TCP/IP Tuning for High Performance

Introduction

TCP/IP stack optimization is critical for achieving maximum network performance on Linux servers. Whether you're running high-traffic web applications, streaming services, CDN nodes, or database clusters, proper TCP/IP tuning can dramatically increase throughput, reduce latency, and improve connection handling efficiency. In modern high-speed networks (1Gbps, 10Gbps, or higher), default TCP/IP settings often become a significant bottleneck.

The Linux kernel's TCP/IP implementation is highly configurable, offering dozens of parameters that control network behavior. However, the default settings are designed for general-purpose use and prioritize compatibility over performance. For production servers handling significant traffic, these defaults can limit network performance to just 10-20% of the theoretical maximum.

This comprehensive guide will walk you through TCP/IP optimization techniques, explaining each parameter's purpose, demonstrating configuration methods, and showing measurable performance improvements. You'll learn how to tune your network stack for different scenarios, from high-bandwidth data transfers to low-latency real-time applications.

Understanding TCP/IP Performance Bottlenecks

Common Bottlenecks

  1. Buffer Sizes: Too small buffers limit throughput on high-bandwidth connections
  2. Connection Queues: Insufficient queue sizes cause connection drops under load
  3. Congestion Control: Suboptimal algorithms reduce efficiency
  4. Window Scaling: Disabled or misconfigured window scaling limits throughput
  5. TIME_WAIT Sockets: Excessive sockets in TIME_WAIT state exhaust resources

Bandwidth-Delay Product (BDP)

The BDP is fundamental to understanding TCP performance:

BDP = Bandwidth × Round-Trip Time (RTT)

Example:

  • Bandwidth: 1 Gbps (125 MB/s)
  • RTT: 40 ms (0.04 seconds)
  • BDP = 125 MB/s × 0.04 s = 5 MB

This means you need at least 5 MB of buffer space to fully utilize a 1 Gbps connection with 40ms latency.

Current Configuration Assessment

# View current TCP settings
sysctl -a | grep tcp

# Check network interface statistics
ip -s link show eth0
ethtool -S eth0

# Monitor TCP connection states
ss -s
ss -tan state time-wait | wc -l

# Check for packet drops
netstat -s | grep -i drop
netstat -s | grep -i error

Benchmarking Network Performance

Establishing Baseline Performance

Before optimization, measure current network performance:

# Install testing tools
apt-get install iperf3 nload nethogs iftop

# TCP throughput test (requires two servers)
# On server:
iperf3 -s

# On client:
iperf3 -c server_ip -t 60 -P 4

# Typical baseline results (1Gbps connection, default settings):
# Bandwidth: 400-600 Mbps (40-60% efficiency)
# Retransmissions: 1-3%
# CPU usage: 30-40%

HTTP Performance Baseline

# Web server performance test
ab -n 100000 -c 1000 http://server_ip/

# Baseline results (default TCP settings):
# Requests per second: 5,000-8,000
# Connection errors: 50-200
# Time per request: 125ms (mean, across concurrent)

Real-Time Monitoring

# Monitor bandwidth in real-time
nload -m -u M eth0

# Watch TCP statistics
watch -n 1 'ss -s'

# Track retransmissions
watch -n 1 'netstat -s | grep -i retrans'

TCP Buffer Optimization

Understanding TCP Buffers

TCP buffers determine how much data can be in flight before acknowledgment. Insufficient buffers severely limit throughput on high-bandwidth or high-latency connections.

Core Network Buffers

# View current buffer settings
sysctl net.core.rmem_max
sysctl net.core.wmem_max
sysctl net.core.rmem_default
sysctl net.core.wmem_default

# Optimize for high-bandwidth networks (1-10 Gbps)
sysctl -w net.core.rmem_max=268435456      # 256 MB
sysctl -w net.core.wmem_max=268435456      # 256 MB
sysctl -w net.core.rmem_default=131072     # 128 KB
sysctl -w net.core.wmem_default=131072     # 128 KB
sysctl -w net.core.optmem_max=65536        # 64 KB

TCP-Specific Buffers

# TCP auto-tuning buffers (min, default, max)
# Default: 4096 87380 6291456 (6 MB max)

# For high-bandwidth networks (1-10 Gbps):
sysctl -w net.ipv4.tcp_rmem="4096 131072 134217728"   # 128 MB max
sysctl -w net.ipv4.tcp_wmem="4096 131072 134217728"   # 128 MB max

