TL;DR
Do not enable
net.ipv4.tcp_tw_recycle
—it doesn’t even exist anymore since Linux 4.12. Most of the time,TIME-WAIT
sockets are harmless. Otherwise, jump to the summary for the recommended solutions.
The Linux kernel documentation is not very helpful about what net.ipv4.tcp_tw_recycle
and net.ipv4.tcp_tw_reuse
do. This lack of documentation opens the path to numerous tuning guides advising to set both these settings to 1 to reduce the number of entries in the TIME-WAIT
state. However, as stated by the tcp(7) manual page, the net.ipv4.tcp_tw_recycle
option is quite problematic for public-facing servers as it won’t handle connections from two different computers behind the same NAT device, which is a problem hard to detect and waiting to bite you:
Enable fast recycling of
TIME-WAIT
sockets. Enabling this option is not recommended since this causes problems when wrking with NAT (Network Address Translation).
I will provide here a more detailed explanation of how to properly handle the TIME-WAIT
state. Also, keep in mind we are looking at the TCP stack of Linux. This is completely unrelated to Netfilter connection tracking which may be tweaked in other ways.1
继续阅读Coping with the TCP TIME-WAIT state on busy Linux servers