 and changes['ListenDrops']>0,changes
 accepted=[]
 for client in clients:
 server,_=small.accept();stack.enter_context(server);accepted.append(server);server.sendall(b'ready')
 reader=stack.enter_context(client.makefile('rb'));assert reader.read(5)==b'ready'
 assert queued(address[1])==0
 for _ in range(4):
 client=fresh();client.connect(address);server,_=small.accept();stack.enter_context(server)
 server.sendall(b'ready');reader=stack.enter_context(client.makefile('rb'));assert reader.read(5)==b'ready'
 accepted.append(server);clients.append(client)
 assert len(accepted)>1 and all(s.fileno()>=0 for s in accepted)
 larger=listener(16)
 for _ in range(6):client=fresh();client.connect(larger.getsockname())
 assert queued(larger.getsockname()[1])==6
 print(json.dumps({'kernel':platform.release(),'somaxconn':somaxconn,'tcp_abort_on_overflow':abort,
 'requested_small_backlog':1,'queued_before_accept':depth,'next_connect_timed_out':timed_out,
 'counter_changes':changes,'accepted_connections_still_open':len(accepted),'larger_backlog_queued':6},sort_keys=True))
'''
result=subprocess.run(['docker','run','--rm','-i','--network','none',image,'python','-'],
 input=program,capture_output=True,text=True,timeout=30)
assert result.returncode==0,result.stderr
record=json.loads(result.stdout);print(json.dumps(record,sort_keys=True))

The first listener requests backlog one and deliberately does not accept connections. In the recorded environment, two client connects complete and /proc/net/tcp reports two queued connections. The next connect exceeds the client’s 250-millisecond timeout. The script records the observed depth rather than asserting that every Linux version must admit exactly two under this setting.

During that controlled overflow, both ListenOverflows and ListenDrops increase by one. Because the experiment has its own network namespace and only these loopback listeners, the observation can be associated with its deliberately stalled listener. No global kernel setting is changed, and the example does not manufacture failure by altering the shared Docker VM’s networking policy.

The application then accepts the queued connections and sends a short acknowledgement over each returned socket. The clients read the complete acknowledgement, and the listener queue falls to zero. Four more connections are created and promptly accepted while the previous accepted sockets remain open. Six accepted connections coexist despite the original requested backlog of one.

A second listener requests backlog sixteen. Six clients connect before any acceptance, and its queue reports six pending connections. This demonstrates that a larger queue can absorb this particular arrival burst while the application is paused. It does not show higher processing throughput, prove those clients received application responses, or establish that increasing a backlog solves sustained overload.

Tune acceptance and waiting capacity together

The recorded somaxconn value is 4096, comfortably above both requested backlogs. That value is an observation of the test environment, not a recommendation to copy into another host. Inspect the application’s actual listen argument, its accept loop, and the kernel cap together. A high system limit cannot enlarge a small backlog the application deliberately requests.

Separate incomplete handshakes from established connections awaiting acceptance. SYN-queue controls and SYN-cookie behavior answer different questions from the accept queue shown here. Likewise, tcp_abort_on_overflow changes overflow handling; enabling resets is not an increase in service capacity. This experiment leaves it disabled and demonstrates the client-visible timeout under that existing policy.

Finally, investigate why acceptance falls behind. Event-loop stalls, descriptor exhaustion, dispatch bottlenecks, and deliberate pauses can affect it differently from slow work on already accepted sockets. A larger queue buys waiting room, which must fit client deadlines and memory budgets. If sustained arrivals exceed the rate the service can accept and handle, additional waiting only postpones the capacity failure.

Sources

Linux listen(2), established connections waiting for accept and the somaxconn cap, checked 2026-09-12.
Linux accept(2), removing a pending connection and returning a connected socket, checked 2026-09-12.
Linux IP sysctl documentation, somaxconn, SYN backlog, and tcp_abort_on_overflow, checked 2026-09-12.

IPv6 routers report oversized packets; sources decide how to fit the path

Wed, 06 Oct 2027 00:00:00 +0000

An IPv6 router does not fragment a packet while forwarding it toward its destination. If the packet is too large for the next link, the router discards it and sends ICMPv6 Packet Too Big feedback. The source can then adjust its packet size or, where appropriate, send fragments using the IPv6 Fragment header. Reassembly of those fragments takes place at the destination.

When it breaks

Assuming a router will split an oversized IPv6 packet hides a size-dependent failure. A small echo request can work while a larger one fails, even when both use the same addresses and route. The endpoint’s local interface may support the original size while an intermediate link does not. Check the entire path constraint rather than concluding that a 1500-byte interface guarantees that size end to end.

Missing Packet Too Big feedback makes it harder for discovery to learn that constraint. Fragment filtering or losing one fragment can also prevent successful reassembly. Generating a Fragment header does not guarantee passage through network policy. Avoid treating source fragmentation as a universal substitute for correct path sizing and the required control traffic.

The reverse direction has its own path estimate. Learning the request path’s MTU does not automatically teach the responder how to size a large reply. A two-way echo test therefore needs both directions understood. TCP segmentation is also distinct from IP fragmentation: a TCP sender can form smaller segments after learning a path constraint without fragmenting each IP packet.

Routers do not fragment forwarded IPv6 traffic. Source fragmentation and destination reassembly are separate from learning the path limit. Packet and aperture shapes are schematic, not a byte-scale drawing. The network example remains blocked and was not rerun.

Check it quickly

This retained lab was previously reported on Linux 6.12.76 with Python 3.11.16, iproute2 6.1.0 and tcpdump 4.99.3; it was not rerun here. Save it as check-ipv6-fragmentation.py only for a separately authorized disposable Linux VM. Docker containers share that VM’s kernel: NET_ADMIN, SYS_ADMIN and proc mounts require isolation beyond a production container. Image builds download packages despite the later --network none run. Keep assertions enabled; never relax host security to make setup pass. The veth links and routes are intended to remain inside the lab:

from pathlib import Path
from tempfile import TemporaryDirectory
import subprocess,json,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 iputils-ping=3:20221126-1+deb12u1 nftables=1.0.6-2+deb12u2 tcpdump=4.99.3-1 traceroute=1:2.1.2-1 procps=2:4.0.2-3 && rm -rf /var/lib/apt/lists/*\nCMD ["python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,select,signal,subprocess,time
def run(*args,check=True,input=None,timeout=8):
 result=subprocess.run(args,input=input,capture_output=True,text=True,timeout=timeout)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def ns(name,*args,**kwargs):return run('ip','netns','exec',name,*args,**kwargs)
def ip(name,*args,**kwargs):return ns(name,'ip',*args,**kwargs)
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=2)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=2)
def spawn(stack,command):
 process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);return process
def line(process,timeout=3):
 assert select.select([process.stdout],[],[],timeout)[0],'child response deadline exceeded'
 value=process.stdout.readline();assert value,process.stderr.read();return value
@contextmanager
def lab():
 with TemporaryDirectory(prefix='mtu-path-') as directory,ExitStack() as stack:
 root=Path(directory);proc=root/'proc';proc.mkdir();run('mount','-t','proc','proc',str(proc));stack.callback(run,'umount',str(proc))
 for name in ['client','r1','r2','target']:
 run('ip','netns','add',name);stack.callback(run,'ip','netns','delete',name,check=False);ip(name,'link','set','lo','up')
 def setting(name,key,value):
 assert name in ['client','r1','r2','target']
 path=proc/'sys'/key.replace('.','/')
 ns(name,'python3','-c',f'from pathlib import Path; p=Path({str(path)!r});p.write_text({str(value)!r});assert p.read_text().strip()=={str(value)!r}')
 yield root,stack,setting
def topology(setting,ipv6=False):
 links=[('client','c0','r1','a0',1,2,1,1500),('r1','a1','r2','b0',2,1,2,1280),('r2','b1','target','t0',3,1,2,1500)]
 for left,left_if,right,right_if,network,left_host,right_host,mtu in links:
 run('ip','link','add',left_if,'type','veth','peer','name',right_if)
 for name,interface,host in [(left,left_if,left_host),(right,right_if,right_host)]:
 run('ip','link','set',interface,'netns',name);ip(name,'link','set',interface,'mtu',str(mtu))
 address=f'2001:db8:{network}::{host}/64' if ipv6 else f'10.210.{network}.{host}/30'
 ip(name,'addr','add',address,'dev',interface,*(['nodad'] if ipv6 else []));ip(name,'link','set',interface,'up')
 family='-6' if ipv6 else '-4'
 for name in ['r1','r2']:setting(name,'net.ipv6.conf.all.forwarding' if ipv6 else 'net.ipv4.ip_forward',1)
 routes=[('client','default','2001:db8:1::1' if ipv6 else '10.210.1.1'),('target','default','2001:db8:3::1' if ipv6 else '10.210.3.1'),
 ('r1','2001:db8:3::/64' if ipv6 else '10.210.3.0/30','2001:db8:2::2' if ipv6 else '10.210.2.2'),
 ('r2','2001:db8:1::/64' if ipv6 else '10.210.1.0/30','2001:db8:2::1' if ipv6 else '10.210.2.1')]
 for name,destination,gateway in routes:ip(name,family,'route','add',destination,'via',gateway)
 if ipv6:
 deadline=time.monotonic()+4
 while any('tentative' in ip(name,'-6','address','show').stdout for name in ['client','r1','r2','target']):
 assert time.monotonic()<deadline,'IPv6 link-local DAD did not finish';time.sleep(.02)
def nft(name,script):return ns(name,'nft','-f','-',input=script)
def counters(name):
 result={}
 for item in json.loads(ns(name,'nft','-j','list','ruleset').stdout)['nftables']:
 rule=item.get('rule',{})
 if 'comment' in rule:
 for expression in rule['expr']:
 if 'counter' in expression:result[rule['comment']]=expression['counter']['packets']
 return result
def capture(stack,root,name,interface,expression,label):
 path=root/(label+'.pcap')
 process=subprocess.Popen(['ip','netns','exec',name,'tcpdump','--immediate-mode','-Z','root','-U','-n','-i',interface,'-w',str(path),expression],stdout=subprocess.DEVNULL,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);deadline=time.monotonic()+3
 while time.monotonic()<deadline:
 assert process.poll() is None,'capture exited'
 if select.select([process.stderr],[],[],.1)[0] and 'listening on' in process.stderr.readline():return process,path
 raise AssertionError('capture did not become ready')
def captured(process,path):
 process.send_signal(signal.SIGINT);_,diagnostic=process.communicate(timeout=3);assert process.returncode==0,diagnostic
 return run('tcpdump','-nn','-vv','-r',str(path)).stdout

