Reports from proxy operators on short-lived client connections

We occasionally receive reports from proxy operators on spikes of short-lived client connections. This does not necessarily indicate a bug, censorship, or an attack on Snowflake. There are many potential explanations for this and it may be difficult to determine the cause, but in some instances might be worth looking into.

China

Jul 10 13:51 UTC 2025 IRC user IDK_ wrote:

13:51 < IDK_> Hi is it only me or does china more aggresively block IPv4 traffic?
13:54 < cohosh> IDK_: is this something you're seeing with snowflake, or something else?
13:56 < IDK_> cohosh: yep, with snowflakes
13:57 < IDK_> ipv6 connections tend to last longer
13:57 < IDK_> and transfer more data while ipv4 ones disconnects after a few bytes/kb
13:59 < cohosh> hm, interesting
14:01 < cohosh> i think i will create a generic issue for looking into short-lived client connections
14:04 < IDK_> also, very suspiciously, a lot of chinese connections terminates after sending exactly 888 bytes
14:04 < IDK_> only occurs with chinese connections, sounds like what a chinese dev would do as well (888 is a lucky number 
              in china)

There was a report from a user in early 2024 that snowflake connections were established but then stopped working after just a few bytes were sent: https://github.com/net4people/bbs/issues/325

Russia

We saw this behaviour from our vantage point in Russia for a period of time in late 2024: https://github.com/net4people/bbs/issues/422

I wrote some patches to re-enable out-of-band signalling for vantage point testing. This can help root out blocking as a cause, but won't help if either the client or proxy are dropping connections due to a bug or malicious behaviour.