---

```
sudo /usr/sbin/sysctl -w net.inet.tcp.tso=0 && (
  for tb_sample in 1 2 3; do
    sleep 10
    date -u
    netstat -an -p tcp | awk '/194[.]186[.]63[.]/ && /ESTABLISHED/ {print}'
  done

  dig @172.21.0.1 jss.corp.mail.ru A +time=5 +tries=1 +notcp +ignore +noall +comments +answer
  dig +tcp @172.21.0.1 jss.corp.mail.ru A +time=5 +tries=1 +noall +comments +answer

  /usr/bin/curl -q -4 --noproxy '*' \
    --connect-timeout 8 --max-time 15 -sS -o /dev/null \
    -w 'JSS ip=%{remote_ip} dns=%{time_namelookup} tcp=%{time_connect} tls=%{time_appconnect} http=%{http_code} total=%{time_total}\n' \
    'https://jss.corp.mail.ru:8443/'
)
```

Then **open Self Service** and report whether it loads, alongside the command output. The curl test uses normal DNS and verifies TLS.

This time TSO stays disabled for validation. To undo it:

```
sudo /usr/sbin/sysctl -w net.inet.tcp.tso=1
```