{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-069-test-established-tcp-sessions-separately-from-new-connections-during-azure-live/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-069-test-established-tcp-sessions-separately-from-new-connections-during-azure-live/", "slug": "dse-20260909-069-test-established-tcp-sessions-separately-from-new-connections-during-azure-live", "url": "https://update.dsesecurity.com/updates/dse-20260909-069-test-established-tcp-sessions-separately-from-new-connections-during-azure-live/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-069-test-established-tcp-sessions-separately-from-new-connections-during-azure-live.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-069-test-established-tcp-sessions-separately-from-new-connections-during-azure-live/" }, "title": "Test established TCP sessions separately from new connections during Azure live migration", "summary": "Why can an application remain stalled after a brief VM migration pause even when new connections work?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:30:47+00:00", "modified_at": "2026-09-10T00:35:07+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 246, "potentially_affected": "Applications with long-lived TCP connections on Azure VMs eligible for live migration.", "dse_recommendation": "Include existing pooled connections and fresh connections as separate cases in the migration-resilience test.", "primary_source": { "name": "Maintenance and updates - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/maintenance-and-updates", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft describes Azure live migration as memory-preserving and rebootless, but best effort rather than guaranteed. During a pause, transmitted TCP segments can remain unacknowledged. For active connections with in-flight data, Standard Load Balancer does not send a reset during that pause. A stalled established connection can therefore require client-side detection and recovery. In Layer-4 TLS passthrough, the load balancer cannot inspect or retry the encrypted stream. Microsoft Learn.

\n

Applicability

\n

Review an application that keeps database, messaging, or other TCP sessions open across requests. Identify its client library, connection pool, operating system, timeout behavior, and load-balancer mode. Check VM eligibility and do not assume that every platform maintenance event will use live migration.

\n

DSE recommendation

\n

Include existing pooled connections and fresh connections as separate cases in the migration-resilience test. Have the application owner define an acceptable stalled-operation interval and safe retry behavior. Prefer a reviewed application or socket-level setting where appropriate, and assess the effect on ordinary slow requests before shortening timeouts. Keep event-driven connection draining as a separate design option.

\n

Verification

\n

In an authorized test, observe outstanding requests, reconnection behavior, and newly opened sessions through the interruption and recovery interval. Compare the application result with its own acceptance threshold instead of using the VM pause duration alone. Record unsuccessful retries, abandoned pooled connections, and unexpected duplicate operations. Require the application owner to accept those outcomes before applying the configuration more broadly.

\n

Official references

\n

Microsoft Learn: Maintenance for virtual machines in Azure. Source reviewed September 9, 2026.

