在linux系统中处理TIME_WAIT连接过多

太过爱你忘了你带给我的痛 2022-04-10 01:57 165阅读 0赞

网络连接状态说明:

CLOSED 无连接是活动的或正在进行

LISTEN 务器在等待进入呼叫

SYN\_RECV 个连接请求已经到达，等待确认

SYN\_SENT 用已经开始，打开一个连接

ESTABLISHED 常数据传输状态

FIN\_WAIT1 用说它已经完成

FIN\_WAIT2 一边已同意释放

ITMED\_WAIT 待所有分组死掉

CLOSING 边同时尝试关闭

TIME\_WAIT 一边已初始化一个释放

LAST\_ACK 待所有分组死掉

1.查看系统有TIME\_WAIT多少个连接

\[root@AY140528120357495c4bZ ~\]\# netstat -antup | grep 'TIME\_WAIT' | wc -l  
1570  
\[root@AY140528120357495c4bZ ~\]\#

2.修改内核参数关闭TIME\_WAIT连接

net.ipv4.tcp\_syncookies = 1 --表示开启SYN Cookies.当出现SYN等待队列溢出时,启用cookies来

处理,可防范少量SYN\*\*\*,默认为0,表示关闭.

net.ipv4.tcp\_tw\_reuse = 1 --表示开启重用.允许将TIME-WAIT sockets重新用于新的TCP连接,默认为

0,表示关闭.

net.ipv4.tcp\_tw\_recycle = 1 --表示开启TCP连接中TIME-WAIT sockets的快速回收.默认为0,表示关闭.

net.ipv4.tcp\_fin\_timeout = 30 --修改系統默认的 TIMEOUT 时间

\[root@AY140528120357495c4bZ ~\]\# vim /etc/sysctl.conf

net.ipv4.tcp\_syncookies = 1  
net.ipv4.tcp\_tw\_reuse = 1  
net.ipv4.tcp\_tw\_recycle = 1  
net.ipv4.tcp\_fin\_timeout = 30

\[root@AY140528120357495c4bZ ~\]\#

3.使用配置生效

\[root@AY140528120357495c4bZ ~\]\# sysctl -p | grep tcp  
net.ipv4.tcp\_syncookies = 1  
net.ipv4.tcp\_max\_tw\_buckets = 5000  
net.ipv4.tcp\_max\_syn\_backlog = 1024  
net.ipv4.tcp\_synack\_retries = 2  
net.ipv4.tcp\_syncookies = 1  
net.ipv4.tcp\_tw\_reuse = 1  
net.ipv4.tcp\_tw\_recycle = 1  
net.ipv4.tcp\_fin\_timeout = 30  
\[root@AY140528120357495c4bZ ~\]\#

4.查看修改内核后的TIME\_WAIT连接

\[root@AY140528120357495c4bZ ~\]\# netstat -antup | grep 'TIME\_WAIT' | wc -l  
9  
\[root@AY140528120357495c4bZ ~\]\#