with lab() as (root,stack,setting):
 topology(setting,ipv6=True);target='2001:db8:3::2'
 small=ns('client','ping','-6','-n','-c','1','-W','1','-s','32',target);assert small.returncode==0
 tap,path=capture(stack,root,'client','c0','ip6','too-big')
 large=ns('client','ping','-6','-n','-M','do','-s','1400','-c','1','-W','1',target,check=False)
 feedback=captured(tap,path);assert large.returncode!=0 and 'too big' in feedback.lower(),(large.stdout,large.stderr,feedback)
 route=ip('client','-6','route','get',target).stdout;assert 'mtu 1280' in route,route
 reverse=ns('target','ping','-6','-n','-M','do','-s','1400','-c','1','-W','1','2001:db8:1::2',check=False)
 reverse_route=ip('target','-6','route','get','2001:db8:1::2').stdout
 assert reverse.returncode!=0 and 'mtu 1280' in reverse_route,(reverse.stdout,reverse.stderr,reverse_route)
 tap,path=capture(stack,root,'client','c0','ip6 and src 2001:db8:1::2','source-fragments')
 fragmented=ns('client','ping','-6','-n','-M','dont','-s','2000','-c','1','-W','2',target,check=False)
 trace=captured(tap,path);assert fragmented.returncode==0,(fragmented.stdout,fragmented.stderr,trace)
 assert 'frag (' in trace and trace.count('frag (')>=2,trace
 refused=ns('client','ping','-6','-n','-M','do','-s','2000','-c','1','-W','1',target,check=False)
 assert refused.returncode!=0 and 'too long' in (refused.stdout+refused.stderr).lower(),(refused.stdout,refused.stderr)
 print(json.dumps({'small_echo':small.stdout,'oversize_before_learning':{'stdout':large.stdout,'stderr':large.stderr,'returncode':large.returncode},
 'packet_too_big_capture':feedback,'learned_route':route,'reverse_path_learning':reverse.stdout+reverse.stderr,'reverse_route':reverse_route,'source_fragmented_echo':fragmented.stdout,
 'source_side_fragment_capture':trace,'dont_fragment_after_learning':{'returncode':refused.returncode,'stdout':refused.stdout,'stderr':refused.stderr}}))
"""
name='xbcatm-mtupath-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN','--cap-add','SYS_ADMIN','--memory','256m','--pids-limit','128',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

Endpoint links use MTU 1500; the middle link uses 1280. Static global addresses use nodad, while setup waits for link-local addresses to leave tentative state. This separates address readiness from forwarding failure; it does not test Duplicate Address Detection.

A small echo exchange succeeds first. An echo payload of 1400 bytes, sent with the do policy, then creates a 1448-byte IPv6 packet after its base and ICMPv6 headers are included. It fits the source interface but not the middle link. The capture shows the original request and a router Packet Too Big message reporting MTU 1280; the client route lookup records that learned value.

The target performs the corresponding oversized probe toward the client and learns MTU 1280 for the reverse path. This explicit step prepares its large echo reply rather than assuming that one endpoint’s cache covers both directions. Both failed discovery probes remain in the output, with their router feedback and route state, so the setup conditions behind later success are visible.

The client next sends a 2000-byte echo payload with the dont policy, allowing source fragmentation under the learned limit. A capture on the client interface, restricted to the client’s source address, shows two fragments with the same identification before either router processes them. Their displayed data offsets are zero and 1232 bytes, and their fragment data lengths sum to 2008, including the ICMPv6 header.

That echo succeeds after destination reassembly and a correctly sized return exchange. Repeating the same payload with do instead reports a local message-too-long error and MTU 1280. The results distinguish a router reporting an unknown bottleneck, source-generated fragments after discovery, and a local refusal once the smaller path limit is known. They are different failure and delivery stages.

Diagnose size and direction before recommending fragmentation

Include all relevant headers when calculating packet size. A fragment adds its own header, and the IPv6 Fragment Offset field uses eight-byte units even though diagnostic tools may display byte offsets. Use consistent units when reconstructing ranges. The reported historical source capture supplies those offsets; the absence of a fragment from an unrelated capture would require more context to interpret.

An IPv6 router can still act as the source of its own packets, which is separate from fragmenting transit traffic. Keep that role distinction when reading captures from routers or tunnel endpoints. Also distinguish the path’s minimum link MTU from a particular application’s chosen payload size: they are related by protocol overhead and the sender’s packetization policy.

Prefer application and transport behavior that fits the known path where possible, and verify any required fragment handling with actual traffic. The historical report describes source placement, feedback, route learning, and a successful fragmented echo; the code only asserts at least two fragment records. It does not validate arbitrary extension-header chains, fragment-filtering policies, or every transport’s behavior under missing control messages.

Sources

RFC 8200 IPv6, source fragmentation, Fragment headers and destination reassembly, checked 2026-10-15.
RFC 8201 IPv6 Path MTU Discovery, Packet Too Big feedback and directional path estimates, checked 2026-10-15.
Linux ping(8), payload sizing and do/dont path-MTU policies, checked 2026-10-15.

TCP keepalive probes idle connections

Tue, 05 Oct 2027 00:00:00 +0000

TCP keepalive asks whether the other TCP endpoint still responds after a quiet period. It does not ask whether an HTTP handler, database query, or worker is making progress. A peer’s kernel can acknowledge traffic while its application is stalled. Treat transport reachability and useful application responses as different observations.

TCP kernel acknowledgment and application progress are separate. In the source Go exercise, keepalive is configured to 30 seconds idle, 10 seconds spacing and 3 probes, then a 200 ms read deadline expires. The peer later reads the original ping and returns pong on the same connection after the client resets its deadline. Actual keepalive probes were not tested. Source exercise only; this illustration pass did not rerun it.

A transport probe, not an application heartbeat

Keepalive can expose a connection whose remote state disappeared or whose path silently stopped delivering traffic. The implementation sends probes after sufficient inactivity and eventually reports failure after its configured unanswered-probe policy. A single lost probe is not proof of a dead peer; transient loss must not be mistaken for certainty.

These probes are handled below the application’s byte stream. They are not HTTP requests, database pings, or WebSocket heartbeats. If a proxy terminates the TCP connection, the peer being probed is that proxy, not the origin behind it. Probes may affect some middlebox tracking, but cannot be assumed to refresh an application’s idle timer or preserve every NAT mapping.

Already outstanding data has its own retransmission and failure rules. Do not translate a keepalive setting into a universal deadline for busy connections. A FIN, reset, application timeout, and silent network loss are different events and may require different recovery decisions.

Configure the socket you actually use

RFC 1122 requires an optional keepalive mechanism to default off, with a configurable default idle interval of at least two hours. Applications and libraries can explicitly enable it and choose shorter intervals; Go’s dialer is one example. Therefore kernel defaults alone do not establish an application’s effective behavior.

On Linux, tcp_keepalive_time, tcp_keepalive_intvl, and tcp_keepalive_probes describe idle seconds, probe spacing, and the unanswered-probe limit. The documented defaults are 7200, 75, and 9. Per-socket TCP_KEEPIDLE, TCP_KEEPINTVL, and TCP_KEEPCNT can specialize the policy when SO_KEEPALIVE is enabled. These names and interfaces are not universal macOS or Windows settings.

Choose intervals against detection needs, connection count, transient-loss tolerance, and intermediary policies. An idle-plus-probe arithmetic estimate is not a hard real-time guarantee. Prefer scoped socket configuration over changing machine-wide defaults for unrelated services, and check setter errors and the actual enabled state.

When it breaks

A supposedly protected request may hang because only keepalive was configured, with no application read deadline. Conversely, an application deadline can expire while the TCP connection remains usable. Neither result proves that the peer process died. Retrying a write after a local timeout can duplicate work that the peer has already received.

A lower idle timeout at a proxy can still close a connection regardless of the endpoint’s keepalive policy. Excessively frequent probes also add traffic and power cost across large fleets. Diagnose the actual terminating hop and failure signal before changing all three timers together.

Check it quickly

Save this as keepalive_probe.go and run go run keepalive_probe.go with Go 1.23 or newer on macOS or Linux. The SO_KEEPALIVE inspection uses a Unix socket API; this exact program is not a Windows recipe. It creates only loopback sockets and changes no sysctl, firewall, or shared service.

package main

import (
 "errors"
 "fmt"
 "io"
 "net"
 "os"
 "runtime"
 "syscall"
 "time"
)

func must(err error) {
 if err != nil {
 panic(err)
 }
}

func check(ok bool, message string) {
 if !ok {
 panic(message)
 }
}

func keepalive(connection *net.TCPConn) int {
 raw, err := connection.SyscallConn()
 must(err)
 var value int
 var optionError error
 must(raw.Control(func(fd uintptr) {
 value, optionError = syscall.GetsockoptInt(int(fd), syscall.SOL_SOCKET, syscall.SO_KEEPALIVE)
 }))
 must(optionError)
 return value
}

func main() {
 listener, err := net.ListenTCP("tcp4", &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1)})
 must(err)
 defer listener.Close()
 must(listener.SetDeadline(time.Now().Add(2 * time.Second)))
 dialer := net.Dialer{Timeout: 2 * time.Second, KeepAlive: -1}
 connection, err := dialer.Dial("tcp4", listener.Addr().String())
 must(err)
 client := connection.(*net.TCPConn)
 defer client.Close()
 peer, err := listener.AcceptTCP()
 must(err)
 defer peer.Close()

 check(keepalive(client) == 0, "keepalive must start disabled")
 must(client.SetKeepAliveConfig(net.KeepAliveConfig{
 Enable: true, Idle: 30 * time.Second,
 Interval: 10 * time.Second, Count: 3,
 }))
 enabled := keepalive(client)
 check(enabled != 0, "SO_KEEPALIVE must be enabled")
 fmt.Printf("SO_KEEPALIVE: 0 -> %d (enabled); per-socket configuration accepted\n", enabled)

 must(client.SetWriteDeadline(time.Now().Add(2 * time.Second)))
 n, err := client.Write([]byte("ping"))
 must(err)
 check(n == 4, "request must be fully written")
 must(client.SetReadDeadline(time.Now().Add(200 * time.Millisecond)))
 reply := make([]byte, 4)
 n, err = client.Read(reply)
 check(n == 0 && errors.Is(err, os.ErrDeadlineExceeded), "silent application must reach read deadline")
 fmt.Println("read deadline fired while the peer application was silent")

 must(peer.SetDeadline(time.Now().Add(2 * time.Second)))
 request := make([]byte, 4)
 _, err = io.ReadFull(peer, request)
 must(err)
 check(string(request) == "ping", "the original request is still queued")
 n, err = peer.Write([]byte("pong"))
 must(err)
 check(n == 4, "reply must be fully written")
 must(client.SetReadDeadline(time.Now().Add(2 * time.Second)))
 _, err = io.ReadFull(client, reply)
 must(err)
 check(string(reply) == "pong", "same connection must deliver the reply")
 fmt.Println("after resetting the read deadline, the original connection returns pong")
 fmt.Println(runtime.Version(), runtime.GOOS)
}

The dialer first disables keepalive. Explicit socket configuration then enables it, and getsockopt must return a nonzero value; enabled need not equal one. The earlier article reports eight on macOS with Go 1.27.0; that result was not independently reproduced here. The peer application deliberately leaves the four-byte request unread while the client’s 200-millisecond read deadline expires.

Afterward, the peer reads the original ping and writes pong. Resetting the client’s read deadline permits that reply on the same connection, without reconnecting or resending. The timeout bounded a local wait; it did not withdraw queued bytes or cancel remote work.

The article reports passing assertions. The code checks accepted configuration and SO_KEEPALIVE, without reading back all three timer settings. It tests application deadlines, not actual keepalive probes: the configured first-probe idle interval is thirty seconds. It neither drops packets nor measures failure detection through a NAT. Those require a separately controlled network test with packet evidence and recovery checks.

