Sysctl is an interface that allows you to change the running Linux system. It includes some advanced options for TCP/IP stacks and virtual memory systems, which allows experienced administrators to improve system performance. You can use sysctl to read over five hundred system variables. Based on this, sysctl (8) provides two functions: Read and modify system settings.
View All readable variables:
% Sysctl-
Read a specified variable, suchkern.maxproc:
% Sysctl Kern. maxprocKern. maxproc: 1044
To set a specified variable, useVariable=ValueSyntax:
# Sysctl Kern. maxfiles = 5000
Kern. maxfiles: 2088-> 5000
You can use sysctl to modify system variables, or edit the sysctl. conf file to modify system variables. Sysctl. conf looks likeRC. conf. It usesVariable = ValueTo set the value. The specified value is set after the system enters multi-user mode. Not all variables can be set in this mode.
The sysctl variable is usually set as a string, number, or Boolean. (Boolean1To indicate 'yes', use0To 'no '). Sysctl-W kernel. sysrq = 0
Sysctl-W kernel. core_uses_pid = 1
Sysctl-W net. ipv4.conf. Default. accept_redirects = 0
Sysctl-W net. ipv4.conf. Default. accept_source_route = 0
Sysctl-W net. ipv4.conf. Default. rp_filter = 1
Sysctl-W net. ipv4.tcp _ syncookies = 1
Sysctl-W net. ipv4.tcp _ max_syn_backlog = 2048
Sysctl-W net. ipv4.tcp _ fin_timeout = 30
Sysctl-W net. ipv4.tcp _ synack_retries = 2
Sysctl-W net. ipv4.tcp _ keepalive_time = 3600
Sysctl-W net. ipv4.tcp _ window_scaling = 1
Sysctl-W net. ipv4.tcp _ sack = 1 Configure sysctl Edit this file: VI/etc/sysctl. conf If the file is empty, enter the following content; otherwise, adjust the file as needed: # Controls source route verification
# Default shoshould work for all interfaces
Net. ipv4.conf. Default. rp_filter = 1
# Net. ipv4.conf. All. rp_filter = 1
# Net. ipv4.conf. Lo. rp_filter = 1
# Net. ipv4.conf. eth0.rp _ filter = 1 # Disables IP Source Routing
# Default shoshould work for all interfaces
Net. ipv4.conf. Default. accept_source_route = 0
# Net. ipv4.conf. All. accept_source_route = 0
# Net. ipv4.conf. Lo. accept_source_route = 0
# Net. ipv4.conf. eth0.accept _ source_route = 0 # Controls the system request debugging functionality of the kernel
Kernel. sysrq = 0 # Controls whether core dumps will append the PID to the core filename.
# Useful for debugging multi-threaded applications.
Kernel. core_uses_pid = 1 # Increase maximum amount of memory allocated to SHM
# Only uncomment if needed!
# Kernel. shmmax = 67108864 # Disable ICMP redirect acceptance
# Default shoshould work for all interfaces
Net. ipv4.conf. Default. accept_redirects = 0
# Net. ipv4.conf. All. accept_redirects = 0
# Net. ipv4.conf. Lo. accept_redirects = 0
# Net. ipv4.conf. eth0.accept _ redirects = 0 # Enable log spoofed packets, source routed packets, redirect packets
# Default shoshould work for all interfaces
Net. ipv4.conf. Default. log_martians = 1
# Net. ipv4.conf. All. log_martians = 1
# Net. ipv4.conf. Lo. log_martians = 1
# Net. ipv4.conf. eth0.log _ Martians = 1 # Decrease the time default value for tcp_fin_timeout connection
Net. ipv4.tcp _ fin_timeout = 25 # Decrease the time default value for tcp_keepalive_time connection
Net. ipv4.tcp _ keepalive_time = 1200 # Turn On the tcp_window_scaling
Net. ipv4.tcp _ window_scaling = 1 # Turn On the tcp_sack
Net. ipv4.tcp _ sack = 1 # Tcp_fack shoshould be on because of sack
Net. ipv4.tcp _ fack = 1 # Turn On the tcp_timestamps
Net. ipv4.tcp _ timestamps = 1 # Enable tcp syn Cookie Protection
Net. ipv4.tcp _ syncookies = 1 # Enable ignoring broadcasts request
Net. ipv4.icmp _ echo_ignore_broadcasts = 1 # Enable bad error message protection
Net. ipv4.icmp _ ignore_bogus_error_responses = 1 # Make more local ports available
# Net. ipv4.ip _ local_port_range = 1024 65000 # Set TCP re-ordering value in kernel to '5 ′
Net. ipv4.tcp _ reordering = 5 # Lower SYN retry rates
Net. ipv4.tcp _ synack_retries = 2
Net. ipv4.tcp _ syn_retries = 3 # Set max syn backlog to '000000 ′
Net. ipv4.tcp _ max_syn_backlog = 2048 # Various settings
Net. Core. netdev_max_backlog = 1024 # Increase the maximum number of SKB-heads to be cached
Net. Core. hot_list_length = 256 # Increase the TCP-time-Wait buckets pool size
Net. ipv4.tcp _ max_tw_buckets = 360000 # This will increase the amount of memory available for socket input/output queues
Net. Core. rmem_default = 65535
Net. Core. rmem_max = 8388608
Net. ipv4.tcp _ rmem = 4096 87380 8388608
Net. Core. wmem_default = 65535
Net. Core. wmem_max = 8388608
Net. ipv4.tcp _ WMEM = 4096 65535 8388608
Net. ipv4.tcp _ mem = 8388608 8388608 8388608
Net. Core. optmem_max = 40960 If you want to block others from pinging your host, add the following code: # Disable ping requests
Net. ipv4.icmp _ echo_ignore_all = 1 After editing, run the following command to make the change take effect immediately: /Sbin/sysctl-P
/Sbin/sysctl-W net. Route 4.route. Flush = 1 |
