# Exercise 1 — Sockets, Listeners, and Reuse

## Scenario

Your team's monitoring dashboard is showing a spike in "connection refused" errors on one service, while a second, unrelated service is throwing "address already in use" on deploy. You need to reason precisely about ports and sockets to tell these apart from other possible failures.

## Deliverables

1. **Socket identification.** A load-balanced web server at `203.0.113.10:443` is handling three simultaneous HTTPS connections from the same client machine (`198.51.100.7`), because the client opened three browser tabs. Write out the full 4-tuple for each of the three connections, using distinct plausible ephemeral port numbers, and explain concretely why the OS can tell all three apart despite the server IP and port being identical in all three.

2. **Refused vs. filtered.** You run a connectivity check against two hosts:
   - Host A returns an immediate TCP RST on port 8080.
   - Host B never responds at all on port 8080, and your check eventually times out.

   Explain what's most likely happening on each host in terms of what's actually listening (or not) versus what's actively blocking traffic, referencing the theory file's explanation of RST behavior and firewall filtering.

3. **"Address already in use" diagnosis.** A teammate deploys a new version of a service that binds TCP port 9000, and it fails immediately with "address already in use." Using what you know about the OS socket table, list two distinct, concrete root causes that could produce this exact error (not just "something is using the port" — name what specifically could be different from the simple case, e.g. the old process not exiting cleanly).

4. **TIME_WAIT under load.** A service opens a brand-new outbound TCP connection to a downstream API for every single request it handles, instead of reusing connections, and it's currently handling 5,000 requests per second. Using the theory file's explanation of ephemeral ports and TIME_WAIT, explain the specific failure mode this design risks under sustained load, and propose one concrete fix.

5. **TCP/UDP independence check.** True or false, with justification: "If `netstat` shows nothing listening on UDP port 53, then DNS over TCP on port 53 must also be unavailable." Use the theory file's explanation of independent namespaces to justify your answer.

## Notes

- Where you're reasoning about OS-level behavior (deliverable 3), it's fine to name a plausible mechanism even if you'd need to verify it with real tooling (`lsof`, `ss`, `netstat`) in practice — the goal is sound reasoning from the socket-table model in the theory file.