Sources

RFC 1122: Requirements for Internet Hosts, section 4.2.3.6: optional keepalive, inactivity, and lost probes, checked 2026-09-09.
Linux tcp(7), keepalive defaults, socket options, and shorter intermediary timeouts, checked 2026-09-09.
Go net, KeepAliveConfig, socket configuration, and deadline semantics, checked 2026-09-09.

A default route matches broadly; it does not rescue every failed path

Tue, 14 Sep 2027 00:00:00 +0000

An IPv4 default route is the prefix 0.0.0.0/0: it matches every IPv4 destination, with the least possible specificity. In a selected routing table, a longer matching prefix normally takes precedence. The default is not a procedure that retries whenever a more specific route fails. Routing policy selects relevant tables, and the chosen route describes a forwarding decision rather than promising that the entire round trip will succeed.

When it breaks

A machine without a default can still reach destinations covered by connected or explicit routes. Conversely, adding a default does not prove internet access. The next hop needs to be reachable, forwarding and filtering must permit the traffic, and replies need a return path. A displayed gateway is only one part of that contract; application communication supplies the evidence that the configured path works.

A more specific rejection route wins over a working default. Linux route types such as unreachable intentionally stop forwarding for matching destinations. A failed neighbor lookup through a selected gateway also does not mean the kernel will automatically search for a healthier, less specific path. Static route preference and metrics are not a service-health monitoring or failover system.

Return-path errors are particularly misleading. The client can select the expected gateway and send traffic toward a listening server, yet fail because the server cannot route replies to the client. Repeatedly changing the client’s default may damage working destinations without repairing that missing reverse path. Inspect both directions and the actual source address before attributing every connection timeout to the sender’s gateway.

A route out still needs a route back. Intended source model only. Missing lab prerequisites keep executable acceptance blocked; no retained run is claimed.

Check it quickly

Source review, 2026-10-18: expected results and historical reports below were not rerun; current execution verification remains blocked.

These commands require a documented Linux lab policy permitting nested namespaces and proc mounts. NET_ADMIN and SYS_ADMIN do not override Docker’s built-in AppArmor mount denial. Setup permission failures are not routing results.

Save this as check-default-route.py and run python3 check-default-route.py with Docker. Python 3.11.16 and iproute2 6.1.0 build a client–router–target topology inside one disposable Linux container. NET_ADMIN and SYS_ADMIN support its nested namespaces and temporary proc mount. All interfaces are newly created veth devices, and no port or route is published on the host:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 iputils-ping=3:20221126-1+deb12u1 nftables=1.0.6-2+deb12u2 tcpdump=4.99.3-1 traceroute=1:2.1.2-1 procps=2:4.0.2-3 && rm -rf /var/lib/apt/lists/*\nCMD ["python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,select,signal,subprocess,time

def run(*args,check=True,input=None,timeout=8):
 result=subprocess.run(args,input=input,capture_output=True,text=True,timeout=timeout)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def ns(name,*args,**kwargs):return run('ip','netns','exec',name,*args,**kwargs)
def ip(name,*args,**kwargs):return ns(name,'ip',*args,**kwargs)
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=2)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=2)
def line(process,timeout=3):
 assert select.select([process.stdout],[],[],timeout)[0],'child response deadline exceeded'
 value=process.stdout.readline();assert value,'child exited without a response'
 return value
def spawn(stack,command):
 process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);return process
@contextmanager
def lab(names):
 with TemporaryDirectory(prefix='net-path-') as directory,ExitStack() as stack:
 root=Path(directory);proc=root/'proc';proc.mkdir();run('mount','-t','proc','proc',str(proc))
 stack.callback(run,'umount',str(proc))
 for name in names:
 run('ip','netns','add',name);stack.callback(run,'ip','netns','delete',name,check=False)
 ip(name,'link','set','lo','up')
 def setting(name,key,value):
 assert name in names
 path=proc/'sys'/key.replace('.','/')
 return ns(name,'python3','-c',f'from pathlib import Path; p=Path({str(path)!r}); p.write_text({str(value)!r}); print(p.read_text().strip())').stdout.strip()
 yield root,stack,setting
def wire(left,left_if,right,right_if,left_addresses,right_addresses):
 run('ip','link','add',left_if,'type','veth','peer','name',right_if)
 for name,interface,addresses in [(left,left_if,left_addresses),(right,right_if,right_addresses)]:
 run('ip','link','set',interface,'netns',name)
 for address in addresses:ip(name,'address','add',address,'dev',interface,*(['nodad'] if ':' in address else []))
 ip(name,'link','set',interface,'up')
def nft(name,script):return ns(name,'nft','-f','-',input=script)
def counters(name):
 data=json.loads(ns(name,'nft','-j','list','ruleset').stdout);found={}
 for entry in data['nftables']:
 rule=entry.get('rule',{})
 if 'comment' in rule:
 for expression in rule['expr']:
 if 'counter' in expression:found[rule['comment']]=expression['counter']['packets']
 return found

def server(stack,name,address,port=18080,label='server'):
 code=r'''
from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer
import json,socket,sys
address,port,label=sys.argv[1],int(sys.argv[2]),sys.argv[3]
class Handler(BaseHTTPRequestHandler):
 def do_GET(self):
 body=json.dumps({'server':label,'peer':self.client_address,'path':self.path}).encode()
 self.send_response(200);self.send_header('Content-Length',str(len(body)));self.end_headers();self.wfile.write(body)
 def log_message(self,*args):pass
class Server(ThreadingHTTPServer):
 address_family=socket.AF_INET6 if ':' in address else socket.AF_INET
 def server_bind(self):
 if self.address_family==socket.AF_INET6:self.socket.setsockopt(socket.IPPROTO_IPV6,socket.IPV6_V6ONLY,1)
 super().server_bind()
service=Server((address,port),Handler);print('ready',flush=True);service.serve_forever()
'''
 process=spawn(stack,['ip','netns','exec',name,'python3','-u','-c',code,address,str(port),label])
 assert line(process).strip()=='ready';return process
def request(name,address,port=18080):
 code=r'''
import http.client,json,sys
client=http.client.HTTPConnection(sys.argv[1],int(sys.argv[2]),timeout=.7)
try:
 client.request('GET','/lab-visible-message');response=client.getresponse();body=json.loads(response.read())
 assert response.status==200;print(json.dumps({'ok':True,'status':response.status,'body':body}))
except OSError as error:print(json.dumps({'ok':False,'type':type(error).__name__,'errno':error.errno}))
finally:client.close()
'''
 return json.loads(ns(name,'python3','-c',code,address,str(port)).stdout)

def routed(setting):
 wire('client','c0','router','r0',['10.201.1.2/30'],['10.201.1.1/30'])
 wire('router','r1','target','t0',['10.201.2.1/30'],['10.201.2.2/30'])
 setting('router','net.ipv4.ip_forward',1)
 ip('client','route','add','default','via','10.201.1.1')
 ip('target','route','add','default','via','10.201.2.1')
with lab(['client','router','target']) as (root,stack,setting):
 routed(setting);ip('client','route','delete','default')
 ip('target','addr','add','198.51.100.9/32','dev','lo');ip('router','route','add','198.51.100.9/32','via','10.201.2.2')
 daemon=server(stack,'target','198.51.100.9')
 connected=ns('client','ping','-n','-c','1','-W','1','10.201.1.1');assert connected.returncode==0
 missing=request('client','198.51.100.9');assert not missing['ok'] and missing['errno']==101
 ip('client','route','add','default','via','10.201.1.1')
 chosen=json.loads(ip('client','-j','route','get','198.51.100.9').stdout)[0];assert chosen['gateway']=='10.201.1.1'
 healthy=request('client','198.51.100.9');assert healthy['ok']
 ip('client','route','add','unreachable','198.51.100.9/32')
 specific=request('client','198.51.100.9');assert not specific['ok'] and specific['errno']==113
 ip('client','route','delete','unreachable','198.51.100.9/32')
 recovered=request('client','198.51.100.9');assert recovered['ok']
 ip('target','route','delete','default')
 bad_return=request('client','198.51.100.9');assert not bad_return['ok'] and bad_return['type']=='TimeoutError'
 assert json.loads(ip('client','-j','route','get','198.51.100.9').stdout)[0]['gateway']=='10.201.1.1'
 ip('target','route','add','default','via','10.201.2.1')
 final=request('client','198.51.100.9');assert final['ok']
 print(json.dumps({'connected_ping_without_default':0,'no_default':missing,'chosen_route':chosen,'with_default':healthy,
 'specific_unreachable_route':specific,'specific_removed':recovered,'missing_return_route':bad_return,'return_route_restored':final}))
"""
name='xbcatm-netpath-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN','--cap-add','SYS_ADMIN',
 '--memory','256m','--pids-limit','128',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The client uses 10.201.1.2, with router neighbor 10.201.1.1. The target sits behind the router on another link and owns service address 198.51.100.9 on loopback. The router has a specific route to that service, and the target initially has a return default. The documentation address is used only within this isolated topology; no public server is contacted.

With the client’s default removed, pinging its directly connected router succeeds. An HTTP connection to the remote service fails with Linux ENETUNREACH, errno 101. Adding a default through 10.201.1.1 changes the route lookup to that gateway, and an actual HTTP request returns status 200. This demonstrates both the narrower connectivity that already existed and the additional path enabled by the default.

An unreachable /32 route is then installed for 198.51.100.9. The same connection now fails with EHOSTUNREACH, errno 113, despite the default still being present. Removing that specific route restores HTTP success. The kernel honored the more specific rejection; it did not treat the error as an invitation to fall back to the default gateway.

Next, the script removes only the target’s default route. The client’s lookup still names 10.201.1.1, but a new HTTP attempt reaches its timeout. Restoring the target’s default restores communication. This controlled comparison isolates the return-path dependency while leaving the client’s choice unchanged, providing stronger evidence than a one-sided route listing or an unexplained failed ping.

Inspect the exact flow before editing defaults

Record source address, destination, relevant policy rules, chosen interface, and gateway. A machine with several interfaces or routing tables can make different decisions for different sources, marks, or routing domains. Run diagnostic lookups with the application’s relevant inputs. The fixture uses ordinary destination-based routing and does not claim to reproduce every policy-routing or multipath configuration.

Check the next hop’s link reachability, the router’s forwarding decision, and the target’s route back to the actual source. NAT or a proxy may change which source the target sees. Error classes can guide this work: immediate local network-unreachable errors differ from an explicitly unreachable host route and from a deadline expiring while a reply cannot return. Keep those distinctions in incident evidence.

Defaults are useful because they summarize destinations whose individual routes the host need not know. Configure them deliberately, verify exceptions, and test representative round trips after changes. If automatic failover is required, use a mechanism that observes the relevant path and updates routing appropriately. A second configured gateway or a preferred metric alone does not establish that behavior.

Sources

Linux ip-route(8), default routes, route lookup and unreachable route types, checked 2026-09-12.
RFC 4632 CIDR, longest-prefix matching and route specificity, checked 2026-09-12.
RFC 1812 IPv4 router requirements, IPv4 forwarding and destination reachability, checked 2026-09-12.
Docker AppArmor policy, and built-in profile, mount-policy prerequisite, checked 2026-10-18.

