{"id":340,"date":"2013-08-15T23:12:31","date_gmt":"2013-08-15T23:12:31","guid":{"rendered":"40008b9a5380fcacce3976bf7c08af5b"},"modified":"2013-08-15T23:12:31","modified_gmt":"2013-08-15T23:12:31","slug":"","status":"publish","type":"post","link":"https:\/\/www.xiaobo.li\/notes\/archives\/340","title":{"rendered":"linux TIME_WAIT"},"content":{"rendered":"

\u73b0\u8c61\uff1a<\/p>\n

1\u3001\u5916\u90e8\u673a\u5668\u4e0d\u80fd\u6b63\u5e38\u8fde\u63a5SSH<\/p>\n

2\u3001\u5185\u5411\u5916\u4e0d\u80fd\u591f\u6b63\u5e38\u7684ping\u901a\u8fc7\uff0c\u57df\u540d\u4e5f\u4e0d\u80fd\u6b63\u5e38\u89e3\u6790\u3002<\/p>\n

\n<\/p>\n

\u95ee\u9898\u6392\u67e5\uff1a<\/p>\n

\u901a\u8fc7 <\/span>netstat  -anp | grep TIME_WAIT | wc -l <\/span>\u547d\u4ee4\u67e5\u770b\u6570\u91cf\uff0c\u53d1\u73b0TIME_WAIT\u7684\u8fde\u63a5\u6570\u91cf\u8d85\u8fc7\u4e8618000\u592a\u5938\u5f20\u4e86\u3002<\/span> <\/p>\n

1\u3001\u521d\u6b65\u6000\u7591\u662f\u7a0b\u5e8f\u6ca1\u6709\u5173\u95ed\u8fde\u63a5\uff0ccodereview\u4e86\u4e24\u904d\uff0c\u53d1\u73b0\uff0c\u5df2\u7ecf\u6b63\u5e38\u5173\u95ed\u3002<\/p>\n

2\u3001\u7f51\u4e0a\u770bTIME_WAIT\u4ea7\u751f\u7684\u539f\u56e0\uff0c\u53ef\u80fd\u662f\u56e0\u4e3a\u670d\u52a1\u5668\u4e3b\u52a8\u5173\u95ed\u8fde\u63a5\u5bfc\u81f4TIME_WAIT\u4ea7\u751f\u3002<\/p>\n

3\u3001\u67e5\u627eTIME_WAIT\u89e3\u51b3\u65b9\u6848\uff1a<\/p>\n

\u53d1\u73b0\u7cfb\u7edf\u5b58\u5728\u5927\u91cfTIME_WAIT\u72b6\u6001\u7684\u8fde\u63a5\uff0c\u901a\u8fc7\u8c03\u6574\u5185\u6838\u53c2\u6570\u89e3\u51b3\uff0c
\nvi \/etc\/sysctl.conf<\/span><\/p>\n

\u7f16\u8f91\u6587\u4ef6\uff0c\u52a0\u5165\u4ee5\u4e0b\u5185\u5bb9\uff1a
\nnet.ipv4.tcp_syncookies = 1
\nnet.ipv4.tcp_tw_reuse = 1
\nnet.ipv4.tcp_tw_recycle = 1
\nnet.ipv4.tcp_fin_timeout = 30
\n<\/span>
\n\u7136\u540e\u6267\u884c <\/span>\/sbin\/sysctl -p <\/span><\/span>\u8ba9\u53c2\u6570\u751f\u6548\u3002<\/span><\/span>\n<\/p>\n

\n<\/p>\n

\u7ecf\u8fc7\u914d\u7f6e\u540e\uff0c\u6682\u65f6\u7684\u95ee\u9898\u662f\u89e3\u51b3\u4e86\uff0c\u518d\u67e5\u770bTIME_WAIT\u6570\u91cf\u5feb\u901f\u4e0b\u964d\u3002<\/p>\n

\n<\/p>\n

\u5173\u952e\u547d\u4ee4\uff1a<\/span><\/p>\n

\n

1\u3001netstat -n | awk '\/^tcp\/ {++state[$NF]} END {for(key in state) print key,\"\\t\",state[key]}'<\/span><\/span><\/code><\/span><\/span><\/p>\n

\u4f1a\u5f97\u5230\u7c7b\u4f3c\u4e0b\u9762\u7684\u7ed3\u679c\uff0c\u5177\u4f53\u6570\u5b57\u4f1a\u6709\u6240\u4e0d\u540c\uff1a<\/span><\/span><\/p>\n

\n

LAST_ACK 1

\nSYN_RECV 14

\nESTABLISHED 79

\nFIN_WAIT1 28

\nFIN_WAIT2 3

\nCLOSING 5

\nTIME_WAIT 1669<\/span><\/span><\/p>\n<\/blockquote>\n

\u72b6\u6001\uff1a\u63cf\u8ff0

\nCLOSED\uff1a\u65e0\u8fde\u63a5\u662f\u6d3b\u52a8\u7684\u6216\u6b63\u5728\u8fdb\u884c

