Twelve hours of samples proved a port unused. It wasn't.

The problem

A port on a production service was believed unused, and the question was whether it could be closed. Rather than guess, a census was run: every five minutes for twelve hours, list the established connections on that port and record what was there.

Twelve hours of samples. Nothing, every time. The port was closed.

It broke immediately, and it broke wide: an energy monitor, an entire lighting fleet, a set of children’s audio players, and more. All of them fire a sub-second request roughly once a minute and then disconnect. Not one of those connections ever coincided with a five-minute sample.

Eighteen dropped packets confirmed the real usage within minutes of the change.

The design

The census was not sloppy. It ran for twelve hours, it was automated, it produced a clean dataset and it answered the question it was asked. The question was the wrong one.

A sampler of persistent state cannot see a transient event. Photographing a road every five minutes and concluding it is never driven is the same instrument error. The census measured standing connections; the consumers had none to measure.

The corrected method inverts what is observed. To prove a service or port is unused you log every access attempt, not the state between attempts:

a firewall DROP rule with logging enabled, or a passive capture of connection attempts;
run across a window that spans the consumers’ cadence, not an arbitrary duration;
and the finding is only unused when the log of attempts is empty — never when a snapshot of state was.

The general form of the rule now sits in the estate’s prime directives: absence of an observed connection is not proof of an absent consumer, and — more broadly — the acceptance test for any change must observe the artifact the consumer actually receives, never an upstream stand-in that merely correlates with it.

The trade-off

Attempt-logging is more intrusive than state-sampling. It touches the firewall, it produces volume, and on a busy port it needs a retention plan. State-sampling is free, safe and can be run from anywhere.

That asymmetry is exactly why the wrong method got chosen — it was the cheap one, and it produced a clean, confident, plausible answer. The rule that came out of it is therefore not “always use packet capture” but a classification step that costs nothing:

Before measuring, decide whether the thing being measured is standing state or a transient event. Sample the first. Log the second. They need different instruments and the outputs look identical.

The residual risk was accepted rather than engineered away, and recorded as an accepted residual with the census limitation written into it — so the next person to read “census-verified unused” also reads what the census could not see.

The evidence

Eighteen dropped packets, captured at the firewall within minutes of the change, from device classes the twelve-hour census had reported as absent.
The consumers’ actual cadence — a sub-second connection roughly once a minute — was measured after the fact and is what makes the five-minute sampling interval provably blind.
The limitation is recorded on the decision itself rather than in a postmortem, so the claim “verified unused” cannot be re-read later without its caveat.

This is one of the estate’s named failure classes — an instrument that cannot observe the event it is being used to rule out — and it is loaded into every operating session as a control rather than filed as a story. The taxonomy is on the agent operations page.