How can I monitor the TCP handshakes between the ALB public faced and ECS Fargate tasks that are in a private subnet?

Question

I’m running an ECS Fargate service in a private subnet, behind a public-facing Application Load Balancer (ALB).

The ALB has a connection idle timeout of 70 seconds, and the HTTP client uses keep-alive. On the ECS service, I’ve set IDLE_TIMEOUT and NO_REQUEST_TIMEOUT to 120 seconds, following the recommendation that server timeouts should be higher than the ALB timeout.

Despite these settings, I’m seeing premature connection closures on the app side. When I load my web app, 3-4 random requests fail out of 20. However, when I retry, the data loads successfully.

I want to figure out which side is sending the FIN signal first. Is there a way to identify this?

Reference: 
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/edit-load-balancer-attributes.html

Riku_Kobayashi · Accepted Answer

Hello.

I often do a tcpdump in a sidecar container when troubleshooting ECS ​​Fargate networks.  
I think it would be a good idea to set up a container called "Amazon ECS Network Sidecar" as a sidecar and perform tcpdump to capture packets.  
It is possible to identify by looking at VPC flow logs, etc., but if you want to see more detailed packets, I think tcpdump is better.  
https://gallery.ecr.aws/aws-se/amazon-ecs-network-sidecar

How can I monitor the TCP handshakes between the ALB public faced and ECS Fargate tasks that are in a private subnet?

Add your answer

Relevant content