The TCP/IP parameters for tweaking a Linux-based machine for fast internet connections are located in /proc/sys/net/... (assuming 2.1+ kernel). This location is volatile, and changes are reset at reboot. There are a couple of methods for reapplying the changes at boot time, ilustrated below.

Locating the TCP/IP parameters

All TCP/IP tunning parameters are located under /proc/sys/net/...  For example, here is a list of the most important tunning parameters, along with short description of their meaning:

/proc/sys/net/core/rmem_max - Maximum TCP Receive Window
/proc/sys/net/core/wmem_max - Maximum TCP Send Window
/proc/sys/net/ipv4/tcp_rmem - memory reserved for TCP receive buffers
/proc/sys/net/ipv4/tcp_wmem - memory reserved for TCP send buffers
/proc/sys/net/ipv4/tcp_timestamps - Timestamps (RFC 1323) add 12 bytes to the TCP header...
/proc/sys/net/ipv4/tcp_sack - TCP Selective Acknowledgements. They can reduce retransmissions, however make servers more prone to DDoS Attacks and increase CPU utilization.
/proc/sys/net/ipv4/tcp_window_scaling - support for large TCP Windows (RFC 1323). Needs to be set to 1 if the Max TCP Window is over 65535.

Keep in mind everything under /proc is volatile, so any changes you make are lost after reboot.   There are some additional internal memory buffers for the TCP Window, allocated for each connection:

/proc/sys/net/ipv4/tcp_rmem - memory reserved for TCP rcv buffers (reserved memory per connection default)
/proc/sys/net/ipv4/tcp_wmem  - memory reserved for TCP snd buffers (reserved memory per connection default)

The tcp_rmem and tcp_wmem contain arrays of three parameter values: the 3 numbers represent minimum, default and maximum memory values. Those 3 values are used to bound autotunning and balance memory usage while under global memory stress.

Applying TCP/IP Parameters at System Boot

TCP/IP parameters in Linux are located in /proc/sys/net/ipv4 and /proc/sys/net/core . This is part of the Virtual filesystem which resides in system memory (RAM), and any changes to it are volatile, they are reset when the machine is rebooted.

There are two methods that we can use to apply the settings at each reboot. First, we can edit /etc/sysctl.conf (or /etc/sysctl.d/sysctl.conf, depending on your distribution). The syntax for setting parameters in this file is by issuing sysctl commands, as follows::

net.core.rmem_default = 256960
net.core.rmem_max = 256960
net.core.wmem_default = 256960
net.core.wmem_max = 256960
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_sack = 0
net.ipv4.tcp_window_scaling = 1

You can see a list of all tweakable parameters by executing the following in your terminal: sysctl -a | grep tcp  (or simply sysctl -a for a full list).

Alternatively, you can apply the settings at boot time by editing the /etc/rc.local, /etc/rc.d/rc.local, or /etc/boot.local depending on your distribution. Note the difference in syntax, you simply echo the appropriate value in the virtual file system. The TCP/IP parameters should be self-explanatory: we're basically setting the TCP Window to 256960, disabling timestamps (to avoid 12 byte header overhead), enabling tcp window scaling, and selective acknowledgements:

echo 256960 > /proc/sys/net/core/rmem_default
echo 256960 > /proc/sys/net/core/rmem_max
echo 256960 > /proc/sys/net/core/wmem_default
echo 256960 > /proc/sys/net/core/wmem_max
echo 0 > /proc/sys/net/ipv4/tcp_timestamps
echo 0 > /proc/sys/net/ipv4/tcp_sack
echo 1 > /proc/sys/net/ipv4/tcp_window_scaling

You can change the above example values as desired, depending on your internet connection and maximum bandwidth/latency. There are other parameters you can change from the default if you're confident in what you're doing - just find the correct syntax of the values in /proc/sys/net/... and add a line in the above code analogous to the others. To revert to the default parameters, you can just comment or delete the above code from /etc/rc.local and restart.

Note: To manually set the MTU value under Linux, use the command: ifconfig eth0 mtu 1500   (where 1500 is the desired MTU size)

Changing Current Values

While testing, the current TCP/IP parameters can be edited without the need for reboot in the following locations:

/proc/sys/net/core/
rmem_default = Default Receive Window 
rmem_max = Maximum Receive Window 
wmem_default = Default Send Window 
wmem_max = Maximum Send Window

/proc/sys/net/ipv4/
You'll find timestamps, window scaling, selective acknowledgements, etc.

Keep in mind the values in /proc will be reset upon reboot. You still need to add the code in either sysctl.conf, or  the alternate syntax in rc.local in order to have the changes applied at each boot as described in the section above.

