How does Tomcat behave under a level of load that it cannot handle? One would expect connections to be refused - so that a load balancer in front can fail-over to another instance. But in reality one would see connections being established and subsequently reset, even after sending a partial or full request by the client, making it difficult for fail-over, especially when non-idempotent service calls are being made.