A service intermittently times out connecting to a managed database. The database is healthy, nothing changed, and failures correlate with traffic volume. Where do you look?

The likely cause

NAT gateway port exhaustion.

Source NAT maps each outbound connection to a source port on the gateway's address. The number of simultaneous connections to a single destination address and port is bounded by the ephemeral port range — roughly 55,000. A service opening many short-lived connections to one endpoint approaches it, and new connections fail while existing ones are fine.

The symptom pattern fits exactly: correlates with load, not with any change; destination provably healthy; intermittent rather than total.

Confirm it

The NAT gateway publishes a port allocation error metric. It exists for this and is almost never on a dashboard. Add it, with an alert.

Fixes, in order

Connection pooling and keep-alive — the largest and cheapest win. A pool of 50 reused connections replaces thousands opened per second. Check the framework's default; many HTTP and database clients open a connection per operation unless configured.

A private endpoint for the managed service — traffic bypasses NAT entirely. It is also usually cheaper, because NAT charges per gigabyte processed, and more secure, because traffic never leaves the provider network. This is frequently the correct permanent answer.

One NAT gateway per availability zone — the standard pattern for resilience anyway, and it multiplies the port ceiling.

Close connections promptly; a connection left open until timeout holds its port allocation for the full duration.

The general lesson

Shared infrastructure has invisible limits. NAT ports, connection tracking table size, load balancer connection limits, ephemeral port ranges on hosts, file descriptor limits. None appear in application metrics, and all produce the same confusing signature: works fine, then intermittently does not, in proportion to load.

Knowing these limits exist and instrumenting them is what distinguishes a two-hour diagnosis from a two-week one.