Unit 3.8 · about 3 h
256 / 324Deterministic network fault injection
Robustness claims are predictions until a fault schedule runs. This unit builds the harness the milestone's fault-tested service slice depends on, with the deterministic schedules of systems/concurrency-bounded-work/schedule-testing-contention.
- implement
- measure
You can now
- Implement a deterministic proxy that injects delay, duplicate, drop and restart faults on a framed protocol.
- Measure timeout, duplicate and disconnect behavior and state the resulting delivery guarantee precisely.
- Write the fault matrix the section mini-project will execute.
Covers
- Deterministic delay, disconnect, duplicate and restart injection
Study, in this order
3 steps
- Replicated Log and Stream Processor: protocol sliceReplicated Log and Stream Processor - protocol slice
The deterministic network fault list (delay, duplicate, disconnect, restart and companions); the protocol requirements for the single-node framed service; the delivery-contract questions
Depth · Use only the fault list and the single-node protocol slice. Replication and consensus stay in the later project.
- Failure modes and unknown outcomesAlgoMaster Networks - pcap and concurrent server labs
A Network Call Has Several Failure Points; Timeouts Turn Unbounded Waiting into a Decision; Known Failure, Known Success, and Unknown Outcome
- Observable overload and failure behaviorAlgoMaster Networks - pcap and concurrent server labs
Overload Behavior Is Observable; Failure Behavior; Common Failure Patterns
Depth · Read for the failure-injection checklist; you already implemented the server contract in the sockets unit.
Focus on
- Deterministic means seeded and scripted: same fault schedule, same interleaving, same verdict. Random chaos finds bugs; only replayable schedules prove fixes.
- Inject above TCP when testing the protocol (duplicate frames, truncated writes, slow reads) and at the connection level when testing the path (delay, drop, restart).
- Each fault has an expected client observation: delay past deadline gives timeout with unknown outcome; duplicate gives one effect under keys; drop gives disconnect with unknown outcome.
- Restart is two faults at once: in-flight requests resolve as unknown, and post-restart state must reconcile pre-restart keys by policy.
Reproduce closed-book
Traps
- Counting a passed clean-path test as fault coverage. Timeouts, duplicates and restarts exercise different code than the happy path.
- Driving fault timing from wall-clock sleeps with tight deadlines. Slow machines flake; script explicit fault steps with generous margins.
- Logging faults only at the injector. Verdicts need client observation, server state and the schedule in one record, or failures cannot be replayed.
Practice
The section mini-project covers this: the full fault matrix (partial, coalesced, oversized, malformed, timeout, duplicate, disconnect, restart) against the versioned framed service, with replayable schedules and verdict records.
Self-test
-
The delay fault fires but the client still reports success. Is the test wrong?
Either the deadline exceeds the injected delay or the client has no deadline. A fault test must assert the client observation, not just run the injector. -
Why must the duplicate test read twice?
The first read succeeds in both correct and buggy servers. Only the second read shows whether a duplicate arrived, and the effect log shows whether it executed twice. -
The server restarts between request receipt and response. What may the client conclude?
Only that the outcome is unknown. The effect may or may not have committed; resolution needs a keyed status query after reconnect.
Completion criterion
Stop when
Your proxy replays a scripted fault schedule, every row records fault parameters with client observation and server state, and you can state the exact delivery guarantee in one sentence.
Mark passed, then open 4.1 Only mark this when you can do it without notes.Leads to
- 5.7 Distributed histories and deterministic failure simulation Lift the fault schedule to distributed histories and model checking.
- 6.5 Queue bounds, first saturation and open-loop load Separate fault behavior from overload behavior under open-loop load.
Comes after
- 3.4 Sockets, partial reads and writes, and message framingAttack the framer with scripted delay, duplicate and truncation faults.
- 3.6 Deadlines, retries and idempotency across RPCProve the deadline and duplicate handling under scripted faults.
- 3.7 Connection shutdown, pools and latency decompositionTest pool exhaustion and shutdown races under scripted faults.
Resources for this unit
- AlgoMaster Networks - pcap and concurrent server labs Use Reading a Packet Capture: A Real Bug and Building a Concurrent TCP Echo Server after the Beej implementation. Reproduce one packet-level observation and one admission, deadline or shutdown behavior in your independently written service.
- Replicated Log and Stream Processor - protocol slice Use only the protocol requirements, deterministic network fault matrix and delivery-contract questions. Build the single-node framed service now; keep replication and consensus for the later project.
Also in this section
- Beej's Guide to Network Programming - sockets to multiplexing Read What is a socket?, IP addresses and data structures, Client-server background, System calls or bust, Client-server examples, Slightly advanced techniques and sendall. Build the simple TCP pair first, then replace delimiter assumptions with a bounded length-prefixed protocol.
- Beej's Guide to Network Concepts - TCP and UDP path Read the OS and sockets, protocol layering, IP, UDP and TCP chapters alongside packet captures from your own client and server. Use it to explain transport behavior rather than memorize layer names.
- MIT 6.5840 - RPC, threads and fault vocabulary Read the introductory RPC and threads material plus the lab guidance. Use it to enumerate timeout ambiguity and duplicate effects. Stop before Raft and the full lab sequence.
- Designing Data-Intensive Applications, 2nd edition - Chapter 5 Read Formats for Encoding Data (printed pp. 163 to 177) for schema merits and compatibility, and Dataflow Through Services: REST and RPC (printed pp. 180 to 186) for service dataflow, version coexistence and the idempotence pointer.
- gRPC Deadlines guide Read Overview, Deadlines on the Client and Deadline Propagation for absolute deadlines, remaining-time forwarding and clock-skew shielding.
- gRPC Status Codes Read the full status list, including
DEADLINE_EXCEEDED,UNAVAILABLEand the codes never generated by the library, for the error taxonomy. - W3C Trace Context Read Section 3.2 for the
traceparentformat and Sections 3.4 to 3.5 for the legaltraceparentandtracestatemutations when forwarding.