# Test established TCP sessions separately from new connections during Azure live migration

> Why can an application remain stalled after a brief VM migration pause even when new connections work?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-069-test-established-tcp-sessions-separately-from-new-connections-during-azure-live/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:30:47+00:00
- Modified: 2026-09-10T00:35:07+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 2 minutes

## What you need to know

Why can an application remain stalled after a brief VM migration pause even when new connections work?

## Potentially affected

Applications with long-lived TCP connections on Azure VMs eligible for live migration.

## DSE recommendation

Include existing pooled connections and fresh connections as separate cases in the migration-resilience test.

## Article

## Source facts

Microsoft describes Azure live migration as memory-preserving and rebootless, but best effort rather than guaranteed. During a pause, transmitted TCP segments can remain unacknowledged. For active connections with in-flight data, Standard Load Balancer does not send a reset during that pause. A stalled established connection can therefore require client-side detection and recovery. In Layer-4 TLS passthrough, the load balancer cannot inspect or retry the encrypted stream. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/maintenance-and-updates).

## Applicability

Review an application that keeps database, messaging, or other TCP sessions open across requests. Identify its client library, connection pool, operating system, timeout behavior, and load-balancer mode. Check VM eligibility and do not assume that every platform maintenance event will use live migration.

## DSE recommendation

Include existing pooled connections and fresh connections as separate cases in the migration-resilience test. Have the application owner define an acceptable stalled-operation interval and safe retry behavior. Prefer a reviewed application or socket-level setting where appropriate, and assess the effect on ordinary slow requests before shortening timeouts. Keep event-driven connection draining as a separate design option.

## Verification

In an authorized test, observe outstanding requests, reconnection behavior, and newly opened sessions through the interruption and recovery interval. Compare the application result with its own acceptance threshold instead of using the VM pause duration alone. Record unsuccessful retries, abandoned pooled connections, and unexpected duplicate operations. Require the application owner to accept those outcomes before applying the configuration more broadly.

## Official references

[Microsoft Learn: Maintenance for virtual machines in Azure](https://learn.microsoft.com/en-us/azure/virtual-machines/maintenance-and-updates). Source reviewed September 9, 2026.

## Primary reference

- Name: Maintenance and updates - Azure Virtual Machines | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machines/maintenance-and-updates
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Test established TCP sessions separately from new connections during Azure live migration,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-069-test-established-tcp-sessions-separately-from-new-connections-during-azure-live/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.