", "content_text": "Source facts\nMicrosoft describes Azure live migration as memory-preserving and rebootless, but best effort rather than guaranteed. During a pause, transmitted TCP segments can remain unacknowledged. For active connections with in-flight data, Standard Load Balancer does not send a reset during that pause. A stalled established connection can therefore require client-side detection and recovery. In Layer-4 TLS passthrough, the load balancer cannot inspect or retry the encrypted stream. Microsoft Learn.\nApplicability\nReview an application that keeps database, messaging, or other TCP sessions open across requests. Identify its client library, connection pool, operating system, timeout behavior, and load-balancer mode. Check VM eligibility and do not assume that every platform maintenance event will use live migration.\nDSE recommendation\nInclude existing pooled connections and fresh connections as separate cases in the migration-resilience test. Have the application owner define an acceptable stalled-operation interval and safe retry behavior. Prefer a reviewed application or socket-level setting where appropriate, and assess the effect on ordinary slow requests before shortening timeouts. Keep event-driven connection draining as a separate design option.\nVerification\nIn an authorized test, observe outstanding requests, reconnection behavior, and newly opened sessions through the interruption and recovery interval. Compare the application result with its own acceptance threshold instead of using the VM pause duration alone. Record unsuccessful retries, abandoned pooled connections, and unexpected duplicate operations. Require the application owner to accept those outcomes before applying the configuration more broadly.\nOfficial references\nMicrosoft Learn: Maintenance for virtual machines in Azure. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nMicrosoft describes Azure live migration as memory-preserving and rebootless, but best effort rather than guaranteed. During a pause, transmitted TCP segments can remain unacknowledged. For active connections with in-flight data, Standard Load Balancer does not send a reset during that pause. A stalled established connection can therefore require client-side detection and recovery. In Layer-4 TLS passthrough, the load balancer cannot inspect or retry the encrypted stream. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/maintenance-and-updates).\n\n## Applicability\n\nReview an application that keeps database, messaging, or other TCP sessions open across requests. Identify its client library, connection pool, operating system, timeout behavior, and load-balancer mode. Check VM eligibility and do not assume that every platform maintenance event will use live migration.\n\n## DSE recommendation\n\nInclude existing pooled connections and fresh connections as separate cases in the migration-resilience test. Have the application owner define an acceptable stalled-operation interval and safe retry behavior. Prefer a reviewed application or socket-level setting where appropriate, and assess the effect on ordinary slow requests before shortening timeouts. Keep event-driven connection draining as a separate design option.\n\n## Verification\n\nIn an authorized test, observe outstanding requests, reconnection behavior, and newly opened sessions through the interruption and recovery interval. Compare the application result with its own acceptance threshold instead of using the VM pause duration alone. Record unsuccessful retries, abandoned pooled connections, and unexpected duplicate operations. Require the application owner to accept those outcomes before applying the configuration more broadly.\n\n## Official references\n\n[Microsoft Learn: Maintenance for virtual machines in Azure](https://learn.microsoft.com/en-us/azure/virtual-machines/maintenance-and-updates). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-069-test-established-tcp-sessions-separately-from-new-connections-during-azure-live/", "url": "https://update.dsesecurity.com/updates/dse-20260909-069-test-established-tcp-sessions-separately-from-new-connections-during-azure-live/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-069-test-established-tcp-sessions-separately-from-new-connections-during-azure-live/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Test established TCP sessions separately from new connections during Azure live migration", "item": "https://update.dsesecurity.com/updates/dse-20260909-069-test-established-tcp-sessions-separately-from-new-connections-during-azure-live/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-069-test-established-tcp-sessions-separately-from-new-connections-during-azure-live/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-069-test-established-tcp-sessions-separately-from-new-connections-during-azure-live/", "url": "https://update.dsesecurity.com/updates/dse-20260909-069-test-established-tcp-sessions-separately-from-new-connections-during-azure-live/", "headline": "Test established TCP sessions separately from new connections during Azure live migration", "description": "Why can an application remain stalled after a brief VM migration pause even when new connections work?", "abstract": "Why can an application remain stalled after a brief VM migration pause even when new connections work?", "articleBody": "Source facts\nMicrosoft describes Azure live migration as memory-preserving and rebootless, but best effort rather than guaranteed. During a pause, transmitted TCP segments can remain unacknowledged. For active connections with in-flight data, Standard Load Balancer does not send a reset during that pause. A stalled established connection can therefore require client-side detection and recovery. In Layer-4 TLS passthrough, the load balancer cannot inspect or retry the encrypted stream. Microsoft Learn.\nApplicability\nReview an application that keeps database, messaging, or other TCP sessions open across requests. Identify its client library, connection pool, operating system, timeout behavior, and load-balancer mode. Check VM eligibility and do not assume that every platform maintenance event will use live migration.\nDSE recommendation\nInclude existing pooled connections and fresh connections as separate cases in the migration-resilience test. Have the application owner define an acceptable stalled-operation interval and safe retry behavior. Prefer a reviewed application or socket-level setting where appropriate, and assess the effect on ordinary slow requests before shortening timeouts. Keep event-driven connection draining as a separate design option.\nVerification\nIn an authorized test, observe outstanding requests, reconnection behavior, and newly opened sessions through the interruption and recovery interval. Compare the application result with its own acceptance threshold instead of using the VM pause duration alone. Record unsuccessful retries, abandoned pooled connections, and unexpected duplicate operations. Require the application owner to accept those outcomes before applying the configuration more broadly.\nOfficial references\nMicrosoft Learn: Maintenance for virtual machines in Azure. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:30:47+00:00", "dateModified": "2026-09-10T00:35:07+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-069-test-established-tcp-sessions-separately-from-new-connections-during-azure-live/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-069-test-established-tcp-sessions-separately-from-new-connections-during-azure-live/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Test established TCP sessions separately from new connections during Azure live migration" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 246, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Maintenance and updates - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/maintenance-and-updates" } } ] } }