What is the timeout for ECS connections and how do I set the TCP connection timeout?-Elastic Compute Service(ECS)-阿里云帮助中心

An ECS instance uses a security group to control inbound and outbound traffic. The security group tracks each established connection to ensure that packets are delivered as expected. A connection that remains idle for an extended period can exhaust the instance's connection resources. This prevents new connections from being established and can even cause packet loss. You can configure an idle connection timeout on an elastic network interface to release resources held by inactive connections.

ECS instance connections

A connection, also known as a network session, is established when a client connects to a server to transfer data.

A network 5-tuple (source IP address, destination IP address, source port, destination port, and protocol) uniquely identifies a connection. The number of connections for an ECS instance includes connections established over TCP, UDP, and ICMP. If your workloads are sensitive to network concurrency, select an instance that explicitly specifies the number of connections parameter. For more information, see Instance families.

Idle connection timeouts

In the TCP protocol, a connection with no data exchange for a period is considered idle, not closed. It may simply be temporarily inactive. However, long-lived idle connections consume server resources and may cause the instance to reach its maximum concurrent connection limit, which prevents new connection requests from being accepted.

Although UDP is a stateless protocol, it still consumes system resources such as network bandwidth, memory, and ports, especially in large-scale applications or high-frequency data exchange scenarios.

Properly setting the TCP idle connection timeout and UDP flow timeout on your ECS instance is crucial for optimizing network performance, resource utilization, and security:

Improve resource utilization: A TCP connection that remains idle for a long time consumes server resources such as memory. Shortening the idle connection timeout releases these resources for other active connections.

Setting a suitable timeout policy for UDP sessions also helps prevent unnecessary resource consumption.
Enhance security: A shorter timeout reduces the window of opportunity for attackers to use long-lived connections for malicious activities, such as launching DDoS attacks or attempting to crack passwords.

However, setting a timeout that is too short might disrupt applications that require long-lived connections, such as some file transfer services. Before you make any changes, fully understand the characteristics of the services on your ECS instance and their specific network requirements.

Configure idle connection timeouts

Note

To minimize latency issues, ensure that the timeout settings for all devices that the data flow passes through match as closely as possible.

When your ECS instance is used with NLB or CLB, configure the timeout of the instance's elastic network interface to match the idle connection timeout configured for the NLB or CLB listener. For information about how to configure listeners and connection timeouts for NLB, see NLB listeners.
Changes to connection timeouts apply only to new connections. Existing connections are not affected.

ECS allows you to configure the following three types of idle connection timeouts:

TCP established timeout: The timeout for an idle TCP connection in the ESTABLISHED state. If a connection is idle for longer than this value, network devices or the operating system might automatically close it. Unit: seconds.
- Minimum: 30 seconds. Maximum: 910 seconds. Default: 910 seconds.
- Valid values: 30, 60, 80, 100, 200, 300, 500, 700, and 910.

TCP wait and close timeout: The timeout for a TCP connection in the TIME_WAIT or CLOSED state. During the four-way handshake to close a TCP connection, one end sends a FIN flag to indicate that it has no more data to send and waits for an ACK from the other end. If an ACK is not received during this wait, a timer starts. The duration of this timer is the TCP wait and close timeout. Unit: seconds.
- Minimum: 3 seconds. Maximum: 15 seconds.
- Default: 3 seconds.
  
  Note
  If your ECS instance is used with NLB or CLB, the default timeout for connections in the TIME_WAIT state is 15 seconds.
- You can set the timeout for TCP connections in the TIME_WAIT and CLOSED states to the same integer value from 3 to 15 seconds.

UDP flow timeout: The time limit for a sequence of UDP packets that is considered a flow, such as the packets in a real-time video stream. If no new UDP packets are sent or received within this period, the flow is considered ended. Unit: seconds.
- Minimum: 10 seconds. Maximum: 100 seconds.
- Default: 30 seconds.
  
  Note
  If your ECS instance is used with NLB or CLB, the default value is 100 seconds.
- Valid values: 10, 20, 30, 60, 80, and 100.

Procedure

You can view and configure connection timeouts when you create an elastic network interface or for an existing one.

When creating an interface

Note

You can also call the CreateNetworkInterface operation to create an elastic network interface and configure the connection timeouts by specifying the TcpEstablishedTimeout, TcpClosedAndTimeWaitTimeout, and UdpTimeout parameters within the ConnectionTrackingConfiguration parameter.

Go to ECS console - Elastic Network Interfaces.
In the top navigation bar, select the region and resource group of the resource that you want to manage.
Click Create an ENI.
On the creation page, in the Session Timeout Periods section, adjust the default values as needed.

For an existing interface

Note

You can also call the ModifyNetworkInterfaceAttribute operation to modify the attributes of an elastic network interface and configure the connection timeouts by specifying the TcpEstablishedTimeout, TcpClosedAndTimeWaitTimeout, and UdpTimeout parameters within the ConnectionTrackingConfiguration parameter.
You can call the DescribeNetworkInterfaceAttribute operation and set the Attribute parameter to connectionTrackingConfiguration to view the connection timeouts for a specified elastic network interface.

Go to ECS console - Elastic Network Interfaces.
In the top navigation bar, select the region and resource group of the resource that you want to manage.
Click the ID of the target elastic network interface to open its details page.
In the Session Timeout Periods section, you can view the Timeout Period for Established TCP Connections, TCP Wait and Close Timeout Period, and UDP Flow Timeout Period of the elastic network interface. You can click to modify these settings.