A subnet prefix shapes connected routes; the routing table chooses the path

Mon, 13 Sep 2027 00:00:00 +0000

An IPv4 prefix length says how many leading address bits identify a network. For 192.0.2.5/24, the network is 192.0.2.0/24 and the ordinary broadcast address is 192.0.2.255. Configuring that interface commonly installs a connected route, but the prefix is not the entire routing algorithm. The kernel consults routing policy and route tables to select a path for each destination.

When it breaks

A prefix that is too short can make the host treat remote destinations as directly connected. Keeping address 192.0.2.5 but changing /24 to /16 includes 192.0.3.9 in the connected range. On a real Ethernet segment, that mistaken choice may lead to neighbor resolution for a destination that is not present on the link. An address that looks correct can therefore coexist with a broken next-hop decision.

“Outside my subnet means use the default gateway” is also incomplete. A more specific route can select a different gateway or interface. Within a selected routing table, a longer matching prefix takes precedence over a shorter one. An explicit host route can even override the ordinary connected route for a destination inside the interface’s subnet. Diagnose the actual lookup rather than reconstructing it from the address alone.

Address-count shortcuts need context. An ordinary /24 has network and directed-broadcast addresses that are not usual host assignments, but subtracting two is not universal. RFC 3021 permits both addresses of a /31 point-to-point link as endpoints. A /32 identifies one address. Those cases describe address semantics, not proof that two configured endpoints can exchange packets through the current physical topology.

A longer prefix can override the subnet. Static illustration of the source and its limits. Reported fixture outcomes were not rerun for this graphic.

Check it quickly

Source review, 2026-10-18: expected results and historical reports below were not rerun; current execution verification remains blocked.

Save this as check-subnet.py and run python3 check-subnet.py with Docker. It builds the pinned Python image with iproute2 6.1.0, then grants NET_ADMIN only to a disposable container with no external network attachment. The program creates a dummy interface and changes that container’s routes. It does not alter host interfaces, routes, or a production gateway:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid

recipe='''FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84
RUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 && rm -rf /var/lib/apt/lists/*
'''
program=r'''
from ipaddress import IPv4Address,IPv4Interface,IPv4Network
import json,subprocess
def ip(*args):
 result=subprocess.run(['ip',*args],capture_output=True,text=True,timeout=3)
 assert result.returncode==0,result.stderr
 return result.stdout
def route(address):return json.loads(ip('-j','route','get',address))[0]
interface=IPv4Interface('192.0.2.5/24');network=interface.network
assert str(network.network_address)=='192.0.2.0' and str(network.broadcast_address)=='192.0.2.255'
assert IPv4Address('192.0.2.77') in network and IPv4Address('192.0.3.9') not in network
try:IPv4Network('192.0.2.5/24');raise AssertionError('host bits accepted in strict network')
except ValueError:strict_rejected=True
point_to_point=[str(a) for a in IPv4Network('192.0.2.0/31').hosts()]
assert point_to_point==['192.0.2.0','192.0.2.1']
ip('link','add','lab0','type','dummy');ip('link','set','lab0','up')
ip('address','add','192.0.2.5/24','dev','lab0');ip('route','add','default','via','192.0.2.1','dev','lab0')
ip('route','add','203.0.113.0/24','via','192.0.2.2','dev','lab0')
direct=route('192.0.2.77');specific=route('203.0.113.9');default=route('198.51.100.9');before=route('192.0.3.9')
assert direct['dev']=='lab0' and 'gateway' not in direct
assert specific['gateway']=='192.0.2.2' and default['gateway']==before['gateway']=='192.0.2.1'
ip('route','add','192.0.2.77/32','via','192.0.2.1','dev','lab0');overridden=route('192.0.2.77')
assert overridden['gateway']=='192.0.2.1'
ip('address','del','192.0.2.5/24','dev','lab0');ip('address','add','192.0.2.5/16','dev','lab0')
ip('route','replace','default','via','192.0.2.1','dev','lab0');wrong=route('192.0.3.9')
assert wrong['dev']=='lab0' and 'gateway' not in wrong
print(json.dumps({'interface':str(interface),'network':str(network),'broadcast':str(network.broadcast_address),
 'strict_host_bits_rejected':strict_rejected,'point_to_point_31_hosts':point_to_point,
 'connected':direct,'more_specific_route':specific,'default':default,'host_route_overrides_subnet':overridden,
 'destination_before_widening':before,'destination_after_wrong_16':wrong,'iproute_version':ip('-V').strip()}))
'''
name='xbcatm-subnet-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN',
 '--memory','128m','--pids-limit','64',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

Python distinguishes the interface 192.0.2.5/24 from its network 192.0.2.0/24. Strict network parsing rejects the former because host bits are set. The /31 example enumerates both 192.0.2.0 and 192.0.2.1 as usable endpoints. This calculation establishes the address set; the fixture does not configure a working point-to-point link or test forwarding between those two addresses.

The dummy interface receives 192.0.2.5/24 and a default route through 192.0.2.1. A specific route for 203.0.113.0/24 uses 192.0.2.2. Actual ip route get results choose no gateway for 192.0.2.77, gateway 192.0.2.2 for 203.0.113.9, and the default gateway for 198.51.100.9. The output also records the selected interface and preferred source address.

Adding a /32 route for 192.0.2.77 through 192.0.2.1 changes that destination’s lookup to the gateway, despite its membership in the connected /24. This deliberate override demonstrates why subnet membership and final route selection must be kept separate. The selected table has a more specific instruction for that one destination; there is no requirement to rewrite the interface address to express it.

Before widening the interface prefix, 192.0.3.9 uses the default gateway. After replacing /24 with /16 while keeping 192.0.2.5, the lookup selects the dummy interface directly and no longer includes a gateway. The test asserts this change in the real kernel’s decision. It does not claim successful delivery, an observed ARP failure, or a functioning router beyond the dummy interface.

Check the route before changing the mask

Inspect the effective address and prefix, relevant policy rules, and a route lookup for the exact failing destination. On multihomed systems, include the intended source and other policy inputs when reproducing the lookup. A simple destination-only check can differ from the application’s path when source routing, marks, or separate routing domains are in use. Keep the diagnostic context with the result.

On Ethernet, distinguish resolving the destination’s link address from resolving the selected gateway’s link address. A gateway must be reachable according to the configured link and routing rules; a plausible number in a route file is insufficient. Compare actual neighbor state and packet delivery after confirming the route, rather than treating a displayed next hop as proof that forwarding works.

Plan prefix changes with the connected routes and affected destinations they create or remove. Validate representative local, specifically routed, and default-routed traffic after the change. A mask is an input to routing and address interpretation, not an independent reachability promise. This distinction explains both accidental on-link expansion and legitimate exceptions created by more specific routes.

Sources

RFC 4632 CIDR, classless prefixes and longest-match forwarding, checked 2026-09-12.
RFC 3021 point-to-point /31 links, the two usable endpoint addresses of a /31 link, checked 2026-09-12.
Linux ip-route(8), route lookup, next hops and explicit host routes, checked 2026-09-12.
Python 3.11 ipaddress, interface, network and host-address distinctions, checked 2026-09-12.

BGP is the Internet routing table

Sun, 12 Sep 2027 00:00:00 +0000

BGP exchanges reachability between independently operated networks, but there is no single authoritative Internet forwarding table. Each router learns a policy-filtered view, chooses routes, and attempts to install usable next hops. Two routers can legitimately select different paths to the same prefix. Understanding BGP means separating announcements, selection policy, and packet forwarding rather than treating them as one universal answer.

The AS path carries history and policy

In ordinary eBGP operation, a speaker prepends its AS number when advertising a route externally. A receiver normally excludes paths containing its own AS to avoid inter-AS loops. There are configured exceptions and protocol extensions. Inside an AS, iBGP does not normally add another AS number; its advertisement restrictions and route-reflector rules address a different loop problem.

AS_PATH is also a policy input and a selection attribute. Repeated prepending can make one route less attractive where path length matters, but cannot override another network’s higher-priority local policy. There is no general rule that prepending makes a route fail filtering. Filters must be understood in their actual operator and customer context.

LOCAL_PREF is an attribute distributed to internal BGP peers, normally not to external peers. Weight, where an implementation provides it, is router-local and is not a standard BGP path attribute. Conflating these two controls hides an important distinction: a local preference change can influence decisions across the AS, while a weight change generally affects one router.

Compare the same prefix first

A router’s best-path process compares candidate paths for the same prefix. The exact sequence depends on the implementation and configuration, including eligibility, local policy, AS-path length, MED comparison rules, and next-hop reachability. A vendor’s weight-first list is not the complete protocol definition. MED is commonly compared within the same neighboring AS, with configurable exceptions.

Forwarding then performs longest-prefix matching over the installed destination routes. A /25 and its covering /24 do not compete through the same best-path tie-break list. If both are accepted and installed, the /25 matches its half of the address range even if the /24 has a shorter AS path. Policy routing and other forwarding features require additional inspection.

Table size likewise depends on the observation point, address family, and date. Distinct prefixes, all received paths, and hardware FIB entries are different counts. Aggregation can reduce some advertisements, but multihoming and traffic engineering may require specific routes. An address-only aggregation estimate is not proof that every corresponding policy can be preserved.

When it breaks

An unauthorized origin announcement is a prefix hijack; a route leak exports learned reachability beyond its intended policy scope. They can overlap, but are not synonyms. The hypothetical /25 below illustrates lookup only: real networks may reject it through prefix-length, origin, or customer filters. An unfamiliar more-specific deserves investigation, not an immediate conclusion that an attack is live.

RPKI origin validation checks the announced prefix, authorized origin, and permitted maximum length against validated records. It does not authenticate the entire AS path or determine every export relationship. Valid-origin routes can still be leaked. Combine origin validation with appropriately scoped import and export policy, and monitor changes rather than assuming all updates propagate unchecked.

A healthy session also does not prove successful forwarding installation. Hardware exhaustion, unresolved next hops, or programming failures can leave a control-plane route unusable. Failure behavior varies by platform; software fallback is not guaranteed. Capacity planning must use the device’s actual table partitions, supported features, and installation telemetry, not a universal million-entry threshold.

Two distinct decisions: same-prefix path selection and cross-prefix forwarding lookup. The source fixture holds other conditions equal; it is not a router implementation or geographical shortest-path proof. No fixture was rerun.

Check it quickly

Run this Python 3 fixture with assertions enabled. The first half intentionally models only local preference and AS-path length, with every other selection condition held equal. The second half is an independent forwarding table. It uses documentation addresses and creates no sessions, listeners, or network announcements.

from ipaddress import ip_address, ip_network

paths = [
 {"name": "policy-first", "localpref": 200, "path": [64501, 64502, 64503]},
 {"name": "shorter", "localpref": 100, "path": [64504, 64503]},
]
def choose(candidates):
 return min(candidates, key=lambda p: (-p["localpref"], len(p["path"])))
assert choose(paths)["name"] == "policy-first"
paths[1]["localpref"] = 200
assert choose(paths)["name"] == "shorter"

routes = {ip_network("198.51.100.0/24"): "legitimate",
 ip_network("198.51.100.128/25"): "unexpected"}
def forward(address):
 matches = [p for p in routes if ip_address(address) in p]
 return routes[max(matches, key=lambda p: p.prefixlen)]
assert forward("198.51.100.20") == "legitimate"
assert forward("198.51.100.200") == "unexpected"
print("same prefix: local preference first, then path length")
print("different prefixes: lower half legitimate, upper half unexpected")

The longer path wins until local preference is equalized; then the shorter path wins. Separately, the lower address selects the legitimate /24, and the upper address selects the unexpected /25. These results explain two different decisions without claiming to implement a router. Real diagnosis must correlate received and advertised paths, selected routes, hardware installation, and permitted-client probes.

