WireGuard handshake health: what the numbers actually mean

Ask WireGuard how it is doing and you get one number per peer: seconds since the latest completed handshake. Interpreting that number correctly is most of the battle.

A healthy always-on tunnel rehandshakes roughly every two minutes under REKEY_AFTER_TIME (120s). So a peer showing an age of 90–150 seconds is cycling normally. An age of ten minutes is not "a bit stale" — it means no key exchange has succeeded for five normal cycles, which almost always indicates a real problem.

The three failure signatures

Flat growth with traffic still flowing usually means one side lost its route but something else is carrying packets — check for policy routing surprises. Flat growth with zero tx on your side means your outbound never reaches the peer: endpoint wrong, UDP blocked, or the peer's port changed. Rapidly increasing handshakes with tiny gaps between them (retry storm) typically indicate mismatched keys — both sides keep trying because neither accepts the other's initiation.

None of these are distinguishable from "the server is up" by any external port or ping check. They only become visible when you either read wg state on the box or do what ExitProbe does: attempt a full session from outside and measure whether data actually flows.

What to alert on

Do not alert on absolute handshake age alone — a quiet idle tunnel legitimately stretches past REKEY thresholds. Alert on age combined with failed data transfer: if verification traffic cannot traverse within one interval plus margin, the tunnel is down regardless of what the counters claim.

That combination — active transfer test as the source of truth, handshake metadata as context — is exactly how ExitProbe scores WireGuard monitors, and why its failures line up with user experience far better than reachability checks.