Often when using Firefox 73.0.1 in Xubuntu 18.04 to browse a web forum about a retrocomputing hobby,* I see 30-minute periods when all connections to that website time out but connections to other websites and non-web Internet resources continue to work. Checking through the website "Down for Everyone or Just Me?" during such an outage shows that the outage affects only me, as does asking other users on a Discord server and an IRC channel related to the website's subject matter.

Comparison of a traceroute to the server during both working and outage periods shows that my packet stops just as it leaves Cogent's network. I have evidence (from a source that I cannot disclose publicly) that the first IPv4 address after the packet leaves Cogent is the IP address of a firewall that sees a bunch of SYNs (the first packet in a TCP outgoing connection) from my IP address and blocks my home Internet connection's IP address as a measure against denial of service (DoS).

I managed to capture getting blocked using Wireshark on my laptop's WLAN interface. (It has no wired Ethernet interface.) The packet log shows 19 SYN packets from my laptop for the first page view and 17 for the second, each with a different ephemeral port, most of which it immediately closes with RST. This burst of 36 SYNs in 4 seconds appears consistent with what my source told me.

So I want to limit Firefox's rate of connection to that site and only that site. Turning off these settings in about:config did not help:

  • network.http.speculative-parallel-limit
  • network.prefetch-next

Others have suggested reducing network.http.max-persistent-connections-per-server, but I hesitate to reduce this because it would slow access to all other websites as well. Is there a way to keep Firefox from being too eager to connect to websites under a particular domain name while behaving as usual for other websites?

* I hesitate to name the website for fear of appearing to unduly promote it.

  • What I hope to achieve is the ability to use that website without having to repeatedly wait out 30 minute blocks. I expect to solve the problem by preventing Firefox from making enough connections to trigger the DoS countermeasure. Mar 4, 2020 at 22:20
  • As I wrote in the question, I came to that conclusion because I was told that my IP address was sending too many SYNs in quick succession to the server's IP address. Where would I go to find recommendations about proxies, VPNs, or other networks with which to test? Mar 5, 2020 at 23:10

1 Answer 1


Try disabling the race cache with network (RCWN) feature in Firefox.

The Race Cache With Network (RCWN) feature in Necko adds the ability to race the cache with the network when the cache is slow. So if reading from the disk is slow, we will send a network request, and return the channel from the network, even though we have the entry in the cache. This way we provide the content to consumers faster.

An answer by David Balažic to "How to turn off network probing in Firefox?" on Stack Overflow stated that RCWN can cause exactly the sort of misbehavior I was seeing.

I opened Wireshark, recorded my connections to this website using the host example.com capture filter, switched back to Firefox, opened Web Developer > Network (Ctrl+Shift+E), and browsed around until I hit a page that caused Wireshark to show ten or more SYNs for one page view. Whenever this happened, things like 174 B (raced), 336 B (raced), and 248 B (raced) showed up in the log. I opened about:config, changed network.http.rcwn.enabled to false, and browsed some more. The misbehavior ceased.

I can understand how RCWN might help on a 5400 or 7200 RPM mechanical HDD with heavy file traffic going on in other applications, particularly on an operating system where real-time antivirus is the norm. But because my Xubuntu laptop has a Samsung SSD, I highly doubt that I need RCWN.

The excessive connections generated by RCWN have been reported to Mozilla as bug 1622859.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.