AWS Reduces Nitro V6 Instance TCP Idle Timeout from 5 Days to 350 Seconds

Starting with instances launched in June 2025 based on Nitro V6 (such as m8i, r8i), the default Connection Tracking TCP established idle timeout in security groups has changed from 432,000 seconds (5 days) to 350 seconds. This change applies at the ENI level; while the configurable range remains the same from 60 seconds to 432,000 seconds, only the default value has been lowered.

Background and Cause

The previous 5-day timeout caused idle connections that did not receive FIN or RST packets to accumulate in the tracking table for extended periods, exhausting the quota. This led to failures in establishing new connections and 504 errors from load balancers. Additionally, since other AWS networking services such as NLB and NAT Gateway already use a 350-second timeout, this measure aims to resolve inconsistencies between layers and reduce half-open states.

Impact and Precautions

When a connection is deleted due to timeout, a silent drop phenomenon may occur where FIN or RST packets are not sent. Consequently, clients may mistakenly believe the connection is alive, causing packets to be silently discarded on the next request. This results in a concentration of timeout errors immediately after weekends or on the first request in the early morning.

Affected workloads include:

• Database Connection Pools: When maxIdleTime is greater than 350 seconds or unset
• IoT Telemetry: Intermittent MQTT transmissions and long-lived sessions
• Microservices: Persistent HTTP and gRPC connections using keep-alive
• WebSockets and Long Polling: When the HeartBeat interval exceeds 350 seconds

In particular, Auto Scaling groups using Karpenter or attribute-based instance type selection automatically choose the latest generation, which may unintentionally migrate to Nitro V6 and cause issues. P6e-GB200 is an exception and retains the default value of 432,000 seconds.