Home / server / Questions / 235608
Accepted
Sparsh Gupta
Asked: 2011-02-16 00:33:40 +0800 CST

Connections though firewall / ipconntrack

  • 772

I have asked a few questions here and got some good replies. I am still facing some issues with ipconntrac and connections though firewall.

http://monitor.wingify.com/munin/visualwebsiteoptimizer.com/lb1.visualwebsiteoptimizer.com.html#Network

I am looking at some guidance and steps I should follow on ubuntu 10.10 64bit machine that will ensure the issues with ipconntrack and time_wait reduces and the server starts performing better and more reliabily.

firewall ubuntu

1 Answers

  1. Best Answer

    Under /proc/sys/net/ipv4 there are files

    tcp_fin_timeout:

    The tcp_fin_timeout variable tells kernel how long to keep sockets in the state FIN-WAIT-2 if you were the one closing the socket. This is used if the other peer is broken for some reason and don't close its side, or the other peer may even crash unexpectedly. Each socket left in memory takes approximately 1.5Kb of memory, and hence this may eat a lot of memory if you have a moderate webserver or something alike.

This value takes an integer value which is per default set to 60 seconds.

    tcp_keepalive_time:

    The tcp_keepalive_time variable tells the TCP/IP stack how often to send TCP keepalive packets to keep an connection alive if it is currently unused. This value is only used when keepalive is enabled.

    tcp_max_orphans:

    The tcp_max_orphans variable tells the kernel how many TCP sockets that are not attached to any user file handle to maintain. In case this number is exceeded, orphaned connections are immediately reset and a warning is printed.

    All quotes copied from here. See also this.

    • 0