Linux Server Tuning

Linux kernel parameters http://space.itpub.net/17283404/viewspace-694350net.ipv4.tcp_syncookies=1indicates that SYN Cookies are turned on. When a SYN wait queue overflow occurs, Cookies are enabled to protect against a small number of SYN attacks, the default is 0, which means close; what is a syn cookies:http://www.ibm.com/developerworks/cn/linux/l-syncookie/Net.ipv4.tcp_tw_reuse=1means to turn on reuse. Allow the time-WAIT sockets is re-used for the new TCP connection, which defaults to 0, which means shutdown; net.ipv4.tcp_tw_recycle=1indicates that the time in the TCP connection is turned on-The fast recycle of WAIT sockets, which defaults to 0, indicates off. Net.ipv4.tcp_fin_timeout= -indicates that if the socket is closed by a local requirement, this parameter determines that it remains in the fin-wait-2 The time of the state. Net.ipv4.tcp_keepalive_time= -indicates the frequency at which TCP sends keepalive messages when KeepAlive is employed. The default is 2 hours. Net.ipv4.tcp_keepalive_probes=5TCP sends a keepalive probe to determine the number of times that the connection has been disconnected. (Note: Keeping a connection is only sent if the so_keepalive socket option is turned on.) The number of times does not need to be modified by default, although this value can also be shortened appropriately depending on the situation. Set to 5 more appropriate) NET.IPV4.TCP_KEEPALIVE_INTVL= theThe frequency at which the message is sent is multiplied by tcp_keepalive_probes to get the time to kill the connection that has not responded since the start of the probe. The default value is 75 seconds, which means that no active connections will be discarded after approximately 11 minutes. (For normal applications, this value is somewhat larger and can be changed as needed.) in particular, the Web server needs to be smaller, 15 is a more appropriate value) Net.ipv4.ip_local_port_range=1024x768 65000represents the range of ports used for an outward connection. Small by default: 32768 to 61000, 1024 to 65000. Net.ipv4.tcp_max_syn_backlog=8192represents the length of the SYN queue, which defaults to 1024, and a larger queue length of 8192, which can accommodate more network connections waiting to be connected. Net.ipv4.ip_conntrack_max=655360NetFilter "Tasks" (Connection tracking entries) that can be processed simultaneously in kernel memory another voice-Do not blindly increase ip_conntrack_max:http://blog.csdn.net/dog250/article/details/7107537net.ipv4.netfilter.ip_conntrack_tcp_timeout_established= thetracing the connection timeout end time Net.ipv4.tcp_max_tw_buckets=819200indicates that the system maintains the maximum number of time_wait sockets at the same time, and if this number is exceeded, the time_wait socket is immediately cleared and a warning message is printed. The default is 180000. Set to a smaller value this parameter controls the maximum number of time_wait sockets, preventing the server from being dragged to death by a large number of time_wait sockets. Net.core.somaxconn=262144defines the length of the maximum listening queue for each port in the system, and for a high-load Web service environment that often handles new connections, the default -it's too small. Net.core.netdev_max_backlog=262144This parameter determines the maximum number of packets that are allowed to be sent to the queue when the rate at which each network interface receives packets is faster than the rate at which the kernel processes these packets, and does not set too large Net.ipv4.tcp_max_orphans=262144The maximum number of TCP sockets that the system can handle that is not part of any process. If this amount is exceeded, then the connection that is not part of any process is immediately reset and a warning message is displayed. The reason to set this limit, purely to protect against those simple DoS attacks, do not rely on this or artificially reduce this limit, but should increase this value (if the memory is increased). Each orphan socket can eat up to 64K of non-exchangeable memory. Net.ipv4.tcp_orphan_retries=3How many retries are attempted before the local side attempts to close the TCP connection. The default value is 7, which is equivalent to 50 seconds~16 minutes (depending on RTO). If your machine is an overloaded Web server, you should consider reducing this value because such a socket consumes a lot of important resources. See Tcp_max_orphans.net.ipv4.tcp_timestamps=0Timestamp , 0 off, 1 on, in (refer to RFC1323The TCP header increases by 12 bytes, about the configuration's impact on time_wait and possible problems: http://huoding.com/2012/01/19/142, timestamps used in some other things, can guard against those forged sequence numbers. A 1G broadband line may re-encounter the old sequence number with out-of-line value (if it was due to the last generation). Timestamp will let it know it's an ' old bag '. (This file indicates whether it is enabled to enable calculation of RTT in a more precise way than a time-out, RFC 1323); This option should be enabled for better performance. )net.ipv4.tcp_synack_retries=1Tcp_synack_retries Shows or sets how many times the Linux core attempts to resend the initial Syn,ack packet in response to a SYN request before deciding to abandon it. This is the second step of the so-called three-segment hand grip (Threeway handshake). That is, how many times the system will try to establish a TCP connection from the remote start. The value of the tcp_synack_retries must be a positive integer and cannot exceed255。 