\nLISTEN\uff1a\u670d\u52a1\u5668\u5728\u7b49\u5f85\u8fdb\u5165\u547c\u53eb

\nSYN_RECV\uff1a\u4e00\u4e2a\u8fde\u63a5\u8bf7\u6c42\u5df2\u7ecf\u5230\u8fbe\uff0c\u7b49\u5f85\u786e\u8ba4

\nSYN_SENT\uff1a\u5e94\u7528\u5df2\u7ecf\u5f00\u59cb\uff0c\u6253\u5f00\u4e00\u4e2a\u8fde\u63a5

\nESTABLISHED\uff1a\u6b63\u5e38\u6570\u636e\u4f20\u8f93\u72b6\u6001

\nFIN_WAIT1\uff1a\u5e94\u7528\u8bf4\u5b83\u5df2\u7ecf\u5b8c\u6210

\nFIN_WAIT2\uff1a\u53e6\u4e00\u8fb9\u5df2\u540c\u610f\u91ca\u653e

\nITMED_WAIT\uff1a\u7b49\u5f85\u6240\u6709\u5206\u7ec4\u6b7b\u6389

\nCLOSING\uff1a\u4e24\u8fb9\u540c\u65f6\u5c1d\u8bd5\u5173\u95ed

\nTIME_WAIT\uff1a\u53e6\u4e00\u8fb9\u5df2\u521d\u59cb\u5316\u4e00\u4e2a\u91ca\u653e

\nLAST_ACK\uff1a\u7b49\u5f85\u6240\u6709\u5206\u7ec4\u6b7b\u6389<\/span><\/span><\/p>\n


\n<\/span><\/span><\/p>\n

2\u3001sysctl -a | grep time | grep wait<\/span>

\nnet.ipv4.netfilter.ip_conntrack_tcp_timeout_time_wait = 120<\/span>

\nnet.ipv4.netfilter.ip_conntrack_tcp_timeout_close_wait = 60<\/span>

\nnet.ipv4.netfilter.ip_conntrack_tcp_timeout_fin_wait = 120<\/span><\/span><\/span>
\n<\/span><\/span><\/p>\n

\n


<\/p>\n

\u5b57\u6bb5\u8bf4\u660e:<\/strong><\/div>\n
\u3000\u3000net.ipv4.tcp_syncookies = 1 \u8868\u793a\u5f00\u542fSYN Cookies\u3002\u5f53\u51fa\u73b0SYN\u7b49\u5f85\u961f\u5217\u6ea2\u51fa\u65f6\uff0c\u542f\u7528cookies\u6765\u5904\u7406\uff0c\u53ef\u9632\u8303\u5c11\u91cfSYN\u653b\u51fb\uff0c\u9ed8\u8ba4\u4e3a0\uff0c\u8868\u793a\u5173\u95ed\uff1b<\/div>\n
\u3000\u3000net.ipv4.tcp_tw_reuse = 1 \u8868\u793a\u5f00\u542f\u91cd\u7528\u3002\u5141\u8bb8\u5c06TIME-WAIT sockets\u91cd\u65b0\u7528\u4e8e\u65b0\u7684TCP\u8fde\u63a5\uff0c\u9ed8\u8ba4\u4e3a0\uff0c\u8868\u793a\u5173\u95ed\uff1b<\/div>\n
\u3000\u3000net.ipv4.tcp_tw_recycle = 1 \u8868\u793a\u5f00\u542fTCP\u8fde\u63a5\u4e2dTIME-WAIT sockets\u7684\u5feb\u901f\u56de\u6536\uff0c\u9ed8\u8ba4\u4e3a0\uff0c\u8868\u793a\u5173\u95ed\u3002<\/div>\n
\u3000\u3000net.ipv4.tcp_fin_timeout = 30 \u8868\u793a\u5982\u679c\u5957\u63a5\u5b57\u7531\u672c\u7aef\u8981\u6c42\u5173\u95ed\uff0c\u8fd9\u4e2a\u53c2\u6570\u51b3\u5b9a\u4e86\u5b83\u4fdd\u6301\u5728FIN-WAIT-2\u72b6\u6001\u7684\u65f6\u95f4\u3002<\/div>\n
\u3000\u3000net.ipv4.tcp_keepalive_time = 1200 \u8868\u793a\u5f53keepalive\u8d77\u7528\u7684\u65f6\u5019\uff0cTCP\u53d1\u9001keepalive\u6d88\u606f\u7684\u9891\u5ea6\u3002\u7f3a\u7701\u662f2\u5c0f\u65f6\uff0c\u6539\u4e3a20\u5206\u949f\u3002<\/div>\n
\u3000\u3000net.ipv4.ip_local_port_range = 1024 65000 \u8868\u793a\u7528\u4e8e\u5411\u5916\u8fde\u63a5\u7684\u7aef\u53e3\u8303\u56f4\u3002\u7f3a\u7701\u60c5\u51b5\u4e0b\u5f88\u5c0f\uff1a32768\u523061000\uff0c\u6539\u4e3a1024\u523065000\u3002<\/div>\n
\u3000\u3000net.ipv4.tcp_max_syn_backlog = 8192 \u8868\u793aSYN\u961f\u5217\u7684\u957f\u5ea6\uff0c\u9ed8\u8ba4\u4e3a1024\uff0c\u52a0\u5927\u961f\u5217\u957f\u5ea6\u4e3a8192\uff0c\u53ef\u4ee5\u5bb9\u7eb3\u66f4\u591a\u7b49\u5f85\u8fde\u63a5\u7684\u7f51\u7edc\u8fde\u63a5\u6570\u3002 <\/div>\n
\u3000\u3000net.ipv4.tcp_max_tw_buckets = 5000 \u8868\u793a\u7cfb\u7edf\u540c\u65f6\u4fdd\u6301TIME_WAIT<\/strong><\/u><\/a>\u5957\u63a5\u5b57\u7684\u6700\u5927\u6570\u91cf\uff0c\u5982\u679c\u8d85\u8fc7\u8fd9\u4e2a\u6570\u5b57\uff0cTIME_WAIT\u5957\u63a5\u5b57\u5c06\u7acb\u523b\u88ab\u6e05\u9664\u5e76\u6253\u5370\u8b66\u544a\u4fe1\u606f\u3002\u9ed8\u8ba4\u4e3a180000\uff0c\u6539\u4e3a5000\u3002\u5bf9\u4e8eApache\u3001Nginx\u7b49\u670d\u52a1\u5668\uff0c\u4e0a\u51e0\u884c\u7684\u53c2\u6570\u53ef\u4ee5\u5f88\u597d\u5730\u51cf\u5c11TIME_WAIT\u5957\u63a5\u5b57\u6570\u91cf\uff0c\u4f46\u662f\u5bf9\u4e8eSquid\uff0c\u6548\u679c\u5374\u4e0d\u5927\u3002\u6b64\u9879\u53c2\u6570\u53ef\u4ee5\u63a7\u5236TIME_WAIT\u5957\u63a5\u5b57\u7684\u6700\u5927\u6570\u91cf\uff0c\u907f\u514dSquid\u670d\u52a1\u5668\u88ab\u5927\u91cf\u7684TIME_WAIT\u5957\u63a5\u5b57\u62d6\u6b7b\u3002<\/div>\n","protected":false},"excerpt":{"rendered":"

