infra notes

Posts

Path MTU is usually the answer

08.11.2026

Everything works, small requests fly, large transfers hang. Half the time it is not the application at all: somewhere on the path the MTU is smaller than the packets we send, and nobody is delivering the ICMP message that would tell us. Check with ping -D -s, pin the MTU slightly below the working size, and move on.

When conntrack fills up quietly

31.10.2026

A box with 1 GB of RAM and a few busy clients can hit nf_conntrack_max in an hour. The symptom is not an error but a slow death: new connections stall while established ones are fine. Look at conntrack -C, the kernel log for table full, and raise the limit together with the hash size.

Two resolvers, two different answers

19.10.2026

If one resolver returns a record and another does not, do not debug the application — read the zone. Nine times out of ten it is a stale cache, a missing A record or a second NS that was never updated.