Nitro V6 Conntrack Idle Timeout - Silent Drop and Keepalive

TCP established idle timeout default 432,000s -> 350s on Nitro V6 ENIs: how a pooled connection dies silently and how keepalive prevents it

Nitro V6 Conntrack Idle Timeout - Silent Drop and Keepalive TCP established idle timeout default 432,000s -> 350s on Nitro V6 ENIs: how a pooled connection dies silently and how keepalive prevents it open pooled connection TCP handshake forward - conntrack entry created Nitro V6 default tcpEstablishedTimeout = 350s (was 432,000s) query / response OK entry expired - no FIN / RST Both sockets still believe ESTABLISHED reuse idle connection packet on untracked flow silent drop (no RST) No error reaches the sender hang until app-level timeout SO_KEEPALIVE + sysctl tcp_keepalive_time = 240s (< 350s); sysctl alone is not enough keepalive probe at 240s idle forward - idle timer reset ACK connection stays alive Establish + traffic Idle > 350s -> silent drop Mitigation: TCP keepalive Client App · connection pool · Sequence participant Client App connection pool TCP Stack · Linux kernel socket · Sequence participant TCP Stack Linux kernel socket ENI Conntrack · Nitro V6 SG, 350s · Sequence participant ENI Conntrack Nitro V6 SG, 350s Peer Server · e.g. database · Sequence participant Peer Server e.g. database Legend request return security async trace default message

What Changed

  • • Nitro V6 (m8i / r8i, June 2025) lowers the SG conntrack TCP established idle default to 350s
  • • Previous generations keep 432,000s (5 days); P6e-GB200 is the exception on V6
  • • This is ENI / hypervisor level tracking, not kernel nf_conntrack

Silent Drop

  • • Expired entries emit no FIN / RST to either side
  • • Pools reuse dead connections; first requests after long idle hang
  • • Karpenter / attribute-based ASGs can move workloads to V6 unintentionally

Keepalive Fix

  • • Start probes before 240s so no layer ever sees the flow as idle
  • • Per-socket SO_KEEPALIVE is required - sysctl only tunes intervals
  • • Safe across mixed Nitro generations, LBs, and NAT Gateway

Sequence diagram • Built with Archify • Create yours ↗ • Hover to trace • R route • Click to focus • +/− zoom • M radar • [/] views • P play story • T theme • E export