curl -v https://www.mediawiki.org --tcp-fastopen --connect-to ::[2a02:ec80:300:ed1a::1] --head
sudo ip tcp_metrics | grep fo_cookie or check server's SYN/ACK in Wireshark

What happens?:

No TFO cookie obtained, no TFO option in SYN/ACK set.

What should have happened instead?:

Software version (on Special:Version page; skip for WMF-hosted wikis like Wikipedia):

Other information (browser name/version, screenshots, etc.):

TFO seems to be supported before as users reported in #wikipedia-zh-cs, SYN packet with payload can bypass China's Deep Packet Inspection. However, they cannot achieve this after at least December 2025.

Details

Related Changes in Gerrit:

	Subject	Author	Repo	Branch	Lines +/-
	R:cache::upload enable TCP Fast Open	Slyngshede	operations/puppet	production	+1 -0
	R:cache::text enable TCP Fast Open	Slyngshede	operations/puppet	production	+1 -0

Customize query in gerrit

Related Objects

Mentioned Here: T355446: Synchronize and rotate TCP Fastopen keys for various use-cases

Event Timeline

Cuthead created this task.Jan 25 2026, 1:00 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 25 2026, 1:00 AM

Cuthead renamed this task from TCP Fast Open not working since at least December 2025 to TCP FastOpen not working since at least December 2025.Jan 25 2026, 1:04 AM

ori subscribed.Jan 25 2026, 1:11 AM

There are some mentions of TCP Fast Open in operations/puppet: https://codesearch.wmcloud.org/puppet/?q=tcp_fastopen . Though I don't know how the network stack here works.

Just confirmed TFO on 3 AuthDNS is OK.

208.80.153.231 age 179.516sec fo_mss 1024 fo_cookie 2961b389e2ec5b93 source 192.168.1.141
208.80.154.238 age 236.896sec fo_mss 1024 fo_cookie ac6e5848bec8220d source 192.168.1.141
198.35.27.27 age 155.280sec fo_mss 1024 fo_cookie 13666bd830beef1e source 192.168.1.141

BCornwall subscribed.Jan 26 2026, 10:57 AM

TFO is still configured in our TLS terminators. We'll have to investigate to figure out what has gone wrong here. Possibly this is being stripped by our loadbalancers.

CDanis subscribed.Mar 20 2026, 1:42 PM

@ssingh figured out where we went wrong. At the TLS terminator level, it is enabled, but at the OS level (Linux sysctl settings), it is not. We did have it enabled at that level sometime in the distant past, but the setting was lost in some past reconfiguration. We'll fix it, but probably early next week!

Any update on this after one month...?

Naruse_shiroha unsubscribed.Apr 20 2026, 3:39 AM

Change #1275750 had a related patch set uploaded (by Slyngshede; author: Slyngshede):

[operations/puppet@production] R:cache::text enable TCP Fast Open

https://gerrit.wikimedia.org/r/1275750

gerritbot added a project: Patch-For-Review.Apr 21 2026, 6:33 AM

@Naruse_shiroha we're currently working on another task, related to TCP Fast Open. To make that work, this task will need to be completed first.

I've created the first patch to enable TFO.

For testing I suggest rolling out to e.g. MAGRU first.
We can then test that cookies get set with

$ curl -I -4 connect-to en.wikipedia.org:443:195.200.68.224:443 https://en.wikipedia.org/wiki/Internet_protocol_suite
$ sudo ip tcp_metrics | grep fo_cookie

That should then show a TFO cookie for the load balancer in MAGRU.

Change #1275750 merged by Slyngshede:

[operations/puppet@production] R:cache::text enable TCP Fast Open

https://gerrit.wikimedia.org/r/1275750