Because every time you resend a packet, it will cost about -To +Seconds to wait before deciding to try the next resend or decide to give up. The default value for Tcp_synack_retries is5, that is, each connection is to be theSeconds3minutes) Before the timeout is determined. Net.ipv4.tcp_syn_retries=1for a new connection, the kernel will send a number of SYN connection requests before deciding to discard. should not be greater than 255, the default value is 5, which corresponds to about 180 seconds of time. (This value is high for networks with good physical communication for heavy loads and can be modified to 2. This value is only for external connections, the connection to come in, is determined by tcp_retries1) Net.ipv4.tcp_retries1=3How many retries are required before giving up a response to a TCP connection request. RFC specifies that the lowest value is 3, which is also the default value, depending on the RTO value of approximately 3 seconds-between 8 minutes. (Note: This value also determines the incoming SYN connection) Net.ipv4.tcp_retries2= theHow many retries are required before a TCP connection that is activated (established communication state) is discarded. The default value is 15, which is determined by the RTO value, which is equivalent to-30 minutes (RFC1122 specified, must be greater than 100 seconds). (This value is based on the current network settings, can be appropriately changed to small, my network changes in order to 5) Net.ipv4.tcp_sack=1using selective ack, it can be used to find a specific missing datagram-so it helps to recover the status quickly. This file indicates whether a selective answer (selective acknowledgment) is enabled, which can improve performance by selectively answering packets received by a random order (which allows the sender to send only the missing segment). (This option should be enabled for WAN traffic, but this increases CPU usage.) ) Net.ipv4.tcp_fack=1Open Fack congestion avoidance and fast retransmission function. (Note that this value, even if set to 1, is not valid when Tcp_sack is set to 0) Net.ipv4.tcp_dsack=1allow TCP to send "two identical" sack. Net.ipv4.conf.default.rp_filter=1Net.ipv4.conf.all.rp_filter=11- DoSource validation by reversed path, as specifiedinchRFC1812 Recommended option forSingle homed hosts and stub network routers. Could cause troubles forComplicated (not loop Free) networks running a slow unreliable protocol (Sortof RIP), or using static routes.0-No Source Validation.net.ipv6.conf.all.disable_ipv6=1Net.ipv6.conf.default.disable_ipv6=1deactivate the IPv6 module vm.swappiness=5default, swappiness can set to values between0and -Inclusive. A low value means the kernel would try to avoid swapping as much as possible where a higher value instead would MakeThe kernel aggressively try-to-use swap space.others:# avoids amplification attacks net.ipv4.icmp_echo_ignore_broadcasts=1# Turn on malicious ICMP error message protection net.ipv4.icmp_ignore_bogus_error_responses=1# Open SYN Flood attack protection Net.ipv4.tcp_syncookies=1# turn on and record spoofing, source Routing and redirect package Net.ipv4.conf.all.log_martians=1Net.ipv4.conf.default.log_martians=1# Handling of packet net.ipv4.conf.all.accept_source_route for passive routing=0Net.ipv4.conf.default.accept_source_route=0# Turn on reverse path filtering net.ipv4.conf.all.rp_filter=1Net.ipv4.conf.default.rp_filter=1# Make sure no one can modify the routing table Net.ipv4.conf.all.accept_redirects=0net.ipv4.conf.default.accept_redirects=0net.ipv4.conf.all.secure_redirects=0net.ipv4.conf.default.secure_redirects=0# does not act as a router net.ipv4.ip_forward=0net.ipv4.conf.all.send_redirects=0net.ipv4.conf.default.send_redirects=0# Open Execshildkernel.exec-shield =1Kernel.randomize_va_space=1# IPv6 Settings net.ipv6.conf.default.router_solicitations=0Net.ipv6.conf.default.accept_ra_rtr_pref=0Net.ipv6.conf.default.accept_ra_pinfo=0NET.IPV6.CONF.DEFAULT.ACCEPT_RA_DEFRTR=0net.ipv6.conf.default.autoconf=0net.ipv6.conf.default.dad_transmits=0net.ipv6.conf.default.max_addresses=1# optimize LB using the Port # Add System file descriptor limit fs.file-max =65535# allow more PIDs (reduce rollover issues); May break some programs32768Kernel.pid_max=65536# Increase system IP Port limit net.ipv4.ip_local_port_range= - 65000# Increase TCP maximum buffer size Net.ipv4.tcp_rmem=4096 87380 8388608Net.ipv4.tcp_wmem=4096 87380 8388608# Add Linux Auto adjust TCP buffer limit # Minimum, default and maximum number of bytes available # maximum value not less than 4MB if you use very high BDP path can be set higher # TCP window etc Net.core.rmem_max=8388608Net.core.wmem_max=8388608Net.core.netdev_max_backlog= thenet.ipv4.tcp_window_scaling=1

Linux Server Tuning