Sources

RFC 4271 BGP-4, the decision process and AS path loop detection, checked 2026-09-16.
RFC 6811 prefix origin validation, what RPKI validation does and does not prove, checked 2026-09-16.
RFC 7908 route leaks, the problem statement for leaked announcements, checked 2026-09-16.
CIDR Report, current IPv4 table size and per-AS more-specific counts, checked 2026-09-16.
FRR BGP path selection, implementation-specific selection controls and diagnostics, checked 2026-10-15.

The TCP handshake establishes sequence spaces, not synchronized clocks

Fri, 10 Sep 2027 00:00:00 +0000

The TCP three-way handshake establishes the two directions of a byte stream. Each endpoint supplies an initial sequence number and acknowledges the other endpoint’s number. Those are independent sequence spaces, not a shared wall clock. Applications do not need synchronized machine clocks to connect. Later sequence numbers identify bytes and support ordering, duplicate handling, acknowledgments, and retransmission within that connection.

Ordinary setup and the controlled loss case are shown; 32-bit sequence numbers wrap. Connect success does not prove application readiness.

When it breaks

A client sends SYN with its initial sequence number. The server returns SYN-ACK containing its own initial number and acknowledging the client’s SYN. The client acknowledges that response. SYN consumes one position in sequence space, so its acknowledgment advances by one even when the segment contains no application data. Treating these values as timestamps produces incorrect packet interpretations and can send an investigation toward unrelated clock synchronization.

The two endpoints do not change state at exactly the same instant. A client’s connect call can succeed after receiving SYN-ACK while its final acknowledgment is lost before reaching the server. The server can remain in SYN-RECEIVED, displayed as SYN-RECV by Linux tools. Subsequent data carrying an appropriate acknowledgment can also complete the exchange, so a missing standalone third packet does not inevitably cause permanent failure.

Successful TCP setup establishes neither application health nor peer authentication. A service might accept connections but never produce a valid response. A proxy may complete one TCP connection while failing to establish its separate upstream connection. Likewise, sequence-number selection helps protect connection incarnations and resist prediction attacks, but it is not an authentication protocol and does not encrypt the stream.

Check it quickly

Save this as check-tcp-handshake.py and run python3 check-tcp-handshake.py with Docker. The disposable container uses Python 3.11.16, iproute2 6.1.0, nftables 1.0.6, and tcpdump 4.99.3, tested with Linux 6.12.76. NET_ADMIN and SYS_ADMIN support its nested network namespaces. A newly created veth joins the client and target, with no host interfaces or published ports involved:

The environment and numerical outcomes below are inherited article reports, not independently reproduced here. The image does not pin the host kernel or package availability.

The revised reader retains byte chunks from unbuffered pipes and consumes complete buffered lines before waiting for readiness. One deadline covers each line, including fragmented arrivals; EOF, malformed text and oversized lines fail explicitly. Synthetic tests cover queued and delayed statuses, timeouts and cleanup calls. They do not establish actual pipe scheduling, process cleanup or network behavior: an authorized integrated rerun is still required. A child-status timeout alone is not a TCP diagnosis.

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 iputils-ping=3:20221126-1+deb12u1 nftables=1.0.6-2+deb12u2 tcpdump=4.99.3-1 traceroute=1:2.1.2-1 procps=2:4.0.2-3 && rm -rf /var/lib/apt/lists/*\nCMD ["python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,select,signal,subprocess,time

def run(*args,check=True,input=None,timeout=8):
 result=subprocess.run(args,input=input,capture_output=True,text=True,timeout=timeout)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def ns(name,*args,**kwargs):return run('ip','netns','exec',name,*args,**kwargs)
def ip(name,*args,**kwargs):return ns(name,'ip',*args,**kwargs)
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=2)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=2)
class DeadlineLines:
 def __init__(self,read_chunk,wait_readable,now,limit=65536):
 self.read_chunk=read_chunk;self.wait_readable=wait_readable;self.now=now
 self.pending=bytearray();self.eof=False;self.limit=limit
 def read(self,timeout):
 deadline=self.now()+timeout
 while True:
 end=self.pending.find(b'\n')
 if end>=0:
 if end+1>self.limit:raise ValueError('child status line too long')
 value=bytes(self.pending[:end+1]);del self.pending[:end+1]
 return value.decode('utf-8')
 if len(self.pending)>self.limit:raise ValueError('child status line too long')
 if self.eof:raise EOFError(('child status EOF before newline',bytes(self.pending[:160])))
 remaining=deadline-self.now()
 if remaining<=0 or not self.wait_readable(remaining):
 raise TimeoutError('child status deadline exceeded; this is not a TCP diagnosis')
 chunk=self.read_chunk(4096)
 if not chunk:self.eof=True
 else:self.pending.extend(chunk)
def reader(stream):
 # Only use this with an unbuffered binary pipe, with no other reader.
 return DeadlineLines(stream.read,lambda timeout:bool(select.select([stream],[],[],timeout)[0]),time.monotonic)
def line(process,timeout=3):return process.status.read(timeout)
def spawn(stack,command):
 process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,bufsize=0)
 for stream in (process.stdin,process.stdout,process.stderr):stack.callback(stream.close)
 stack.callback(stop,process);process.status=reader(process.stdout);return process
@contextmanager
def lab(names):
 with TemporaryDirectory(prefix='net-path-') as directory,ExitStack() as stack:
 root=Path(directory);proc=root/'proc';proc.mkdir();run('mount','-t','proc','proc',str(proc))
 stack.callback(run,'umount',str(proc))
 for name in names:
 run('ip','netns','add',name);stack.callback(run,'ip','netns','delete',name,check=False)
 ip(name,'link','set','lo','up')
 def setting(name,key,value):
 assert name in names
 path=proc/'sys'/key.replace('.','/')
 return ns(name,'python3','-c',f'from pathlib import Path; p=Path({str(path)!r}); p.write_text({str(value)!r}); print(p.read_text().strip())').stdout.strip()
 yield root,stack,setting
def wire(left,left_if,right,right_if,left_addresses,right_addresses):
 run('ip','link','add',left_if,'type','veth','peer','name',right_if)
 for name,interface,addresses in [(left,left_if,left_addresses),(right,right_if,right_addresses)]:
 run('ip','link','set',interface,'netns',name)
 for address in addresses:ip(name,'address','add',address,'dev',interface,*(['nodad'] if ':' in address else []))
 ip(name,'link','set',interface,'up')
def nft(name,script):return ns(name,'nft','-f','-',input=script)
def counters(name):
 data=json.loads(ns(name,'nft','-j','list','ruleset').stdout);found={}
 for entry in data['nftables']:
 rule=entry.get('rule',{})
 if 'comment' in rule:
 for expression in rule['expr']:
 if 'counter' in expression:found[rule['comment']]=expression['counter']['packets']
 return found


def capture(stack,root,name,interface,expression,label):
 path=root/(label+'.pcap')
 process=subprocess.Popen(['ip','netns','exec',name,'tcpdump','--immediate-mode','-Z','root','-U','-n','-i',interface,'-w',str(path),expression],
 stdout=subprocess.DEVNULL,stderr=subprocess.PIPE,bufsize=0)
 stack.callback(process.stderr.close);stack.callback(stop,process);messages=reader(process.stderr)
 deadline=time.monotonic()+3
 while time.monotonic()<deadline:
 assert process.poll() is None,'tcpdump exited before listening'
 if 'listening on' in messages.read(max(0,deadline-time.monotonic())):return process,path
 raise AssertionError('tcpdump did not become ready')
def packets(process,path):
 import struct,socket
 process.send_signal(signal.SIGINT);_,diagnostic=process.communicate(timeout=3)
 assert process.returncode==0,diagnostic
 raw=path.read_bytes();assert raw[:4]==bytes.fromhex('d4c3b2a1') and struct.unpack_from('<I',raw,20)[0]==1
 offset=24;result=[]
 while offset<len(raw):
 seconds,micros,size,original=struct.unpack_from('<IIII',raw,offset);offset+=16
 frame=raw[offset:offset+size];offset+=size
 if frame[12:14]!=b'\x08\x00' or frame[23]!=6:continue
 ihl=(frame[14]&15)*4;length=struct.unpack_from('!H',frame,16)[0];tcp=14+ihl
 sport,dport,seq,ack=struct.unpack_from('!HHII',frame,tcp);header=(frame[tcp+12]>>4)*4
 opts={};cursor=tcp+20
 while cursor<tcp+header:
 kind=frame[cursor]
 if kind==0:break
 if kind==1:cursor+=1;continue
 option_length=frame[cursor+1];data=frame[cursor+2:cursor+option_length];assert option_length>=2
 if kind==2:opts['mss']=struct.unpack('!H',data)[0]
 elif kind==3:opts['wscale']=data[0]
 elif kind==4:opts['sack_ok']=True
 elif kind==5:opts['sack']=[list(pair) for pair in struct.iter_unpack('!II',data)]
 cursor+=option_length
 body=frame[tcp+header:14+length]
 result.append({'t':seconds+micros/1e6,'src':socket.inet_ntoa(frame[26:30]),'dst':socket.inet_ntoa(frame[30:34]),
 'sport':sport,'dport':dport,'seq':seq,'ack':ack,'flags':frame[tcp+13],'window':struct.unpack_from('!H',frame,tcp+14)[0],
 'length':len(body),'options':opts,'preview':body[:24].hex()})
 return result
with lab(['client','target']) as (root,stack,setting):
 wire('client','c0','target','t0',['192.0.2.1/30'],['192.0.2.2/30'])
 server_code=r'''
import socketserver
class Handler(socketserver.StreamRequestHandler):
 def handle(self):
 data=self.rfile.readline();self.wfile.write(b'echo:'+data);self.wfile.flush()
class Server(socketserver.ThreadingTCPServer):allow_reuse_address=True;daemon_threads=True
server=Server(('192.0.2.2',18080),Handler);print('ready',flush=True);server.serve_forever()
'''
 service=spawn(stack,['ip','netns','exec','target','python3','-u','-c',server_code]);assert line(service).strip()=='ready'
 tap,path=capture(stack,root,'client','c0','tcp port 18080','handshake')
 normal=ns('client','python3','-c',
 'import socket; s=socket.socket();s.settimeout(2);s.bind(("192.0.2.1",40100));s.connect(("192.0.2.2",18080));s.sendall(b"normal\\n");print(s.makefile("rb").readline().decode().strip());s.close()')
 assert normal.stdout.strip()=='echo:normal'
 nft('client','''table ip missing_ack {
 chain output { type filter hook output priority 0; policy accept;
 tcp dport 18080 tcp flags & (syn|ack|rst|fin) == ack counter drop comment "missing_final_ack"
 }
}
''')
 client_code=r'''
import json,socket,sys
s=socket.socket();s.settimeout(.25);s.bind(('192.0.2.1',40101));s.connect(('192.0.2.2',18080))
print(json.dumps({'connect_returned':True}),flush=True);s.sendall(b'deferred\n')
try:s.recv(64);raise AssertionError('unexpected application response')
except TimeoutError:print(json.dumps({'application_timeout':True}),flush=True)
assert sys.stdin.readline().strip()=='restore';s.settimeout(5)
received=b''
while not received.endswith(b'\n'):
 chunk=s.recv(64);assert chunk,'premature EOF';received+=chunk
assert received==b'echo:deferred\n',received
print(json.dumps({'recovered':received.decode().strip()}),flush=True);s.close()
'''
 client=spawn(stack,['ip','netns','exec','client','python3','-u','-c',client_code])
 connected=json.loads(line(client));failure=json.loads(line(client));assert connected['connect_returned'] and failure['application_timeout']
 pending=ns('target','ss','-nHt','state','syn-recv').stdout;assert '192.0.2.1:40101' in pending,pending
 blocked=counters('client');assert blocked['missing_final_ack']>0
 nft('client','delete table ip missing_ack');assert client.stdin.write(b'restore\n')==8;client.stdin.flush()
 recovery=json.loads(line(client,6));assert recovery['recovered']=='echo:deferred'
 client.wait(timeout=2);assert client.returncode==0
 observed=packets(tap,path);flow=[p for p in observed if 40100 in (p['sport'],p['dport'])]
 syn=next(p for p in flow if p['flags']&0x12==0x02)
 synack=next(p for p in flow if p['flags']&0x12==0x12)
 third=next(p for p in flow if p['sport']==40100 and p['flags']&0x12==0x10)
 assert synack['ack']==(syn['seq']+1)%2**32
 assert third['seq']==(syn['seq']+1)%2**32 and third['ack']==(synack['seq']+1)%2**32
 print(json.dumps({'three_messages':[syn,synack,third],'normal_reply':normal.stdout.strip(),
 'client_connect_returned':connected['connect_returned'],'application_timeout':failure['application_timeout'],
 'server_still_syn_recv':pending.strip(),'drop_counters':blocked,'after_ack_filter_removed':recovery}))
"""
name='xbcatm-tcpflow-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN','--cap-add','SYS_ADMIN',
 '--memory','256m','--pids-limit','128',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The first connection uses client port 40100 and target port 18080. It sends a newline-terminated request and receives the expected echo. A packet capture supplies the actual SYN, SYN-ACK, and final ACK values. Assertions check that SYN-ACK acknowledges the client’s sequence plus one and that the third message acknowledges the server’s sequence plus one, using modulo arithmetic for the 32-bit sequence space.

