Explore how to reduce the number of Linux server time_wait too many problems _linux

The meaning of the TIME_WAIT state:
The port status of the server-side connection is time_wait after the client closes the socket after the TCP/IP connection is established on the server side
is not all the active closed socket will enter the TIME_WAIT state?
Is there any case that the active closed socket directly into the closed state?
Active shutdown of the party after sending the last ACK will enter the TIME_WAIT state stay 2MSL (max segment lifetime) time, this is the TCP/IP is essential, that is, "solve" not.
That's what TCP/IP designers were designed to do.

There are two main reasons
1. Prevents packets from the last connection from being lost and appearing again, affecting new connections (after 2MSL, all duplicate packets from the previous connection will disappear)
2. Reliable shutdown of TCP connections
The last ACK (FIN) sent by the active shutdown is likely to be lost, when the passive side will resend the fin, and if the active party is in the CLOSED state, it will respond to RST instead of ACK. So the active side should be in the TIME_WAIT state, but not the CLOSED.
Time_wait does not take up a lot of resources unless it is attacked.
In Squid server, you can enter the following command:
#netstat-N | awk '/^tcp/{++s[$NF]} end {for (a in S) print A, s[a]} '
Last_ack 14
SYN_RECV 348
Established 70
Fin_wait1 229
Fin_wait2 30
CLOSING 33
Time_wait 18122
Status: Description
CLOSED: No connection is active or in progress
LISTEN: The server is waiting to enter the call
SYN_RECV: A connection request has arrived, waiting for confirmation
Syn_sent: Application has started, open a connection
Established: Normal data transfer status
FIN_WAIT1: Application says it's done
Fin_wait2: The other side has agreed to release
Itmed_wait: Waiting for all groups to die
CLOSING: Both sides try to close at the same time
Time_wait: The other side has initialized a release
Last_ack: Waiting for all groups to die
That is, this command can subtotal the current Linux server's network connectivity status.
Let's explain why you write this:
A simple pipe character connects the Netstat and awk commands.
First Look at Netstat:
Netstat-n
Active Internet connections (w/o servers)
Proto recv-q send-q Local address Foreign
TCP 0 0 123.123.123.123:80 234.234.234.234:12345 time_wait
When you actually execute this command, you may get thousands of records like the one above, but one of them will suffice.
Take another look at awk:
/^tcp/
Filter out the record of the beginning of TCP, shielding UDP, socket and other unrelated records.
State[]
is equivalent to defining an array named state.
Nf
Represents the number of fields in a record, as shown in the record, NF equals 6
$NF
Represents the value of a field, such as the record shown above, $NF that is $ $, which represents the value of the 6th field, which is time_wait
state[$NF]
Represents the value of an array element, such as the record shown above, the number of connections in the state[time_wait] state
++state[$NF]
To add a number to a, as shown in the record, is to put the state[time_wait] state of the connection number plus a
End
Represents the command to be executed in the final phase
for (key in)
traversing an array
Print key, "\ T", State[key]
Print the keys and values of the array, with a \ t tab in the middle to beautify.
If the system is found to have a large number of time_wait state connections, by adjusting the kernel parameters to solve,
Vim/etc/sysctl.conf
Edit the file and add the following:
Net.ipv4.tcp_syncookies = 1
Net.ipv4.tcp_tw_reuse = 1
Net.ipv4.tcp_tw_recycle = 1
Net.ipv4.tcp_fin_timeout = 30
The/sbin/sysctl-p is then executed to make the argument effective.
Under Linux high concurrency squid server, TCP time_wait socket number often reached 20,000 or 30,000, the server can easily be towed to death. By modifying the Linux kernel parameters, you can reduce the number of time_wait sockets on the squid server.
Vi/etc/sysctl.conf
Add the following lines: reference
Net.ipv4.tcp_fin_timeout = 30
Net.ipv4.tcp_keepalive_time = 1200
Net.ipv4.tcp_syncookies = 1
Net.ipv4.tcp_tw_reuse = 1
Net.ipv4.tcp_tw_recycle = 1
Net.ipv4.ip_local_port_range = 1024 65000
Net.ipv4.tcp_max_syn_backlog = 8192
Net.ipv4.tcp_max_tw_buckets = 5000
Description:
Net.ipv4.tcp_syncookies = 1 means to open syn Cookies. When the SYN wait queue overflow occurs, cookies are enabled to handle, to prevent a small number of SYN attacks, the default is 0, indicating shutdown;
Net.ipv4.tcp_tw_reuse = 1 means to turn on reuse. Allows time-wait sockets to be re used for a new TCP connection, which defaults to 0, indicating shutdown;
Net.ipv4.tcp_tw_recycle = 1 is a quick recycle of time-wait sockets on a TCP connection, and the default is 0, which means shutdown.
Net.ipv4.tcp_fin_timeout = 30 indicates that if the socket is closed by the local end, this parameter determines how long it remains in the fin-wait-2 state.
Net.ipv4.tcp_keepalive_time = 1200 means the frequency at which TCP sends keepalive messages when KeepAlive is enabled. The default is 2 hours, and 20 minutes instead.
Net.ipv4.ip_local_port_range = 1024 65000 indicates the range of ports used for outward joins. Small by default: 32768 to 61000, 1024 to 65000.
Net.ipv4.tcp_max_syn_backlog = 8192 Indicates the length of the SYN queue, the default is 1024, and the queue length is 8192, which can accommodate more network connections waiting for connections.
Net.ipv4.tcp_max_tw_buckets = 5000 indicates that the system maintains the maximum number of time_wait sockets at the same time, and if this number is exceeded, the time_wait socket is immediately cleared and the warning message is printed. The default is 180000, and 5000 is changed. For Apache, Nginx and other servers, the parameters on a few lines can well reduce the number of time_wait sockets, but for squid, the effect is not. This parameter controls the maximum number of time_wait sockets and avoids the squid server being dragged to death by a large number of time_wait sockets.
Perform the following command to make the configuration effective:
/sbin/sysctl-p