Networking

When debugging TCP, ss or netstat often shows a list of states first. The hard part is mapping those states to the phase where the connection is stuck.

Many SYN-SENT entries: is the server slow or the network unreachable? The connection is still ESTABLISHED: why did the business request time out? CLOSE-WAIT is piling up: is this a network issue or an application not closing sockets? TIME-WAIT is large: should kernel parameters be changed immediately? A long connection appears alive locally, but NAT or firewall state may already be gone.

When a network is slow, bandwidth is often the first thing people check.

Bandwidth looks sufficient, but HTTPS downloads are slow. Cellular throughput jumps up and down. Wi-Fi signal looks acceptable, but API calls occasionally time out. Packet captures show retransmissions, duplicate ACKs, RTOs, and then the sending rate drops. The server CPU is fine and the application did not change, but TCP suddenly becomes conservative.

Congestion control is often the reason.