Connection pool exhaustion during NetworkManager interface flapping on Fedora

Resolution and Analysis

NetworkManager's handling of interface flapping does not create a race condition that directly generates TIME_WAIT sockets. TIME_WAIT is a kernel-level TCP state managed by the networking stack, not the NetworkManager daemon. However, rapid profile switching triggers route invalidations that cause application-layer connection pools to behave unpredictably, leading to the perceived exhaustion.

Likely Explanation vs. Confirmed Facts

Confirmed Facts:

• NetworkManager manages connection profiles and D-Bus state transitions; it does not control the TCP state machine of individual application sockets.
• Interface flapping forces the kernel to drop or invalidate routes, which often results in RST (Reset) packets or silent timeouts rather than a graceful FIN exchange.

Likely Explanation: The "exhaustion" is typically a result of the application pool attempting to reuse sockets that are logically dead but not yet reclaimed by the kernel, or initiating a burst of new connections to replace dropped ones. When systemd-resolved is involved, DNS resolution delays during the transition can cause connection attempts to hang, keeping sockets in a pending state and accelerating pool depletion.

Recommended Diagnostic Priority

Diagnosis should focus on kernel socket states first, then application pool behavior, and finally D-Bus transitions. The daemon's state transitions are the trigger, but the exhaustion occurs in the kernel/application boundary.

1. Quantify Socket States: Run the following command during a flapping event to determine if the bottleneck is TIME_WAIT accumulation or a surge of SYN_SENT sockets:

   ss -tan | awk '{print $1}' | sort | uniq -c

2. Verify Route Changes: Check dmesg for route changes or "martian source" logs that align with the pool exhaustion timestamps.
3. Test DNS Latency: Monitor if systemd-resolved is delaying the establishment of new connections during the profile switch, which masks the actual timeout.

Missing Diagnostic Detail

To refine this recommendation, please provide the application's connection timeout and keep-alive settings. If the application lacks a proactive health check for pooled connections, it will continue to attempt reuse of invalidated sockets regardless of NetworkManager's state.