Linux Kernel Parameters

Linux Kernel Parameters
Kernel Parameters

Long-term update

SYN_RECV

The server has received sys and has not sent syn + ack
1.net. ipv4.tcp _ synack_retries
The default value is 5. linux corresponds to 1 + 2 + 4 + .. 32 = 2 ^ 6-1 = 63 s.

2.net. ipv4.tcp _ syncookies
It should be set to 1 to prevent SYN Flood.
TCP connections in SYN_RECV are called semi-connections and stored in SYN queues. A large number of SYN_RECV will cause queue overflow, and subsequent requests will be directly discarded by the kernel, that is, SYN Flood attacks.
After syncookies are enabled, when the SYN queue is full, TCP creates a special Sequence Number (also called cookie) through the original address port, destination address port, and timestamp and sends it back, the attacker will not respond. If the connection is normal, The SYNCookie is sent back, and the server can establish a connection through the cookie (even if it is not in the SYN queue ).
Do not use tcp_syncookies to handle regular large load connectionsBecause syncookies are a compromised version of TCP protocol and are not rigorous. For normal requests, three TCP parameters can be adjusted.
1. tcp_max_syn_backlog reduces the number of retries
2. tcp_max_syn_backlog increases the number of syn connections
3. tcp_abort_on_overflow cannot process the connection.

CLOSE_WAIT

The passive shutdown party receives the FIN and sends the ACK in the CLOSE_WAIT status. This status is usually caused by the failure to close () in time. By default, it will last for 2 hours.

TIME_WAIT

When either party is active, the socket will wait for 2msl time in TIME_WAIT.
1.net. ipv4.tcp _ fin_timeout
The default value is 60. TCP stays in the FIN_WAIT2 state and is directly in the CLOSED state after timeout. Therefore, reducing tcp_fin_timeout helps reduce the number of TIME_WAIT instances. Note: Although shutdown (SHUD_WR) is in the FIN_WAIT2 status, the timeout does not work.

2.net. ipv4.tcp _ tw_recycle
The default value is 0. enable quick TIME_WAIT socket reclaim.
If tcp_timestamps is enabled, the latest timestamp of each connection is cached. If the subsequent request timestamp is smaller than the cached timestamp, the request is regarded as invalid and the corresponding packets are discarded. Therefore, in a nat or Server Load balancer environment, data packets may be discarded.

3.net. ipv4.tcp _ tw_resue
The default value is 0. Whether to reuse the TIME_WAIT status socket for new connections
This option is more secure than tcp_tw_recycle. From the Protocol perspective, reuse is safe.
Reuse conditions for online search:

1. The tcp_timestamps option must be enabled (the client must also be enabled)
2. The condition for reusing TIME_WAIT is that more than 1 s after receiving the last package

4.net. ipv4.tcp _ timestamps
The default value is 1. The timestamp is added to tcp to avoid serial number wrapping and more precise RTT calculation. This option should be enabled for better performance.

5.net. ipv4.tcp _ max_tw_buckets
The default value is 180000, and the maximum value is TIME_WAIT.

TCP optimization

1.net. ipv4.tcp _ moderate_rcvbuf
The default value is 1. Whether to automatically adjust the TCP receiving buffer size. When SO_SNDBUF is set in programming, SO_RCVBUF will automatically adjust these connections.
2. net. ipv4.tcp _ adv_win_scale
The default value is 2. 1/(2 ^ tcp_adv_win_scale) is used as the application read cache, so the maximum accept sliding window can only reach 3/4 of the read cache.

3.net. ipv4.tcp _ rmem
4096 87380 6291456
The first is to accept the minimum buffer byte.
The second is to accept the initial value of the buffer length, which is used to initialize the sock sk_rcvbuf and will replace rmem_default.
The third is to accept the maximum buffer length, which is used to adjust sock's sk_rcvbuf

4.net. core. rmem_default
Default accept window size (in bytes) for all protocols)
The reasonable value of the accept window (rwnd) depends on BDP (the product of bandwidth and latency). Assume that the bandwidth is 100 Mbps and the latency is 100 ms.
BDP = (100 Mbps/8) * (100/1000) = 1.25 M
Because tcp_adv_win_scale overhead exists, the cache value is as follows:
BDP/(1-1/(2 ^ tcp_adv_win_scale ))

5.net. ipv4.tcp _ window_scaling
The default value is 1. Whether to enable windows scaling. To enable a window larger than 64 KB, you must enable it.