\u73b0\u8c61\uff1a<\/p>\n

1\u3001\u5916\u90e8\u673a\u5668\u4e0d\u80fd\u6b63\u5e38\u8fde\u63a5SSH<\/p>\n

2\u3001\u5185\u5411\u5916\u4e0d\u80fd\u591f\u6b63\u5e38\u7684ping\u901a\u8fc7\uff0c\u57df\u540d\u4e5f\u4e0d\u80fd\u6b63\u5e38\u89e3\u6790\u3002<\/p>\n

<\/p>\n

\u95ee\u9898\u6392\u67e5\uff1a<\/p>\n

\u901a\u8fc7 <\/span>netstat  -anp | grep TIME_WAIT | wc -l <\/span>\u547d\u4ee4\u67e5\u770b\u6570\u91cf\uff0c\u53d1\u73b0TIME_WAIT\u7684\u8fde\u63a5\u6570\u91cf\u8d85\u8fc7\u4e8618000\u592a\u5938\u5f20\u4e86\u3002<\/span><\/p>\n

1\u3001\u521d\u6b65\u6000\u7591\u662f\u7a0b\u5e8f\u6ca1\u6709\u5173\u95ed\u8fde\u63a5\uff0ccodereview\u4e86\u4e24\u904d\uff0c\u53d1\u73b0\uff0c\u5df2\u7ecf\u6b63\u5e38\u5173\u95ed\u3002<\/p>\n

2\u3001\u7f51\u4e0a\u770bTIME_WAIT\u4ea7\u751f\u7684\u539f\u56e0\uff0c\u53ef\u80fd\u662f\u56e0\u4e3a\u670d\u52a1\u5668\u4e3b\u52a8\u5173\u95ed\u8fde\u63a5\u5bfc\u81f4TIME_WAIT\u4ea7\u751f\u3002<\/p>\n

3\u3001\u67e5\u627eTIME_WAIT\u89e3\u51b3\u65b9\u6848\uff1a<\/p>\n

\u53d1\u73b0\u7cfb\u7edf\u5b58\u5728\u5927\u91cfTIME_WAIT\u72b6\u6001\u7684\u8fde\u63a5\uff0c\u901a\u8fc7\u8c03\u6574\u5185\u6838\u53c2\u6570\u89e3\u51b3\uff0c
vi \/etc\/sysctl.c...<\/span><\/span><\/span><\/p>\n

<\/div>\n

\u7ee7\u7eed\u9605\u8bfb →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[287],"tags":[145],"class_list":["post-340","post","type-post","status-publish","format-standard","hentry","category-linux","tag-TIME_WAIT"],"_links":{"self":[{"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/posts\/340","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/comments?post=340"}],"version-history":[{"count":0,"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/posts\/340\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/media?parent=340"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/categories?post=340"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/tags?post=340"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}