Stratum Proxy Disconnects Worker After Timeout

Restart the stratum proxy: `systemctl restart ckproxy` / `braiins-farm-proxy` / `public-pool` (or your container equivalent). Watch for 30 minutes. If disconnects vanish for hours and creep back, you are on memory-leak territory — escalate to Tier 3. If they vanish permanently, the proxy was wedged but no underlying problem exists yet.

Lower the worker's starting difficulty so it submits more shares per minute, reducing idle gaps. On Bitaxe / NerdMiner: set `suggest_difficulty=512` in AxeOS. On cgminer / bmminer / DCENT_OS: append `--diff 512` or set the equivalent pool option. More shares = less idle time = no timeout. Trade-off: marginally higher proxy CPU. Watch a Pi-class proxy host's load.

Raise the proxy's idle timeout. ckpool: edit ckpool.conf and set `"client_timeout": 600`. Braiins Farm Proxy: `[connection] idle_timeout_s = 900` in its config. public-pool: edit config.json `idle_timeout_ms`. Restart the proxy. 600 seconds is a sane upper bound; longer hides genuinely-dead workers.

If your proxy supports per-worker-name routing (ckpool, Braiins Farm Proxy do), pin slow workers to a low-traffic backend so a 0.5 TH/s Bitaxe is not competing for socket attention against a 100 TH/s S19 fleet. This eliminates a class of edge cases where the proxy starves slower workers.

Enable proxy-side worker keepalive. Some proxies (Braiins Farm Proxy >= 2024.x, ckpool with keepalive patch) emit `mining.ping` or zero-payload TCP keepalives every 30 s to keep middleboxes happy. Toggle the config flag and restart. Free fix when supported.

Tune kernel TCP keepalive on the proxy host: `sysctl -w net.ipv4.tcp_keepalive_time=60`, `tcp_keepalive_intvl=15`, `tcp_keepalive_probes=4`. Persist via /etc/sysctl.d/99-stratum.conf and `sysctl --system`. Sends TCP keepalives every 60 s — middlebox-friendly, free, no proxy reconfig needed.

Enable `SO_KEEPALIVE` in the proxy config (`enable_tcp_keepalive: true` or equivalent). Without this socket-option flag, the kernel sysctl in step 6 does not apply to the proxy's sockets. Required pairing.

On the home/office router, replace UPnP-mapped proxy port forwards with static port forwards. UPnP entries get reaped under router memory pressure — this is one of the silent killers of long-lived stratum sessions on consumer routers. Static maps survive forever.

If your ISP gives a CGNAT-only IPv4, your remote workers reach the proxy through two NATs. Solve with a WireGuard tunnel from each worker site to the proxy site (proxy host as endpoint), purchase a static IPv4 from the ISP, or relocate the proxy to a $5/month VPS instead of behind your residential router.

Stand up Prometheus + Grafana on the proxy. ckpool / public-pool / Braiins Farm Proxy all expose metrics. Alert on: `worker_count` drops > 10% in 60 s, `upstream_disconnects_total` rate-of-change, `proxy_rss_bytes` growth > 5%/hour. You catch the failure before users do.

Configure a backup upstream pool. ckpool supports failover natively; Braiins Farm Proxy supports primary + backup pools. With failover, an upstream pool flap reroutes the proxy instead of cascading a kill to all downstream workers. Validate failover by stopping the primary upstream temporarily during off-peak hours.

Update the proxy to its latest tagged release. `git pull && make` for source builds, `apt upgrade` for distro packages, `docker pull` for container deployments. Read the changelog. ckpool fixed nullptr on malformed `mining.set_extranonce` in 2023; public-pool forks are still actively patching memory leaks; Braiins Farm Proxy SV2 builds had handshake regressions resolved in 2024. Don't run year-old proxy binaries.

A/B test a different proxy implementation. If you are on slush0 stratum-proxy (unmaintained), migrate to ckpool-proxy (active SV1) or Braiins Farm Proxy (active SV1+SV2). Run both proxies on different ports for a week, observe disconnect rate per side. The Mining Hackers' 2026 default: Braiins Farm Proxy for SV2-capable farms, ckpool for SV1-only.

Build the proxy from source with debug symbols (`./configure --enable-debug && make`). Capture `strace -p <pid> -e trace=network -tt` for 60 seconds during a disconnect, or attach `gdb` if you suspect a panic. The system call sequence reveals exactly which side closed the socket and why. File a GitHub issue with the trace if it's a proxy bug — open-source maintainers respond fast when you bring data.

Profile proxy memory under load. Use `heaptrack` (fast, prod-safe) or `valgrind --leak-check=full` (slow, dev only). If RSS grows linearly with worker-hours, you have a leak. Cron-restart is a band-aid; submitting the patch upstream is the cure and earns you a credit in the next release.

For Antminer fleets behind a proxy, flash DCENT_OS — D-Central's own open-source Antminer firmware. DCENT_OS exposes `pool_reconnect_count` metrics and structured stratum logs over its API; you stop guessing whether the worker or the proxy is at fault because the worker is now telling you. Alternatives if preferred: Braiins OS+, LuxOS, Vnish — all expose stratum reconnect counters too. Stock Bitmain firmware does not.

Stop DIY when: mixed-firmware fleet drops behind one proxy with no reproducible pattern, SV1<->SV2 translation is failing for a subset of workers, you've patched and swapped and profiled and disconnects persist beyond 1% of session-hours, or the upstream pool operator says it's your proxy and you say it's their pool. Book a D-Central Mining Consulting slot — independent third-party debugging settles it.

D-Central consult deliverables: live `tcpdump` and `strace` on your proxy host, log review with the upstream pool operator, proxy config audit (idle timeouts, keepalive, vardiff start, failover URLs), firmware audit per fleet (DCENT_OS / Braiins OS+ / Vnish / LuxOS recommendations), and either a written report with config diffs or hands-on remediation. Engagement scope sets the cost.