From: Andriy Khavryuchenko <akhavr@khavr.com> To: ALT Linux sysadmin discuss <sysadmins@lists.altlinux.org> Subject: [Sysadmins] iptables performance Date: Fri, 11 Apr 2008 13:26:31 +0300 Message-ID: <47FF3CD7.5070504@khavr.com> (raw) Подскажите тёмному какие ручки в ядре нужно дёргать, чтобы через iptables можно было прогонять поток syn-flood-а в 20-40Mbps? Правил фильтрации где-то от сорока тысяч. Сейчас при превышении потоком определённой границы (1-2Mbps кажется), начинается дикая потеря пакетов, 100%-я загрузка одного из ядер оптерона hardware и software interrupts и следующие сообщения в логах: TCP: too many of orphaned sockets Out of socket memory Openvz ядро. По результатам гугленья, ручки tcp сейчас подкручены следующим образом: echo "20" > /proc/sys/net/ipv4/tcp_fin_timeout echo "2048" > /proc/sys/net/core/netdev_max_backlog echo "2048" > /proc/sys/net/core/somaxconn echo "300" > /proc/sys/net/ipv4/tcp_keepalive_time echo "15" > /proc/sys/net/ipv4/tcp_keepalive_intvl echo "2" > /proc/sys/net/ipv4/tcp_keepalive_probes echo "1" > /proc/sys/net/ipv4/tcp_syncookies echo "2" > /proc/sys/net/ipv4/tcp_synack_retries echo "2" > /proc/sys/net/ipv4/tcp_syn_retries echo "28000" > /proc/sys/net/ipv4/tcp_max_syn_backlog echo "10" > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_syn_recv echo "40" > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_syn_sent echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter echo "220000" > /proc/sys/net/ipv4/ip_conntrack_max echo "1" > /proc/sys/net/ipv4/tcp_window_scaling echo "0" > /proc/sys/net/ipv4/tcp_sack echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses echo 0 > /proc/sys/net/ipv4/tcp_abort_on_overflow sysctl -w net.core.rmem_default=2097152 sysctl -w net.core.rmem_max=2097152 sysctl -w net.core.wmem_max=2097152 sysctl -w net.core.wmem_default=2097152 sysctl -w "net.ipv4.tcp_mem= 786432 1048576 1572864" sysctl -w net.ipv4.tcp_max_orphans = 30000 Где узкое место и что крутить? -- Это задействует левый ALT (кнопка такая, а не характеристика дистрибутива $) -- genix in #8201
next reply other threads:[~2008-04-11 10:26 UTC|newest] Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top 2008-04-11 10:26 Andriy Khavryuchenko [this message] 2008-04-11 12:10 ` Konstantin A. Lepikhov 2008-04-11 12:23 ` Andriy Khavryuchenko 2008-04-14 5:46 ` Andrew Avramenko 2008-04-14 8:09 ` Sergey 2008-04-14 9:48 ` Konstantin A. Lepikhov 2008-04-14 11:13 ` Andriy Khavryuchenko 2008-04-14 20:16 ` Andriy Khavryuchenko 2008-04-14 20:50 ` Konstantin A. Lepikhov 2008-04-17 13:35 ` Andriy Khavryuchenko 2008-04-17 13:59 ` Andriy Khavryuchenko 2008-04-17 14:31 ` Konstantin A. Lepikhov 2008-04-17 14:36 ` Andriy Khavryuchenko 2008-04-17 14:57 ` Konstantin A. Lepikhov 2008-04-17 15:01 ` Andriy Khavryuchenko 2008-04-17 15:28 ` Konstantin A. Lepikhov 2008-04-17 16:09 ` Andriy Khavryuchenko 2008-04-17 18:30 ` Konstantin A. Lepikhov 2008-04-14 13:52 ` Sergey 2008-04-14 11:09 ` Andriy Khavryuchenko 2008-04-14 11:18 ` Andrew Avramenko 2008-04-14 11:39 ` Andriy Khavryuchenko 2008-04-14 11:51 ` Денис Смирнов 2008-04-14 11:57 ` Andriy Khavryuchenko 2008-04-14 12:19 ` Денис Смирнов
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=47FF3CD7.5070504@khavr.com \ --to=akhavr@khavr.com \ --cc=sysadmins@lists.altlinux.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
ALT Linux sysadmins discussion This inbox may be cloned and mirrored by anyone: git clone --mirror http://lore.altlinux.org/sysadmins/0 sysadmins/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 sysadmins sysadmins/ http://lore.altlinux.org/sysadmins \ sysadmins@lists.altlinux.org sysadmins@lists.altlinux.ru sysadmins@lists.altlinux.com public-inbox-index sysadmins Example config snippet for mirrors. Newsgroup available over NNTP: nntp://lore.altlinux.org/org.altlinux.lists.sysadmins AGPL code for this site: git clone https://public-inbox.org/public-inbox.git