I have also a cacti graph, representing the state of tcp connections for the period of the accident: http://unix.zhegan.in/files/tcp_connections.png looks like handshakes were fine, but the the exchange was stalled for each stream. Posted at Nginx Forum: http://forum.nginx.org/read.php?2,240568,241466#msg-241466