6.net. ipv4.tcp _ sack
The default value is 1. Whether to enable the sack (selective ack) and report the received data fragments. This solves the problem of fast retransmission and does not know whether to re-transmit subsequent data.

Congestion window

The congestion window (cwnd) is an internal parameter of the sender to avoid network congestion,
You can use the following command to quickly increase the capacity of cwnd through a slow start, and the initial value of the Linux2.6 kernel is 3 * MSS. To improve the transmission efficiency, the value after Linux3.0 is 10 * MSS.

[root@10-9-22-239 ~]# ip route showdefault via 10.9.0.1 dev eth0 10.9.0.0/16 dev eth0  proto kernel  scope link  src 10.9.22.239 172.17.0.0/16 dev docker0  proto kernel  scope link  src 172.17.42.1 [root@10-9-22-239 ~]# ip route change default via 10.9.0.1 dev eth0 initcwnd 10[root@10-9-22-239 ~]# ip route showdefault via 10.9.0.1 dev eth0  initcwnd 1010.9.0.0/16 dev eth0  proto kernel  scope link  src 10.9.22.239 172.17.0.0/16 dev docker0  proto kernel  scope link  src 172.17.42.1

Out of socket memory

Cause

1. There are many orphan (orphan) socket
2. the tcp socket has exhausted the allocated memory.
Tcp socket uses page count. The default value is 4096 bytes in linux.

getconf PAGESIZE

1./proc/net/ipv4/tcp_mem
365664 487552 731328
When less than 365664 page is used, kernel does not intervene in it
When more than 487552 pages are used, the kernel enters "memory pressure"
When tcp is used more than 731328, the following error occurs: Out of socket memory.

2./proc/net/sockstat

sockets: used 307TCP: inuse 13 orphan 0 tw 0 alloc 34 mem 6UDP: inuse 6 mem 2UDPLITE: inuse 0RAW: inuse 0FRAG: inuse 0 memory 0

You can view the current socket memory status by comparing tcp_mem.

Orphan socket

1. The connection between FIN_WAIT1 and LAST_ACK is an orphan socket.
2. Add FIN_WAIT2 to tw status statistics instead of orphan socket
3. CLOSE_WAIT does not include the statement of orphan or tw.

fs

1. fs. file-max
Maximum number of files that the system can open
Fs. file-max indicates the file handle that can be opened at the system level, and ulimit-n controls the number of files that a user process can open.
Recommended memory/10 k

grep -r MemTotal /proc/meminfo | awk '{printf("%d",$2/10)}'

2. fs. file-nr read-only file
1984 0 65535
The first represents the number of currently allocated file handles, and the third represents the maximum number of file handles allocated by the system (same as file-max)
File-nr is generally smaller than lsof | wc-l, but the order of magnitude is the same.

vm

1. vm. dirty_background_ratio
The default value is 10.
The kdmflush daemon is responsible for synchronizing all pages related to the file system to the disk. When the number of dirty pages in the memory exceeds 10%, kdmflush starts to write back.

kswapd

The kswapd daemon ensures that the memory remains free. It monitors the pages_high and page_low standards in the kernel. If the free memory is smaller than pages_low, kswapd starts scanning and tries to recycle 32 pages each time, until the idle memory is greater than pages_high.
Kswapd performs the following operations:

1. If the page is not changed, it will put the page into the free list
2. If the page changes and is written back by the file system, it writes the page to the disk.
2. If the page changes and is not written back by the file system, it writes the page to the swap device.

Buff: physical memory buffer size for read () and write ()
Cache: the number of physical memories mapped to the process address space.

1. When a large amount of data is read into the memory (bi) from the disk, the cache value will continue to increase
2. The swapd value in vmstat is increasing, indicating that kswapd is writing dirty pages to the swap space (so)
3. The buff value is decreasing, indicating that kswapd is continuously reclaiming memory.