The second connection uses client port 40101. An output filter in the client namespace drops ACK-bearing packets without SYN, FIN, or RST, including the final acknowledgment and subsequent data. Blocking that data matters: otherwise a later data segment could acknowledge the SYN-ACK and repair the intentionally missing third message. The example therefore makes the intended asymmetric state observable instead of relying on a narrow timing accident.

The client reports that connect returned successfully, but its application read reaches a deadline. At the same point, the server’s socket listing shows that exact client tuple in SYN-RECV. A rule counter confirms dropped packets. These independent observations establish the distinction between the client’s local API result, the server’s protocol state, and the failed application exchange.

Removing the filter lets the same connection finish the exchange and deliver the queued request. The client receives echo:deferred; it does not create a replacement socket to hide the original failure. Framed reads accumulate the response rather than assuming one recv call always returns the entire application message. The test verifies both the temporary failure and recovery after its controlled cause is removed.

Diagnose setup separately from useful service

Record the four-tuple, namespace, capture point, and state on each endpoint. A reset, repeated SYN, repeated SYN-ACK, and a completed handshake followed by an application timeout suggest different next checks. Capture both directions when possible: an outgoing acknowledgment visible locally is not proof that the remote endpoint received it. The fixture’s counter and remote socket state supply that missing context.

For service validation, follow the transport connection with a meaningful request and inspect its response. For identity and confidentiality, use the appropriate authenticated protocol above TCP. This exercise covers an ordinary connection without Fast Open or simultaneous open, and does not claim every valid connection begins with exactly three separately visible packets. Its central check is the sequence and state relationship, not a simplistic packet-count rule.

Sources

RFC 9293 TCP, sequence numbers, connection states and the three-way handshake, checked 2026-09-12.
Linux tcp(7), TCP socket behavior and Linux-specific controls, checked 2026-09-12.
Linux ss(8), examining established and SYN-RECV sockets, checked 2026-09-12.
Python 3.11 subprocess, unbuffered binary pipes; real process integration remains untested, checked 2026-10-19.

DHCP lends the address until it expires

Tue, 07 Sep 2027 00:00:00 +0000

Dynamic DHCPv4 allocation lends an address for a lease period. Renewal can extend that period; expiry permits reuse. DHCP also supports other allocation policies, so a finite dynamic lease is the scope of this article, not the only configuration DHCP can deliver.

Borrow a number, not own it

A newly initializing client discovers servers, selects an offer, and requests configuration. The acknowledged lease records how long it may use the address. A lease database tracks assignments, but cannot guarantee that every machine follows the protocol: unmanaged static addresses, overlapping pools, lost server state, or unauthorized servers can still create conflicts. An address assignment is not proof of a device’s identity or a substitute for access control.

Renewal keeps the lease alive

During a finite lease the client normally renews with the original server at T1. If it receives no acknowledgment by T2, it broadcasts a rebinding request that other suitable servers may answer. Defaults are half and seven-eighths of the lease duration; servers may provide different valid timers. RFC 2131 recommends random variation to reduce synchronization. The acknowledgment sets expiry from the renewal request’s send time plus the granted duration. Later T1 and T2 deadlines follow the renewed lease, not the original acquisition.

Renewal often preserves the address but does not guarantee permanent identity across reboots, moves, or policy changes. A shorter lease can reclaim departed clients’ addresses sooner while increasing renewal load; a longer lease gives clients more time to survive an outage but holds unused assignments longer. Fixed-address requirements call for an explicit allocation policy, rather than assuming an arbitrarily long dynamic lease will suffice.

Reclaim what is not used

A client can release an address, but a server must also handle clients that disappear silently. Once the lease expires, the client must stop using the address and restart configuration; the server may allocate it again. A returning device may receive its old address or a different one. Deleting a binding administratively does not revoke a live client’s belief that its lease remains valid, so clearing leases is not a safe substitute for resolving conflicts.

When it breaks

Pool exhaustion may leave a discover unanswered. A NAK has context-specific meaning, such as rejecting an inappropriate requested address; it is not a universal “pool full” response. Some clients configure IPv4 link-local addresses after DHCP failure, but this is separate behavior and does not identify the cause. Check the pool, relay path, and server logs before changing capacity or retries.

Very short leases increase renewal load and reduce outage tolerance. Simultaneous client starts can concentrate traffic, but not every fleet renews in lockstep. Review configured timers and retry behavior instead of treating the default fractions as mandatory tuning values. Lengthening new leases also does not retroactively change already acknowledged leases.

A rogue server can supply an unwanted router or resolver. Selecting the first offer is one possible client policy, not a universal rule. The server-identifier option is not cryptographic authentication and can be spoofed. Network controls such as DHCP snooping must trust the correct switch ports and relay path; merely remembering a server identifier does not establish that trust.

Sleep and clock handling can expose stale configuration. A device waking after expiry must reacquire configuration before resuming use, not blindly keep the address or assume it is merely at T2. Inspect elapsed lease time and implementation logs; wall-clock synchronization alone does not prove correct timer behavior. Conflict detection and DECLINE handling remain separate safeguards.

Finite dynamic leases only. Default T1 and T2 fractions are not universal tuning guarantees. The categorical timeline and renewal formula are explanatory; no DHCP packets or complete client state machine were tested.

Check it quickly

Save this as dhcp_lease_sim.py and run python3 dhcp_lease_sim.py. It uses a virtual clock and a simplified in-memory server. Unicast and broadcast are scenario labels, not transmitted packets; it checks timer arithmetic and address ownership, not a complete DHCP client state machine. Requests and acknowledgments are instantaneous here; T2 is truncated to whole seconds.

"""Simulate a DHCP lease lifecycle on a virtual clock (stdlib only)."""
from __future__ import annotations

LEASE_TIME = 100
T1 = LEASE_TIME // 2 # 50: unicast renewal (RFC 2131 default)
T2 = int(LEASE_TIME * 0.875) # 87: broadcast rebinding (RFC 2131 default)


class DHCPServer:
 def __init__(self, pool):
 self.pool = list(pool)
 self.leases: dict[str, dict] = {} # ip -> {"client": id, "expiry": int}
 self.now = 0

 def _free_ip(self):
 for ip in self.pool:
 lease = self.leases.get(ip)
 if lease is None or lease["expiry"] <= self.now:
 return ip
 return None

 def discover_offer(self, client_id):
 """DISCOVER -> OFFER (no state change)."""
 ip = self._free_ip()
 assert ip is not None, f"t={self.now}: pool exhausted, no OFFER for {client_id}"
 return ip

 def request_ack(self, client_id, ip):
 """REQUEST -> ACK and bind the lease."""
 assert ip in self.pool, "requested address outside pool"
 lease = self.leases.get(ip)
 assert lease is None or lease["expiry"] <= self.now or lease["client"] == client_id, \
 f"t={self.now}: {ip} held by another client"
 self.leases[ip] = {"client": client_id, "expiry": self.now + LEASE_TIME}
 return {"ip": ip, "lease_time": LEASE_TIME, "t1": T1, "t2": T2,
 "expiry": self.now + LEASE_TIME}

 def renew(self, client_id, ip):
 """Extend a current lease; transport and client states are not modeled."""
 lease = self.leases.get(ip)
 if lease is None or lease["client"] != client_id or lease["expiry"] <= self.now:
 return False # expired: server already reclaimed
 lease["expiry"] = self.now + LEASE_TIME
 return True

 def tick(self, dt):
 self.now += dt
 # Reclaim expired leases so a new client can reuse them.
 for ip, lease in list(self.leases.items()):
 if lease["expiry"] <= self.now:
 del self.leases[ip]


def check(cond, msg):
 assert cond, msg


def main():
 server = DHCPServer(["192.168.1.10", "192.168.1.11"])
 # 1. DORA: client c1 joins.
 offered = server.discover_offer("c1")
 check(offered == "192.168.1.10", f"expected first free IP, got {offered}")
 ack = server.request_ack("c1", offered)
 check((ack["lease_time"], ack["t1"], ack["t2"]) == (100, 50, 87), f"bad timers: {ack}")
 check(ack["expiry"] == 100, f"expiry should be 0+100, got {ack['expiry']}")
 print(f"t={server.now}: c1 ACK {ack['ip']} lease=100 T1=50 T2=87 expiry=100")
 # 2. T1 unicast renewal at half lease.
 server.tick(T1) # now=50
 check(server.renew("c1", offered), "T1 renewal should be ACKed")
 check(server.leases[offered]["expiry"] == 150, "T1 must extend expiry to 50+100")
 print(f"t={server.now}: c1 T1 unicast renew OK expiry=150")
 # 3. Miss T1, rebind at T2 via broadcast.
 server.tick(T1) # now=100: renewed T1; pretend this attempt got no ACK
 server.tick(T2 - T1) # now=137: renewed T2, before expiry 150
 check(server.now == 50 + T2, "rebind must use renewed lease origin")
 check(server.renew("c1", offered), "T2 rebinding should be ACKed")
 check(server.leases[offered]["expiry"] == 237, "T2 must extend expiry to 137+100")
 print(f"t={server.now}: c1 T2 broadcast rebind OK expiry=237")
 # 4. Leave without renewing: expiry reclaims the address.
 server.tick(200) # now=337 > expiry 237
 check(offered not in server.leases, "expired lease must be reclaimed")
 offered2 = server.discover_offer("c2")
 check(offered2 == offered, f"reclaimed {offered} should be reused, got {offered2}")
 ack2 = server.request_ack("c2", offered2)
 check(ack2["expiry"] == server.now + LEASE_TIME, "new lease expiry must restart")
 # Stale renewal from the departed client must fail.
 check(not server.renew("c1", offered), "stale renewal after expiry must not be ACKed")
 print(f"t={server.now}: c1 expired, c2 ACK {ack2['ip']} expiry={ack2['expiry']}")
 print("PASS: discover/offer/request/ack, T1 renew, T2 rebind, expiry reclaim")


if __name__ == "__main__":
 main()

