**PSA: If Nicotine+ or SoulSeek keeps dropping connection every 10-30 minutes and you have a UniFi router, check your IPS logs**
Spent way too long on this. Nicotine+ would connect fine, run for somewhere between 10 and 30 minutes, then drop. Auto-reconnect would fail repeatedly for several minutes before eventually coming back — but only if I changed the server port. Switch to 2242, works again. Switch back to 2416, works again. Didn't matter which port, just had to change it.
I went down the usual rabbit holes. UPnP lease expiry (my listening port is manually forwarded so not relevant). ISP throttling (I'm on FiOS, and the connection always came back on its own eventually, which ruled that out). Soulseek server flakiness. Nothing fit perfectly.
Eventually I pulled the IPS logs on my UDM Pro and found this firing right at the moment of every disconnect:
ET MALWARE NanoCore RAT Keepalive Response 3
NanoCore is a RAT, and apparently the Soulseek server's keepalive packets match its C2 heartbeat signature byte-for-byte. So after enough traffic flowed, the IPS would catch a keepalive, decide it was malware, block the connection, and then keep blocking reconnection attempts to that IP for a few minutes. Changing the server port forced a reconnect which reset the flow state and bought more time until the next keepalive.
Fix is easy once you know what you're looking for: in the UniFi threat management logs, find the blocked event and hit "suppress signature for source IP" on it. Took about 10 seconds.
Hopefully this saves someone else the headache.