Comments on: linux network optimize with sysctl

By: optimize linux tcp/ip stack « Papa Delta Sierra

optimize linux tcp/ip stack « Papa Delta Sierra — Mon, 18 May 2009 23:17:18 +0000

[...] source: [...]

By: fcicq

fcicq — Mon, 14 Apr 2008 10:59:06 +0000

net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_keepalive_time = 1200
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.ip_local_port_range = 1024 65000
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_max_tw_buckets = 5000

By: fcicq

fcicq — Mon, 30 Jul 2007 06:50:16 +0000

配置Linux内核如何更新dirty buffers到磁盘。
当缓冲区内的数据完全dirty，使用：sysctl -w vm.bdflush=”30 500 0 0 500 3000 60 20 0″
vm.bdflush有9个参数，但是建议只改变其中的3个：
1 nfract, 为排队写入磁盘前，bdflush daemon允许的缓冲区最大百分比
2 ndirty, 为bdflush即刻写的最大缓冲区的值。如果这个值很大，bdflush需要更多的时间完成磁盘的数据更新。
7 nfract_sync, 发生同步前，缓冲区变dirty的最大百分比。
配置kswapd daemon，指定Linux的内存交换页数量
sysctl -w vm.kswapd=”1024 32 64″
三个参数的描述如下：
– tries_base 相当于内核每次所交换的“页”的数量的四倍。对于有很多交换信息的系统，增加这个值可以改进性能。
– tries_min 是每次kswapd swaps出去的pages的最小数量。
– swap_cluster 是kswapd 即刻写如的pages数量。数值小，会提高磁盘I/O的性能；数值大可能也会对请求队列产生负面影响。
如果要对这些参数进行改动，请使用工具vmstat检查对性能的影响。其它可以改进性能的虚拟内存参数为：
_ buffermem
_ freepages
_ overcommit_memory
_ page-cluster
_ pagecache
_ pagetable_cache

By: fcicq

fcicq — Sun, 29 Jul 2007 06:08:29 +0000

# Disables packet forwarding
net.ipv4.ip_forward=0

# Disables IP source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.lo.accept_source_route = 0
net.ipv4.conf.eth0.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# Enable IP spoofing protection, turn on source route verification
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.lo.rp_filter = 1
net.ipv4.conf.eth0.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Disable ICMP Redirect Acceptance
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.lo.accept_redirects = 0
net.ipv4.conf.eth0.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# Enable Log Spoofed Packets, Source Routed Packets, Redirect Packets
net.ipv4.conf.all.log_martians = 0
net.ipv4.conf.lo.log_martians = 0
net.ipv4.conf.eth0.log_martians = 0

# Enable IP spoofing protection, turn on source route verification
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.lo.rp_filter = 1
net.ipv4.conf.eth0.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Disable ICMP Redirect Acceptance
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.lo.accept_redirects = 0
net.ipv4.conf.eth0.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# Disables the magic-sysrq key
kernel.sysrq = 0

# Decrease the time default value for tcp_fin_timeout connection
net.ipv4.tcp_fin_timeout = 15

# Decrease the time default value for tcp_keepalive_time connection
net.ipv4.tcp_keepalive_time = 1800

# Turn off the tcp_window_scaling
net.ipv4.tcp_window_scaling = 0

# Turn off the tcp_sack
net.ipv4.tcp_sack = 0

# Turn off the tcp_timestamps
net.ipv4.tcp_timestamps = 0

# Enable TCP SYN Cookie Protection
net.ipv4.tcp_syncookies = 1

# Enable ignoring broadcasts request
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Enable bad error message Protection
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Log Spoofed Packets, Source Routed Packets, Redirect Packets
net.ipv4.conf.all.log_martians = 1

# Increases the size of the socket queue (effectively, q0).
net.ipv4.tcp_max_syn_backlog = 1024

# Increase the tcp-time-wait buckets pool size
net.ipv4.tcp_max_tw_buckets = 1440000

# Allowed local port range
net.ipv4.ip_local_port_range = 16384 65536

By: fcicq

fcicq — Sun, 29 Jul 2007 06:07:59 +0000

net.ipv4.tcp_rmem = 4096 25165824 25165824
net.core.rmem_max = 25165824
net.core.rmem_default = 25165824
net.ipv4.tcp_wmem = 4096 65536 25165824
net.core.wmem_max = 25165824
net.core.wmem_default = 65536