0

I have a problem with limiting the number of concurrent network connections. I just need to set them so that my machine will never produce more than 200 concurrent network connections, but I am unable to do so.

Here is my /etc/sysctl.conf:

net.ipv4.netfilter.ip_conntrack_max=100
fs.inotify.max_user_watches=100000
net.ipv4.tcp_tw_recycle = 0
net.ipv4.tcp_tw_reuse = 0
net.ipv4.tcp_orphan_retries = 1
net.ipv4.tcp_fin_timeout = 25
net.ipv4.tcp_max_orphans = 150

I understand that this setting means that number of connections should not exceed 150 connections, but when, for example, I open many pages in firefox at same time, I can see that this setting is not respected - netstat | grep tcp | wc -l shows many more connections.

Here are some info about my system:

[firzen:~] lsb_release -sd
Debian GNU/Linux 7.7 (n/a)
[firzen:~] uname -r
3.2.0-2-686-pae
[firzen:~] arch
i686

How can I fix that? It is really a critical setting for me.

Thanks in advance!

6
  • This has been asked before, see this post on ServerFault: serverfault.com/questions/10852/… Nov 14, 2014 at 15:41
  • Yes, but as you can see, I am using the same configuration (but with different values), and in my case it just does not work. And that is my problem.
    – Firzen
    Nov 14, 2014 at 18:07
  • No you are not using the same configuration. You should have limited the port range, as in net.ipv4.ip_local_port_range = 32768 61000 This is very wide, suitable to the OP I referenced above, you should restrict it to the number of multiple connections you intend to allow. Nov 14, 2014 at 18:34
  • Well, i have added this line to my /etc/sysctl.conf but is still does not work. What can I do with that? ..
    – Firzen
    Nov 17, 2014 at 22:06
  • Did you verify your changes using sysctl variable, eg. sysctl net.ipv4.netfilter.ip_conntrack_max ?
    – Martin
    Nov 17, 2014 at 22:20

1 Answer 1

0

As per kernel documentation:

tcp_max_orphans - INTEGER
Maximal number of TCP sockets not attached to any user file handle, held by system. If this number is exceeded orphaned connections are reset immediately and warning is printed. This limit exists only to prevent simple DoS attacks, you must not rely on this or lower the limit artificially, but rather increase it (probably, after increasing installed memory), if network conditions require more than default value, and tune network services to linger and kill such states more aggressively. Let me to remind again: each orphan eats up to ~64K of unswappable memory.

So no, this doesn’t limit the number of open connections. Instead, you’ll have to use IPTables somehow, because this is clearly a firewall concern.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .