Original work, permission granted for reprinting. When reprinting, please be sure to indicate the original source , author information, and this statement in the form of a hyperlink. Otherwise, legal liability will be pursued.http://leven.blog.51cto.com/1675811/382097
I. TIME_WAIT Causes:
1. Nginx‘s existing load balancing module implements PHP FastCGI load balancing. Nginx uses short connections, resulting in a large number of connections in the TIME_WAIT state.
2. TCP/IP designers originally designed it this way
There are two main reasons
(1) To prevent packets from a previous connection from reappearing after getting lost and affecting a new connection
(After 2MSL, all duplicate packets from the previous connection will disappear)
(2) To reliably close the TCP connection
The last ack(fin) sent by the active closer may be lost, at which point the passive party will resend
fin. If the active party is in the CLOSED state at this time, it will respond with rst instead of ack. Therefore,
the active party must be in the TIME_WAIT state, not the CLOSED state.
There are two main reasons
(1) To prevent packets from a previous connection from reappearing after getting lost and affecting a new connection
(After 2MSL, all duplicate packets from the previous connection will disappear)
(2) To reliably close the TCP connection
The last ack(fin) sent by the active closer may be lost, at which point the passive party will resend
fin. If the active party is in the CLOSED state at this time, it will respond with rst instead of ack. Therefore,
the active party must be in the TIME_WAIT state, not the CLOSED state.
II Hazards of Excessive TIME_WAIT
TIME_WAIT does not consume significant resources unless under attack.As long as the memory occupied by TIME_WAIT is controlled within a certain range. Generally, the default maximum is 35600 TIME_WAIT entries.
III. Solutions
net.ipv4.tcp_syncookies = 1 means enabling SYN Cookies. When the SYN wait queue overflows, cookies are enabled to handle it, which can prevent a small amount of SYN attacks. Default is 0, meaning disabled;
net.ipv4.tcp_tw_reuse = 1 means enabling reuse. Allows TIME-WAIT sockets to be reused for new TCP connections. Default is 0, meaning disabled;
net.ipv4.tcp_tw_recycle = 1 means enabling fast recycling of TIME-WAIT sockets in TCP connections. Default is 0, meaning disabled.
net.ipv4.tcp_fin_timeout = 30 means if the socket is requested to be closed by the local end, this parameter determines how long it stays in the FIN-WAIT-2 state.
net.ipv4.tcp_keepalive_time = 1200 means when keepalive is enabled, the frequency at which TCP sends keepalive messages. The default is 2 hours, changed to 20 minutes.
net.ipv4.ip_local_port_range = 1024 65000 means the port range used for outgoing connections. The default is very small: 32768 to 61000, changed to 1024 to 65000.
net.ipv4.tcp_max_syn_backlog = 8192 means the length of the SYN queue. The default is 1024. Increasing the queue length to 8192 can accommodate more network connections waiting to connect.
net.ipv4.tcp_max_tw_buckets = 5000 means the maximum number of TIME_WAIT sockets the system maintains simultaneously. If this number is exceeded, the TIME_WAIT socket will be immediately cleared and a warning message printed.
The default is 180000, changed to 5000. For servers like Apache and Nginx, the parameters in the lines above can effectively reduce the number of TIME_WAIT sockets, but for Squid, the effect is minimal. This parameter can control the maximum number of TIME_WAIT sockets, preventing the Squid server from being dragged down by a large number of TIME_WAIT sockets.
net.ipv4.tcp_tw_reuse = 1 means enabling reuse. Allows TIME-WAIT sockets to be reused for new TCP connections. Default is 0, meaning disabled;
net.ipv4.tcp_tw_recycle = 1 means enabling fast recycling of TIME-WAIT sockets in TCP connections. Default is 0, meaning disabled.
net.ipv4.tcp_fin_timeout = 30 means if the socket is requested to be closed by the local end, this parameter determines how long it stays in the FIN-WAIT-2 state.
net.ipv4.tcp_keepalive_time = 1200 means when keepalive is enabled, the frequency at which TCP sends keepalive messages. The default is 2 hours, changed to 20 minutes.
net.ipv4.ip_local_port_range = 1024 65000 means the port range used for outgoing connections. The default is very small: 32768 to 61000, changed to 1024 to 65000.
net.ipv4.tcp_max_syn_backlog = 8192 means the length of the SYN queue. The default is 1024. Increasing the queue length to 8192 can accommodate more network connections waiting to connect.
net.ipv4.tcp_max_tw_buckets = 5000 means the maximum number of TIME_WAIT sockets the system maintains simultaneously. If this number is exceeded, the TIME_WAIT socket will be immediately cleared and a warning message printed.
The default is 180000, changed to 5000. For servers like Apache and Nginx, the parameters in the lines above can effectively reduce the number of TIME_WAIT sockets, but for Squid, the effect is minimal. This parameter can control the maximum number of TIME_WAIT sockets, preventing the Squid server from being dragged down by a large number of TIME_WAIT sockets.
Note:
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
Setting these two parameters: reuse indicates whether to allow re-applying a socket in the TIME-WAIT state for a new TCP connection; recycle accelerates the recycling of TIME-WAIT sockets
This article is from the “levens” blog, please be sure to keep this sourcehttp://leven.blog.51cto.com/1675811/382097