Lost in Cyberspace: Tracking Down the Missing TCP Packet
summary
Claim: a single TCP RST dropped by an F5 because of an F5 SSL handshake timeout causes long-lived half‑open connections that exhaust SNAT ports. Setup details: Azure Kubernetes Service with NGINX ingress, on‑prem F5, TCP captures and packet traces. Numbers: 100,000 cars × ~2 checks/min → ~3.3k checks/sec, firewall orphan timeout = 1 hour, TCP orphan retries ≈ 8. Fix: allow device RSTs through the firewall; it releases SNATs and the system recovers.
AI-written summary · about
chapters (10)
- 0:00TCP packet investigation
- 1:58Speaker background and presentation context
- 4:50TomTom cloud migration
- 9:09F5 SSL timeout issues
- 12:03Firewall TCP reset handling
- 13:27TCP captures analysis
- 16:40F5 vs Engine X handling
- 19:09Firewall fix challenges
- 20:57Failed TLS handshake causes
- 21:38Key takeaways and troubleshooting tips
related talks
34mIt's Not Always the Network (But Here's How to Prove It): Kubernetes Packet...
38mLogs Told Us It Was DNS, It Looked like DNS, It Had to Be DNS, It Wasn't DNS
35mWho Dropped the Packet? Solving K8s Network Mysteries in Real-Time
28mHow to Break your Kubernetes Cluster with Networking
31mThirty seconds of silence
30mMaking Kubernetes Networking Ready for Service Providers
39mTesting Level Hard: Distributed Apps
35mFollowing a packet journey through the networking stack in OpenShift