From 8a854141c520fb4efdc796a94e382b0bd74a3282 Mon Sep 17 00:00:00 2001 From: mrambossek Date: Fri, 31 Jul 2026 20:49:05 +0200 Subject: [PATCH] build-status: server self-test live; fmr proven good (sysctl+MTU clean) Co-Authored-By: Claude Opus 5 --- docs/build-status.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/docs/build-status.md b/docs/build-status.md index b9a59bc..ee77965 100644 --- a/docs/build-status.md +++ b/docs/build-status.md @@ -271,3 +271,17 @@ against independent clients. Deployed via `--self-update` (v0.3.0→v0.3.1, chec encoding — a focused batch, not a corner to rush. Remaining spec: tls-echo (ClientHello+JA4), TRAIN_REPORT, big/frag-send, throughput, downtrain; real admin UI. + +## Server self-test + host tuning — v0.3.4/v0.3.5, fmr proven good (2026-07-31) +The daemon now proves its own host is a clean measurement target: +- **sysctl audit** (`GET /admin/selftest`, startup warnings): on first run it flagged exactly 4 + real issues on fmr — accept_ra=1 on a static-v6 host, accept_redirects=1, send_redirects=1, + icmp_ratelimit=1000. Recommended `server/deploy/99-echolot-sysctl.conf` applied (v6 default + route/addrs are proto static with 0 RA-derived routes, so disabling accept_ra is safe — + verified v6 egress intact after). Now sysctl_ok=true, 0 warnings. +- **egress-MTU self-proof**: DF PMTUD via IP_MTU_DISCOVER + getsockopt IP_MTU (v0.3.4 had a bug — + read IP_MTU without connecting → ENOTCONN; v0.3.5 connects first). fmr reports 1500 on both v4 + and v6 → mtu_ok=true, so client MTU tests are trustworthy. +- Both signals ride in the profile as `server_selftest{mtu_ok,sysctl_ok}` so a client can skip + MTU testing when the server can't support it honestly. +fmr profile now: `{mtu_ok: true, sysctl_ok: true}`.