To make any new sysctl.conf changes take effect without rebooting the machine, you can execute:

sysctl -p

To see a list of all relevant tweakable sysctl parameters, along with their current values, try the following in your terminal:

sysctl -a | grep tcp

To set a single sysctl value:

sysctl -w variable=value
example:  sysctl -w net.netfilter.nf_conntrack_tcp_timeout_time_wait=30

TCP Parameters to consider

TCP_FIN_TIMEOUT
This setting determines the time that must elapse before TCP/IP can release a closed connection and reuse its resources. During this TIME_WAIT state, reopening the connection to the client costs less than establishing a new connection. By reducing the value of this entry, TCP/IP can release closed connections faster, making more resources available for new connections. Adjust this in the presence of many connections sitting in the TIME_WAIT state:

 

sysctl.conf syntax:
net.ipv4.tcp_fin_timeout = 15

(default: 60 seconds, recommended 15-30 seconds)

alternative rc.local syntax:
echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout

TCP_KEEPALIVE_INTERVAL
This determines the wait time between isAlive interval probes. To set:

sysctl.conf syntax:
net.ipv4.tcp_keepalive_intvl = 30

(default: 75 seconds, recommended: 15-30 seconds)

alternative rc.local syntax:
echo 30 > /proc/sys/net/ipv4/tcp_keepalive_intvl

TCP_KEEPALIVE_PROBES
This determines the number of probes before timing out. To set:

sysctl.conf syntax:
net.ipv4.tcp_keepalive_probes = 5

(default: 9, recommended 5)

alternative rc.local syntax:
echo 5 > /proc/sys/net/ipv4/tcp_keepalive_probes

TCP_TW_RECYCLE
It enables fast recycling of TIME_WAIT sockets. The default value is 0 (disabled). The sysctl documentation incorrectly states the default as enabled. It can be changed to 1 (enabled) in many cases. Known to cause some issues with hoststated (load balancing and fail over) if enabled, should be used with caution.

sysctl.conf syntax:
net.ipv4.tcp_tw_recycle=1

(boolean, default: 0)

alternative rc.local syntax:
echo 1 > /proc/sys/net/ipv4/tcp_tw_recycle

TCP_TW_REUSE
This allows reusing sockets in TIME_WAIT state for new connections when it is safe from protocol viewpoint. Default value is 0 (disabled). It is generally a safer alternative to tcp_tw_recycle

sysctl.conf syntax:
net.ipv4.tcp_tw_reuse=1

(boolean, default: 0)

alternative rc.local syntax:
echo 1 > /proc/sys/net/ipv4/tcp_tw_reuse

Note: The tcp_tw_reuse setting is particularly useful in environments where numerous short connections are open and left in TIME_WAIT state, such as web servers. Reusing the sockets can be very effective in reducing server load.

Linux Netfilter Tweaks

Try this for a list netfilter parameters:  sysctl -a | grep netfilter

We can add the following commands to the /etc/sysctl.conf file to tune individual parameters, as follows.
To reduce the number of connections in TIME_WAIT state, we can decrease the number of seconds connections are kept in this state before being dropped:

# reduce TIME_WAIT from the 120s default to 30-60s
net.netfilter.nf_conntrack_tcp_timeout_time_wait=30
# reduce FIN_WAIT from teh 120s default to 30-60s
net.netfilter.nf_conntrack_tcp_timeout_fin_wait=30

You can commit the sysctl.conf changes without rebooting (and test for possible syntax errors) by executing: sysctl -p
To check sysctl parameters, use: sysctl -a

Misc Notes: You may want to reduce net.netfilter.nf_conntrack_tcp_timeout_established to 900 or some manageable number as well.
To check the actual number of current connections in the TIME_WAIT state, for example, try: netstat -n | grep TIME_WAIT | wc -l

Kernel Recompile Option

There is another method one can use to directly set the default TCP/IP parameters, involving kernel recompile... If you're brave enough. Look for the parameters in the following files: 
/LINUX-SOURCE-DIR/include/linux/skbuff.h  (Look for SK_WMEM_MAX & SK_RMEM_MAX) 
/LINUX-SOURCE-DIR/include/net/tcp.h (Look for MAX_WINDOW & MIN_WINDOW)

Determine Connection States

It is often useful to decrease some of the TCP Timeouts to release resources faster and reduce memory use, the default TCP timeouts may leave too many connections in the TIME_WAIT state. To see a list of all current connections to the machine and their states, try:

netstat -tan | grep ':80 ' | awk '{print $6}' | sort | uniq -c

You will be presented with a list similar to the following:

4 CLOSING
12 ESTABLISHED
  4 FIN_WAIT1
14 FIN_WAIT2
12 LAST_ACK
  1 LISTEN
10 SYN_RECV
273 TIME_WAIT

This information can be very useful to determine whether you need to tweak some of the timeouts above.

SYN Flood Protection

These settings added to sysctl.conf will make a server more resistant to SYN flood attacks. Applying configures the kernel to use the SYN cookies mechanism, with a backlog queue of 1024 connections, also setting the SYN and SYN/ACK retries to an effective ceiling of about 45 seconds. The defaults for these settings vary depending on kernel version and distribution you may want to check them with sysctl -a | grep syn

net.ipv4.tcp_max_syn_backlog = 1024
net.ipv4.tcp_syn_retries = 6
net.ipv4.tcp_synack_retries = 3
net.ipv4.tcp_syncookies = 1

Notes: The default SYN retries cycle under Linux doubles every time, so 5 retries means: the original packet, 3s, 6s, 12s, 24s.. 6th retry is 48s. Under BSD-derived kernels (including Mac OS X), the retry times triple instead.