The script asserts the first free address is offered, the ACK carries a 100-second lease with T1 at 50 and T2 at 87, each renewal resets expiry to the renewal time plus the lease duration, and the departed address is reclaimed for a second client while the stale renewal fails. Expect four timestamped lines plus a PASS line covering offer, renewal, rebinding, and reclaim.

An earlier version recorded a Python 3.12/macOS pass, but labeled a request at time 107 as T2 even though the renewed T2 was 137. The corrected sequence passes on Python 3.12.14: times 0, 50, 137, and 337, with renewed expiry 237. A real daemon still requires packet, pool, and client-expiry checks.

Sources

IETF: RFC 2131 DHCP, the authoritative lease lifecycle: DISCOVER, OFFER, REQUEST, ACK with T1 and T2 renewal timers, checked 2026-10-19.
ISC: ISC DHCP, legacy implementation resources and the vendor’s end-of-maintenance notice, checked 2026-10-19.
Wikipedia: Dynamic Host Configuration Protocol, a readable overview of the lease lifecycle, checked 2026-10-19.

MSS clamping can repair one TCP path without repairing its MTU feedback

Sun, 24 Jan 2027 00:00:00 +0000

TCP’s Maximum Segment Size option advertises the receiving endpoint’s maximum TCP data size under the option’s defined accounting rules. Each direction has its own advertisement; the two values need not match. A router can reduce those advertisements while forwarding SYN messages so later data segments fit a constrained path. That changes TCP behavior for the affected connections, not the underlying link MTU itself.

Clamping changes TCP advertisements for new connections. It leaves the link MTU and missing ICMP feedback unchanged; preserve smaller peer limits and verify each direction.

When it breaks

An intermediate bottleneck can be smaller than either endpoint interface. If classic path-MTU feedback is filtered, a connection may establish successfully and then stall on larger data. Reducing MSS can help that TCP flow avoid the oversized packets, but the missing feedback remains missing. Treating the workaround as a complete network repair leaves other protocols and traffic patterns exposed to the original limitation.

MSS is not the full IP packet size. For an IPv4 path MTU of 1280 with ordinary twenty-byte IPv4 and TCP base headers, an advertised MSS of 1240 follows the basic calculation. Actual IP or TCP options require additional allowance when forming data segments. Confusing the advertisement with a final wire-packet length can make a seemingly conservative value too large.

Direction and timing matter too. Editing only one SYN direction leaves the other endpoint’s advertisement unchanged. Updating a rule does not rewrite options already exchanged by existing connections. A clamp should reduce an excessive advertisement, not raise a peer’s already smaller limit. Scope such policy to the real bottleneck and relevant flow instead of treating one hard-coded value as suitable for every network.

Check it quickly

Save this as check-mss-clamp.py and run python3 check-mss-clamp.py with Docker. The disposable environment uses Python 3.11.16, iproute2 6.1.0, nftables 1.0.6, and tcpdump 4.99.3, tested on Linux 6.12.76. NET_ADMIN and SYS_ADMIN enable four nested namespaces. Endpoint links have MTU 1500; the link between two routers has MTU 1280:

The environment and numerical outcomes below are inherited article reports, not independently reproduced here. The image does not pin the host kernel or package availability.

Startup retains unbuffered diagnostic and listening lines before checking readiness; synthetic tests leave actual pipe, process and capture behavior unverified.

from pathlib import Path
from tempfile import TemporaryDirectory
import subprocess,json,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 iputils-ping=3:20221126-1+deb12u1 nftables=1.0.6-2+deb12u2 tcpdump=4.99.3-1 traceroute=1:2.1.2-1 procps=2:4.0.2-3 && rm -rf /var/lib/apt/lists/*\nCMD ["python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,re,select,signal,subprocess,time
def run(*args,check=True,input=None,timeout=8):
 result=subprocess.run(args,input=input,capture_output=True,text=True,timeout=timeout)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def ns(name,*args,**kwargs):return run('ip','netns','exec',name,*args,**kwargs)
def ip(name,*args,**kwargs):return ns(name,'ip',*args,**kwargs)
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=2)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=2)
def spawn(stack,command):
 process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);return process
def line(process,timeout=3):
 assert select.select([process.stdout],[],[],timeout)[0],'child response deadline exceeded'
 value=process.stdout.readline();assert value,process.stderr.read();return value
@contextmanager
def lab():
 with TemporaryDirectory(prefix='mtu-path-') as directory,ExitStack() as stack:
 root=Path(directory);proc=root/'proc';proc.mkdir();run('mount','-t','proc','proc',str(proc));stack.callback(run,'umount',str(proc))
 for name in ['client','r1','r2','target']:
 run('ip','netns','add',name);stack.callback(run,'ip','netns','delete',name,check=False);ip(name,'link','set','lo','up')
 def setting(name,key,value):
 assert name in ['client','r1','r2','target']
 path=proc/'sys'/key.replace('.','/')
 ns(name,'python3','-c',f'from pathlib import Path; p=Path({str(path)!r});p.write_text({str(value)!r});assert p.read_text().strip()=={str(value)!r}')
 yield root,stack,setting
def topology(setting,ipv6=False):
 links=[('client','c0','r1','a0',1,2,1,1500),('r1','a1','r2','b0',2,1,2,1280),('r2','b1','target','t0',3,1,2,1500)]
 for left,left_if,right,right_if,network,left_host,right_host,mtu in links:
 run('ip','link','add',left_if,'type','veth','peer','name',right_if)
 for name,interface,host in [(left,left_if,left_host),(right,right_if,right_host)]:
 run('ip','link','set',interface,'netns',name);ip(name,'link','set',interface,'mtu',str(mtu))
 address=f'2001:db8:{network}::{host}/64' if ipv6 else f'10.210.{network}.{host}/30'
 ip(name,'addr','add',address,'dev',interface,*(['nodad'] if ipv6 else []));ip(name,'link','set',interface,'up')
 family='-6' if ipv6 else '-4'
 for name in ['r1','r2']:setting(name,'net.ipv6.conf.all.forwarding' if ipv6 else 'net.ipv4.ip_forward',1)
 routes=[('client','default','2001:db8:1::1' if ipv6 else '10.210.1.1'),('target','default','2001:db8:3::1' if ipv6 else '10.210.3.1'),
 ('r1','2001:db8:3::/64' if ipv6 else '10.210.3.0/30','2001:db8:2::2' if ipv6 else '10.210.2.2'),
 ('r2','2001:db8:1::/64' if ipv6 else '10.210.1.0/30','2001:db8:2::1' if ipv6 else '10.210.2.1')]
 for name,destination,gateway in routes:ip(name,family,'route','add',destination,'via',gateway)
 if ipv6:
 deadline=time.monotonic()+4
 while any('tentative' in ip(name,'-6','address','show').stdout for name in ['client','r1','r2','target']):
 assert time.monotonic()<deadline,'IPv6 link-local DAD did not finish';time.sleep(.02)
def nft(name,script):return ns(name,'nft','-f','-',input=script)
def counters(name):
 result={}
 for item in json.loads(ns(name,'nft','-j','list','ruleset').stdout)['nftables']:
 rule=item.get('rule',{})
 if 'comment' in rule:
 for expression in rule['expr']:
 if 'counter' in expression:result[rule['comment']]=expression['counter']['packets']
 return result
class DeadlineLines:
 def __init__(self,read_chunk,wait_readable,now,limit=65536):
 self.read_chunk=read_chunk;self.wait_readable=wait_readable;self.now=now
 self.pending=bytearray();self.eof=False;self.limit=limit
 def read(self,timeout):
 deadline=self.now()+timeout
 while True:
 end=self.pending.find(b'\n')
 if end>=0:
 if end+1>self.limit:raise ValueError('child status line too long')
 value=bytes(self.pending[:end+1]);del self.pending[:end+1]
 return value.decode('utf-8')
 if len(self.pending)>self.limit:raise ValueError('child status line too long')
 if self.eof:raise EOFError(('child status EOF before newline',bytes(self.pending[:160])))
 remaining=deadline-self.now()
 if remaining<=0 or not self.wait_readable(remaining):
 raise TimeoutError('child status deadline exceeded; this is not a TCP diagnosis')
 chunk=self.read_chunk(4096)
 if not chunk:self.eof=True
 else:self.pending.extend(chunk)
def reader(stream):
 # Only use this with an unbuffered binary pipe, with no other reader.
 return DeadlineLines(stream.read,lambda timeout:bool(select.select([stream],[],[],timeout)[0]),time.monotonic)
def capture(stack,root,name,interface,expression,label):
 path=root/(label+'.pcap')
 process=subprocess.Popen(['ip','netns','exec',name,'tcpdump','--immediate-mode','-Z','root','-U','-n','-i',interface,'-w',str(path),expression],
 stdout=subprocess.DEVNULL,stderr=subprocess.PIPE,bufsize=0)
 stack.callback(process.stderr.close);stack.callback(stop,process);messages=reader(process.stderr)
 deadline=time.monotonic()+3
 while time.monotonic()<deadline:
 assert process.poll() is None,'tcpdump exited before listening'
 if 'listening on' in messages.read(max(0,deadline-time.monotonic())):return process,path
 raise AssertionError('tcpdump did not become ready')
def captured(process,path):
 process.send_signal(signal.SIGINT);_,diagnostic=process.communicate(timeout=3);assert process.returncode==0,diagnostic
 return run('tcpdump','-nn','-tt','-S','-r',str(path)).stdout

