• When a connection is reset by peers it means that the remote server has sent you a RST packet, which indicates an immediate dropping of the connection, rather than the usual handshake
  • When it shows “Connection refused” its most likely that the connection is on, but the service is either unavailable or else
  • Best responses for a firewall is to give timeout responses, you can setup an IP table to do connection refuse
  • If using curl command and received an empty response, its likely that the DNS has been resolved
  • VPNs add a route in your machine once initiated
    • Example: site-to-site VPN needs a router in order to contact an IP that it outside its own range
  • [::1] Means 127.0.0.1 in ipv6 address
  • Throughput Calculation = (number of requests) / (total time)
    • Bandwidth is the maximum potential capacity of a network, while throughput is the actual amount of data successfully transmitted
    • Total time can be the duration of a test for example
  • When adding records to your DNS records, you can make multiple hosts point at something like a variable that has the instance IP address
    • Rather than creating an A record for each domain, create an A record like the following: <app-name>-instance
    • Then create as many CNAME records as you want pointing towards that <app-name>-instance.domain.com
    • So in case the machine’s IP changed, no need to change for every domain, just the instance and that’s it. Really handy when it comes to apps with microservices
  • One of the ways to confirm that your VPN is connected is by listing the routes (that should be configured automatically) using a command like route -n
  • It’s important to understand that server-side encryption encrypts data on the server after upload, ideal for centralized control, while client-side encryption encrypts data before upload, ensuring only the client can decrypt, suitable for zero-trust or privacy-focused use cases
    • Server-side encryption is used in cloud storage like AWS S3 to protect data at rest, while client-side encryption is used in apps like Signal to keep messages private before they leave the device
  • 502 doesn’t necessarily mean your server is down, it could mean that the connection between the load balancer and your backend broke mid-request. Most common cause is connection timing mismatch. For example, your load balancer has an idle timeout on 60 seconds, your backend server also has a keep-alive timeout but closes the connection after 55 seconds, hence the next request gets a closed connection and the backend rejects it, load balancer returns 502
    • Fix is simple: Just increase keep-alive to 65 seconds
    • A second most common cause could also be target deregistration during deployments, where active requests are still being processed when the instance was removed hence load balancer returns 502
    • Third common cause is backend resource exhaustion, even if your health check shows everything is fine (could be due to lightweight endpoint) actual requests are failing because the application has run out of worker threads, database connections, or file descriptors