Files
felhom.eu/documentation/audits/evidence-ep0-established-connections-2026-08-20/step1.5-attribution-arithmetic.txt
T
admin 19672e685e
gates / gates (push) Successful in 14s
SPIKE ep0 connections: the leak is felhom-agent's, not the poll rate
R-341's first dated check, taken at +46.2 h: fd 17 -> 405 over 166,251 s
= 201.6/day. Pre-registered range was 370-450; observed 388. UNCHANGED,
as predicted. CLOSE-WAIT is 0 -- absent entirely, not merely flat.

Q1: exactly two peers, 194 each, no third party.
Q2: outcome (a). ep0 388 = 194 + 194 on the boxes, twice, and the four
    new sockets carry the same source ports on both sides. 0 closed in 31 min.

The finding: all 388 are held by felhom-agent. pvestatd and
proxmox-backup-client made 162,404 requests and leaked zero. Mechanism is
a per-cycle http.Transport with a zero-value IdleConnTimeout that nothing
ever closes (internal/pbs/client.go:56, main.go:1486). R-336's premise
does not survive this -- cutting the poll rate would have fixed nothing.

Q3 NOT measured: Phase C held at STOP 1, prediction pre-registered first.

Part 0 captures the due-checks gate's first conviction on a real overdue
date (rc=1, names R-341, sole failure among 10 gates). Row cleared at
Part 4, after the result was recorded in R-341, not to make a push work.

New: R-344 (the transport leak), R-345 (hub/Makefile pushes :latest),
R-346 (ActiveEnterTimestamp reads 5h56m early -- NRestarts is still 0).
2026-08-20 10:41:37 +02:00

35 lines
2.0 KiB
Plaintext

ATTRIBUTION — who makes the requests, and who leaks the descriptors
window 2026-08-18 ~09:51Z -> 2026-08-20 08:03Z (166251 s = 46.18 h)
user agent endpoint requests req/day
libwww-perl/6.78 pvestatd: GET /admin/datastore 81192 42195
proxmox-backup-client/1.0 GET .../felhom-offsite/status 80061 41607
libwww-perl/6.78 GET .../felhom-offsite/snapshots 1131 588
Go-http-client/1.1 GET .../felhom-offsite/snapshots 387 201
Go-http-client/1.1 GET /version 371 193
Go-http-client/1.1 POST .../verify + task status 53 28
TOTAL (both boxes, all agents) 163215 84822
LEAKED DESCRIPTORS OVER THE SAME WINDOW: 388 (all ESTABLISHED on :8007)
requests by libwww-perl + proxmox-backup-client : 162404 descriptors leaked: 0
requests by Go-http-client/1.1 (felhom-agent) : 811 descriptors leaked: 388
Go-http-client GET .../snapshots calls : 387
leaked ESTAB sockets : 388 -> ratio 1.0026 (ONE per call, within 1)
Per box, at the instant of reading A:
ep0 ESTAB from 10.77.0.2 (demo-felhom) = 194 ; from 10.77.0.3 (demo-hp) = 194
demo-felhom ESTAB to 10.77.0.1:8007 = 194 ; demo-hp = 194
194 + 194 = 388 = ep0 total. Both sides agree EXACTLY -> Q2 outcome (a).
CADENCE RECONCILIATION (why 194 and not 185):
hub report poll poll_seconds=900 -> 184.7 cycles in the window
pbs VerifyLoop DefaultVerifyCadence=6h -> 7.7 cycles in the window
sum -> 192.4 observed leaked/box: 194
observed POST .../verify per box in the window: 8 (matches 7.7)
observed GET /version per box: ~185.5 (matches the 184.7 hub cycles)
Mean interval between leaked descriptors, per box:
857 s = 14.28 min (900 s poll + a 6 h verify cycle superposed)