12

How to reduce the number of time wait connections

view full story
linux-howto

http://serverfault.com – I'm running comet server on linux (Debian). All the connections are proxied by nginx. And my time_wait/live rate is too big although I set reuse_connections. Here is my sysctl.conf rules: net.ipv4.tcp_tw_reuse = 1 net.ipv4.tcp_tw_recycle = 1 net.ipv4.tcp_keepalive_time = 60 net.ipv4.tcp_fin_timeout = 3 net.ipv4.tcp_max_tw_buckets = 360000 net.ipv4.tcp_keepalive_probes=3 Could you give me any clue why? (HowTos)

taskli's picture
Submitted by taskli on 03/02/2012 – Made popular on 03/02/2012

Stories similar to How to reduce the number of time wait connections

On my Linux box, I have various daemons which can bind to all IPv6-enabled interfaces on ::. When they do so, Linux sends IPv4 requests to that daemon mapped as, for instance, ::ffff:198.51.100.37.

I would instead like IPv4 connections to be refused and only IPv6 connections accepted when a daemon binds to ::.

While searching for more ways to secure Linux servers, I found the following /etc/sysctl.conf configuration. It came as is, without much explanation.

I'm currently having a socket leak with my Node.js application. This bug is also posted here. I hope to fix this soon.

I've just installed a XenServer 6.1.

I have several Debian Squeeze (6.0.6 up to date) used as routers. When a link is down, they send ICMP redirects to local hosts. This is the default behaviour of Debian and several others.

I have setup a web server (Nginx) and assigned an IPv4 address and an IPv6 address to it. In the DNS I have set an A record and an AAAA record. Now, I need to check whether its working. I need to check whether an IPv6 only client can view my site. Whether an IPv4 only client can view the site (I think IPv4 only clients can view because im IPv4 ).

How can I do this? I only have IPv4!

I have setup an Nginx server in a machine which have both ipv4 and ipv6 addresses. Currently, its connected to CloudFlare and only use ipv4. I have 1 ipv4 address assigned to the web server.

Now what I want is, to become fully ipv6. Then connect to CloudFlare. So, if an ipv4 user comes to the site, CloudFlare will make sure that he can visit my ipv6 only site!

Is there any way for IPv6-unaware applications to continue to work on a host with only IPv6 connectivity?

The IPv4 implementation of the host could know about the problem and just encapsulate the IPv4 address in the IPv6 header (like 0::ffff:[ipv4]?), but where are these pakets then translated to real IPv4 packets?

Do current operating systems provide that kind of functionality to IPv4-only appl

On my Ubuntu machine, in /etc/sysctl.conf file, I've got reverse path filtering options commented out by default like this:

#net.ipv4.conf.default.rp_filter=1 #net.ipv4.conf.all.rp_filter=1

but in /etc/sysctl.d/10-network-security.conf they are (again, by default) not commented out:

net.ipv4.conf.default.rp_filter=1 net.ipv4.conf.all.rp_filter=1

So is reverse path filtering enabled or not?