What is the timeout period for an ECS connection and how do I specify the timeout period for a TCP connection? - Elastic Compute Service

Specify idle connection timeout periods on an ENI to release resources occupied by inactive connections and prevent connection exhaustion.

Connections of an ECS instance

A connection (session) is the process of connecting a client to a server and transferring data between them.

A connection is uniquely defined by a quintuple: source IP address, destination IP address, source port, destination port, and protocol. ECS instance connections include TCP, UDP, and ICMP. If your workload is sensitive to concurrent connections, select an instance type whose the maximum number of connections meets your requirements. See Instance family.

Timeout periods for idle connections

An established TCP connection may remain open even when no data is being exchanged. Long-lived idle connections consume instance resources and may cause the concurrent connection limit to be reached, causing new connections to be rejected.

Although UDP is stateless, it still consumes system resources such as network bandwidth, memory, and ports, especially in large-scale or high-frequency data exchange scenarios.

Specify appropriate timeout periods for idle TCP connections and UDP flows to optimize network performance, improve resource utilization, and enhance security.

Improve resource utilization. Idle TCP connections consume instance resources such as memory. Shorten timeout periods to release resources for active connections.

Specify appropriate UDP flow timeout periods to prevent unnecessary resource consumption.
Enhance security. Short timeout periods reduce the risk of attacks that exploit long-lived connections, such as DDoS and brute-force attacks.

However, too short a timeout period may disrupt applications that require long-lived connections, such as file transfer services. Before changing a timeout period, ensure that you understand the connection requirements of the services running on your ECS instance.

Specify timeout periods for idle connections

Note

To minimize latency, ensure that all devices in the data path use matching timeout settings.

If your ECS instance works with an NLB or CLB instance, specify matching idle connection timeout periods on the ENI and the NLB or CLB listeners. See NLB listeners.
New timeout periods take effect only on new connections, not existing ones.

ECS supports the following idle connection timeout types:

Timeout Period for Established TCP Connections: the timeout period for idle TCP connections in the ESTABLISHED state. A connection is considered idle when no data is transmitted for longer than this period. The connection may be closed by a network device such as a router or firewall, or by the operating system. Unit: seconds.
- Minimum value: 30. Maximum value: 910. Default value: 910.
- Valid values: 30, 60, 80, 100, 200, 300, 500, 700, and 910.

TCP Wait and Close Timeout Period: the timeout period for TCP connections in the TIME_WAIT or CLOSED state. To close a TCP connection, four handshakes are required. After one end sends the FIN flag to indicate it has no data to send, it waits for the ACK from the other end. If no ACK is received, the TCP wait and close timeout period starts. Unit: seconds.
- Valid values: 3 to 15.
- Default value: 3.
  
  Note
  If the ECS instance works with an NLB or CLB instance, the default timeout period for TCP connections in the TIME_WAIT state is 15 seconds.
- Valid values: integers from 3 to 15.

UDP Flow Timeout Period: the timeout period for a UDP flow. A UDP flow is a series of related UDP packets, such as packets in a real-time video stream. If no new UDP packets are received or sent within this period, the flow may end or an exception may occur. Unit: seconds.
- Minimum value: 10. Maximum value: 100.
- Default value: 30.
  
  Note
  If the ECS instance works with an NLB or CLB instance, the default timeout period for UDP flows is 100 seconds.
- Valid values: 10, 20, 30, 60, 80, and 100.

Procedure

You can specify connection timeout periods when you create an ENI or modify them on an existing ENI.

Specify timeout periods for idle connections when you create an ENI

Note

You can also call the CreateNetworkInterface operation to create an ENI and specify TcpEstablishedTimeout, TcpClosedAndTimeWaitTimeout, and UdpTimeout in the ConnectionTrackingConfiguration parameter set.

Go to ECS Console - Elastic Network Interfaces.
In the upper-left corner of the page, select a region and resource group.
Click Create an ENI.
In the Session Timeout Periods section, specify timeout periods for each connection type.

Specify timeout periods for idle connections on an existing ENI

Note

You can also call the ModifyNetworkInterfaceAttribute operation to modify ENI attributes and specify TcpEstablishedTimeout, TcpClosedAndTimeWaitTimeout, and UdpTimeout in the ConnectionTrackingConfiguration parameter set.
To query connection timeout periods on an ENI, call the DescribeNetworkInterfaceAttribute operation with Attribute set to connectionTrackingConfiguration.

Go to ECS Console - Elastic Network Interfaces.
In the upper-left corner of the page, select a region and resource group.
Click the ENI ID to go to the ENI details page.
In the Session Timeout Periods section, view the Timeout Period for Established TCP Connections, TCP Wait and Close Timeout Period, and UDP Flow Timeout Period values. Click the icon next to a parameter to change its value.