def advertisement(trace,source,destination,acknowledges):
 # This deliberately accepts only the pinned tcpdump IPv4 SYN display.
 prefix=re.compile(r'^\S+ IP '+re.escape(source)+r' > '+re.escape(destination)+r': Flags \[([^]]+)\], (.*)$')
 values=set()
 for row in trace.splitlines():
 match=prefix.fullmatch(row)
 if not match:continue
 flags,fields=match.groups()
 if 'S' not in flags:continue
 assert set(flags)<=set('S.EW') and ('.' in flags)==acknowledges,('unexpected SYN flags',row)
 assert '[|' not in row and '[bad' not in row,('incomplete SYN',row)
 seq=re.findall(r'(?:^|, )seq (\d+)(?=,|$)',fields)
 ack=re.findall(r'(?:^|, )ack (\d+)(?=,|$)',fields)
 options=re.findall(r'(?:^|, )options \[([^]]*)\](?=,|$)',fields)
 assert len(seq)==1 and len(ack)==int(acknowledges) and len(options)==1,('missing/ambiguous SYN fields',row)
 mss=re.findall(r'(?:^|,)mss (\d+)(?=,|$)',options[0])
 assert len(mss)==1 and re.search(r'(?:^|, )length 0$',fields),('invalid MSS or SYN payload',row)
 value=(int(seq[0]),int(ack[0]) if ack else None,int(mss[0]))
 assert 0<=value[0]<2**32 and (value[1] is None or 0<=value[1]<2**32),row
 assert 0<value[2]<=1240,('unclamped advertisement',row)
 values.add(value)
 assert len(values)==1,('missing or inconsistent handshake',source,destination,values)
 seq,ack,mss=values.pop()
 return {'source':source,'destination':destination,'seq':seq,'ack':ack,'mss':mss}
def verify_advertisements(target_trace,client_trace,port):
 client=f'10.210.1.2.{port}';target='10.210.3.2.18080'
 syn=advertisement(target_trace,client,target,False)
 synack=advertisement(client_trace,target,client,True)
 assert synack['ack']==(syn['seq']+1)%2**32,('unrelated SYN-ACK',syn,synack)
 return {'syn_at_target':syn,'synack_at_client':synack}



def server(stack):
 code=r'''
import socketserver,hashlib
class Handler(socketserver.StreamRequestHandler):
 def handle(self):
 self.request.settimeout(3)
 header=self.rfile.readline()
 if not header:return
 length=int(header);data=self.rfile.read(length)
 if len(data)!=length:return
 self.wfile.write(hashlib.sha256(data).hexdigest().encode()+b'\n');self.wfile.flush()
class Server(socketserver.ThreadingTCPServer):allow_reuse_address=True;daemon_threads=True
service=Server(('10.210.3.2',18080),Handler);print('ready',flush=True);service.serve_forever()
'''
 process=spawn(stack,['ip','netns','exec','target','python3','-u','-c',code]);assert line(process).strip()=='ready'
def transfer(size,port):
 code=r'''
import socket,json,hashlib,sys,struct
size=int(sys.argv[1]);stream=socket.socket();stream.settimeout(1.5);connected=False
try:
 stream.bind(('10.210.1.2',int(sys.argv[2])));stream.connect(('10.210.3.2',18080));connected=True
 stream.sendall(str(size).encode()+b'\n'+b'x'*size)
 with stream.makefile('rb') as incoming:reply=incoming.readline().decode().strip()
 assert reply==hashlib.sha256(b'x'*size).hexdigest()
 print(json.dumps({'ok':True,'connected':True,'bytes':size,'sha256':reply,'snd_mss':stream.getsockopt(socket.IPPROTO_TCP,socket.TCP_MAXSEG)}))
except OSError as error:
 stream.setsockopt(socket.SOL_SOCKET,socket.SO_LINGER,struct.pack('ii',1,0))
 print(json.dumps({'ok':False,'connected':connected,'type':type(error).__name__,'errno':error.errno}))
finally:stream.close()
'''
 return json.loads(ns('client','python3','-c',code,str(size),str(port)).stdout)
def hide_fragmentation_feedback():
 nft('r1','''table ip hidden_mtu {
 chain output { type filter hook output priority 0; policy accept;
 icmp type destination-unreachable icmp code frag-needed counter drop comment "fragmentation_feedback_dropped"
 }
}
''')
with lab() as (root,stack,setting):
 topology(setting);setting('client','net.ipv4.tcp_mtu_probing',0);server(stack);hide_fragmentation_feedback()
 failed=transfer(65536,40100);assert failed['connected'] and not failed['ok'] and failed['type']=='TimeoutError'
 initial_counter=counters('r1')['fragmentation_feedback_dropped'];assert initial_counter>0
 nft('r1','''table ip clamp {
 chain forward { type filter hook forward priority 0; policy accept;
 tcp flags & syn == syn tcp option maxseg size > 1240 tcp option maxseg size set 1240 counter comment "mss_rewritten"
 }
}
''')
 # Inspect each advertisement after forwarding, at its receiving endpoint.
 client_tap,client_path=capture(stack,root,'client','c0','tcp port 18080','mss-client')
 target_tap,target_path=capture(stack,root,'target','t0','tcp port 18080','mss-target')
 recovered=transfer(65536,40101);assert recovered['ok'] and recovered['snd_mss']<=1240,recovered
 client_trace=captured(client_tap,client_path);target_trace=captured(target_tap,target_path)
 advertisements=verify_advertisements(target_trace,client_trace,40101)
 after_transfer=counters('r1');assert after_transfer['mss_rewritten']>=2 and after_transfer['fragmentation_feedback_dropped']==initial_counter,after_transfer
 large_ping=ns('client','ping','-n','-M','do','-s','1400','-c','1','-W','1','10.210.3.2',check=False)
 assert large_ping.returncode!=0 and counters('r1')['fragmentation_feedback_dropped']>initial_counter
 print(json.dumps({'before_clamp':failed,'after_clamp':recovered,'counters_after_tcp':after_transfer,
 'icmp_echo_still_fails':{'returncode':large_ping.returncode,'stdout':large_ping.stdout,'stderr':large_ping.stderr},
 'advertisements':advertisements,'capture':{'client_c0':client_trace,'target_t0':target_trace}}))
"""
name='xbcatm-mtupath-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN','--cap-add','SYS_ADMIN','--memory','256m','--pids-limit','128',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The first router suppresses outgoing ICMP fragmentation-needed messages. The client disables its separate TCP MTU probing feature, making this a controlled classic-discovery failure. A 65536-byte transfer establishes TCP and then reaches its application deadline. The router counter confirms feedback was suppressed. The failed socket is aborted so its remaining retransmissions cannot be mistaken for packets from the later comparison.

The script adds a forwarding rule matching SYN-bearing TCP packets whose advertised MSS exceeds 1240. It sets that option to 1240 and counts the changes. SYN-ACK also has SYN set, so the rule covers the corresponding return advertisement. The comparison uses a fresh connection because an already established stream would retain the options it received during its own setup.

The revised assertions use fresh client port 40101, distinct from the failed connection’s 40100. Target-side capture checks SYN after forwarding; client-side capture checks returning SYN-ACK. Absolute sequence numbers link the acknowledgment to that SYN, and retransmissions cannot substitute for a missing direction. Both advertisements must be at most 1240. Aggregate counts alone remain insufficient. Synthetic traces test these checks; actual captures, one-sided-clamp failures and the full transfer still require authorized validation. The inherited report records a verified SHA-256 response, effective sending MSS 1228 after option overhead, and no additional fragmentation-feedback drops.

An IPv4 echo probe with a 1400-byte payload and Don’t Fragment set still fails afterward. The suppressed-feedback counter increases again. This larger ICMP packet is outside the TCP MSS mechanism: reducing an option in a TCP handshake did not shrink it or repair the router’s feedback policy. The paired outcomes define the workaround’s actual scope through traffic, not just a rule listing.

Keep the workaround tied to observed packet constraints

The local capture contains offload representations that can be larger than the resulting TCP segments and can carry apparent partial checksums. Do not conclude from those records alone that MSS was ignored or that giant packets crossed the 1280-byte link. The option, socket diagnostic, counters, and verified application response provide complementary evidence at different processing stages.

Derive a suitable bound from the actual encapsulation and IP version. An IPv6 outer header or additional tunnel overhead changes the packet budget, and path changes can invalidate a previously adequate fixed value. The rule in this isolated topology uses a known bottleneck; it is not a discovery algorithm that learns every later route change automatically.

After applying a production policy, test both new connections and relevant non-TCP traffic. Preserve peer advertisements that are already smaller, and inspect both directions when transfers differ by upload versus download. Prefer correcting required feedback and path configuration where possible. MSS adjustment is useful when its constrained role is explicit and the intended TCP exchange is actually verified.

Sources

RFC 6691 TCP Options and MSS, MSS advertisement and accounting for actual header options, checked 2026-09-12.
nftables packet-header mangling, editing MSS on SYN and SYN-ACK and directional advertisements, checked 2026-09-12.
RFC 1191 Path MTU Discovery, the underlying IPv4 discovery problem that clamping does not repair, checked 2026-09-12.
Linux segmentation offloads, local offload representations versus final TCP segments, checked 2026-09-12.
tcpdump 4.99.3 manual, numeric endpoints, absolute sequence numbers and SYN option display, checked 2026-10-19.
tcpdump 4.99.3 startup source, privilege-drop diagnostics precede the listening line, checked 2026-10-19.
Python 3.11 subprocess, unbuffered binary pipes and short reads, checked 2026-10-19.

Network · XB Field Notes

The SYN backlog holds incomplete handshakes

The backlog argument is the accept queue

SYN cookies remain a fallback

The accept queue is where the pressure lands

When it breaks

Check it quickly

Sources

Network namespaces isolate networking; their names do not own every process

When it breaks

Check it quickly

Keep naming, process ownership, and connectivity separate

Sources

AAAA records publish IPv6 addresses without proving reachability

When it breaks

Check it quickly

Check each advertised family through the service

Sources

TCP slow start grows with acknowledged data, not merely with elapsed time

When it breaks

Check it quickly

Interpret a growth trace in its workload context

Sources

The listen backlog holds connections waiting for accept

When it breaks

Check it quickly

Tune acceptance and waiting capacity together

Sources

IPv6 routers report oversized packets; sources decide how to fit the path

When it breaks

Check it quickly

Diagnose size and direction before recommending fragmentation

Sources

TCP keepalive probes idle connections

A transport probe, not an application heartbeat

Configure the socket you actually use

When it breaks

Check it quickly

Further reading

Sources

A default route matches broadly; it does not rescue every failed path

When it breaks

Check it quickly

Inspect the exact flow before editing defaults

Sources

A subnet prefix shapes connected routes; the routing table chooses the path

When it breaks

Check it quickly

Check the route before changing the mask

Sources

BGP is the Internet routing table

The AS path carries history and policy

Compare the same prefix first

When it breaks

Check it quickly

Sources

The TCP handshake establishes sequence spaces, not synchronized clocks

When it breaks

Check it quickly

Diagnose setup separately from useful service

Sources

DHCP lends the address until it expires

Borrow a number, not own it

Renewal keeps the lease alive

Reclaim what is not used

When it breaks

Check it quickly

Further reading

Sources

MSS clamping can repair one TCP path without repairing its MTU feedback

When it breaks

Check it quickly

Keep the workaround tied to observed packet constraints

Sources