References

TCP Variables
See also the complete ip-sysctl parameters reference -here-

The TCP/IP parameters for tweaking的更多相关文章

  1. Linux TCP/IP parameters reference

    This is a reference of IP networking parameters that are configurable as described in our linux twea ...

  2. Optimizing Linux network TCP/IP kernel parameters

    You can verify the Linux networking kernel parms from the root user with these commands::Many Oracle ...

  3. 调整Win7中TCP/IP半开连接数限制

    调整Win7中TCP/IP半开连接数限制      相信大家都有过这样的经历,普通的ADSL宽带下,打开下载工具下载资源时,再想浏览网页就会变得非常困难了,Windows7中也未能幸免.   究其原因 ...

  4. 云计算之路-阿里云上:消灭“黑色n秒”第三招——禁用网卡的TCP/IP Offload

    程咬金有三板斧,我们有三招.在这篇博文中我们要出第三招,同时也意味着昨天在“希望的田野”上的第二招失败了. 前两招打头(CPU)不凑效,这一招要换一个部位,但依然要坚持攻击敌人最弱(最忙最累)部位的原 ...

  5. 如何强化 TCP/IP 堆栈

    TCP/IP 是一种本质上不安全的协议.但是,Windows 2000 实现可以使您配置其操作以防止网络的拒绝服务攻击.默认情况下,本文中所涉及的一些项和值可能并不存在.在这些情况下,请创建该项.值或 ...

  6. 避免 TCP/IP 端口耗尽

    转载:http://www.cnblogs.com/tianzhiliang/archive/2011/06/27/2091214.html 当客户端启动到服务器的 TCP/IP 套接字连接时,客户端 ...

  7. LINUX 中的 TCP/IP协议 参数详解

    Ipsysctl tutorial 1.0.4 Prev Chapter 3. IPv4 variable reference Next https://www.frozentux.net/ipsys ...

  8. TCP/IP,http,socket,长连接,短连接

    TCP/IP TCP/IP是个协议组,可分为三个层次:网络层.传输层和应用层. 在网络层有IP协议.ICMP协议.ARP协议.RARP协议和BOOTP协议. 在传输层中有TCP协议与UDP协议. 在应 ...

  9. 网络基础之HTTP、TCP/IP、Socket

    一.HTTP相关 https://www.cnblogs.com/sunny-sl/p/6529830.html https://www.cnblogs.com/ranyonsue/p/5984001 ...

随机推荐

  1. iOS项目架构文档

    设计的项目架构主要引用MVVM+MVC架构,并以功能模块分级.以下为目录结构. 初级目录: 我们只需要关注SGZH文件夹下的目录,其他为Xcode管理的目录.可以看到此目录为项目初级目录,我们开发过程 ...

  2. 破解EXCEL2007的密码

    破解EXCEL2007的密码 xshzhao (斑竹)顶楼举报 我有一个EXCEL2007文件(后缀是XLSX),由于设置了打开密码.现在密码搞忘了,这个文件对我很重要. 我试过了Office Pas ...

  3. 菜鸟Android之路(上)

    自己为什么要学android 本人作为应届毕业生,自己进入社会前做过好多梦,可是呢,现实还是打败了无邪!!面对社会的压力和残酷的竞争力自己如何生成下去??我自己对自己说:第一步 先养活自己,才能走好以 ...

  4. 被windows“折磨”了一个礼拜

    说是被windows折磨了一个礼拜,这话一点都不假!由于想彻底的卸载SQL Server而误删系统文件,导致系统重启之后持续蓝屏.无奈之下只能重装系统(心想,加入当初自己将系统备份的话,那该是多美好的 ...

  5. hdu 4749

    题目很简单,不过题意很难看懂. 就是给一个标准的大小关系的队列,从原队列中找出最多的匹配子队列,感觉就像一个KMP算法+贪心: 不过这个题可能数据有点水把,竟然只要判断相邻的关系就可以A掉: 代码: ...

  6. UNIX网络编程——套接字选项

    http://www.educity.cn/linux/1241288.html 有时候我们需要控制套接字的行为(如修改缓冲区的大小),这个时候我们就要学习套接字选项. int getsockopt( ...

  7. SPRING IN ACTION 第4版笔记-第一章-003-AOP介绍

    一.目标 要在BraveKnight调用embarkOnQuest()前后各做一些处理(调用Minstrel的方法) 二. 1.minstrel.xml <?xml version=" ...

  8. android 读写SD卡文件

    参考: http://www.oschina.net/code/snippet_176897_7336#11699 写文件: private void SavedToText(Context cont ...

  9. Ehcache Java开源缓存框架

    一.ehcache.xml 配置详解 单机配置: <ehcache xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ...

  10. XSS跨站脚本攻击在Java开发中防范的方法

    1. 防堵跨站漏洞,阻止攻击者利用在被攻击网站上发布跨站攻击语句不可以信任用户提交的任何内容,首先代码里对用户输入的地方和变量都需要仔细检查长度和对”<”,”>”,”;”,”’”等字符做过 ...