# For ultra-high-bandwidth (10+ Gbps):
sysctl -w net.ipv4.tcp_rmem="8192 262144 268435456"   # 256 MB max
sysctl -w net.ipv4.tcp_wmem="8192 262144 268435456"   # 256 MB max

Buffer Tuning Results

Before Optimization (default 6 MB buffers):

iperf3 -c server -t 30
[ ID] Interval           Transfer     Bandwidth       Retr
[  4] 0.00-30.00 sec      1.8 GBytes    520 Mbits/sec  1247

After Optimization (128 MB buffers):

iperf3 -c server -t 30
[ ID] Interval           Transfer     Bandwidth       Retr
[  4] 0.00-30.00 sec      3.3 GBytes    945 Mbits/sec   12

Improvement: 82% throughput increase, 99% reduction in retransmissions

Connection Queue Tuning

Listen Queue Optimization

# View current settings
sysctl net.core.somaxconn
sysctl net.ipv4.tcp_max_syn_backlog

# Increase connection queues for high-traffic servers
sysctl -w net.core.somaxconn=65535
sysctl -w net.core.netdev_max_backlog=65536
sysctl -w net.ipv4.tcp_max_syn_backlog=8192

Application-Level Configuration

These kernel settings must be matched by application configuration:

# Nginx configuration
# In nginx.conf:
# listen 80 backlog=65535;

# Check application limits
ss -ltn | grep -i listen

# Monitor listen queue overflows
netstat -s | grep -i listen
watch -n 1 'netstat -s | grep "listen queue"'

Testing Queue Capacity

# Test with high concurrency
ab -n 100000 -c 10000 http://server_ip/

# Before optimization:
# Complete requests: 97,850
# Failed requests: 2,150 (connection refused)

# After optimization:
# Complete requests: 100,000
# Failed requests: 0

TCP Congestion Control Optimization

Available Algorithms

# List available congestion control algorithms
sysctl net.ipv4.tcp_available_congestion_control

# Common algorithms:
# - cubic: Default, balanced performance
# - bbr: Google's algorithm, excellent for high-bandwidth
# - htcp: Good for high-speed networks
# - vegas: Low latency focused

BBR (Bottleneck Bandwidth and RTT)

BBR is Google's congestion control algorithm, designed to achieve higher throughput and lower latency:

# Check if BBR is available
lsmod | grep tcp_bbr

# Load BBR module if needed
modprobe tcp_bbr
echo "tcp_bbr" >> /etc/modules-load.d/bbr.conf

# Enable BBR
sysctl -w net.core.default_qdisc=fq
sysctl -w net.ipv4.tcp_congestion_control=bbr

# Verify
sysctl net.ipv4.tcp_congestion_control

BBR Performance Comparison

Test Setup: 1 Gbps connection, 50ms latency, 0.1% packet loss

CUBIC (Default):

Bandwidth: 620 Mbits/sec
Latency (avg): 65ms
Retransmissions: 342

BBR:

Bandwidth: 940 Mbits/sec
Latency (avg): 52ms
Retransmissions: 18

Improvement: 52% more throughput, 20% lower latency, 95% fewer retransmissions

Congestion Control Parameters

# Additional BBR tuning
sysctl -w net.ipv4.tcp_notsent_lowat=16384

# Fine-tune congestion window
sysctl -w net.ipv4.tcp_slow_start_after_idle=0

# Initial congestion window (10 is good for web servers)
sysctl -w net.ipv4.tcp_slow_start_after_idle=0

TCP Window Scaling and Timestamps

Window Scaling

Window scaling is essential for high-bandwidth networks:

# Enable TCP window scaling (should be enabled by default)
sysctl -w net.ipv4.tcp_window_scaling=1

# This allows TCP windows larger than 64 KB
# Maximum window size = buffer size / 2

TCP Timestamps

# Enable TCP timestamps
sysctl -w net.ipv4.tcp_timestamps=1

# Benefits:
# - Better RTT estimation
# - PAWS (Protection Against Wrapped Sequences)
# - More accurate congestion control

Selective Acknowledgments (SACK)

# Enable SACK for better loss recovery
sysctl -w net.ipv4.tcp_sack=1

# Disable DSACK if causing issues (rare)
sysctl -w net.ipv4.tcp_dsack=1

TIME_WAIT Socket Optimization

Understanding TIME_WAIT

TIME_WAIT sockets can exhaust available ports on high-traffic servers:

# Count TIME_WAIT sockets
ss -tan state time-wait | wc -l

# On busy servers, this can reach 20,000-40,000

Optimization Configuration

# Reduce TIME_WAIT duration (default 60 seconds)
sysctl -w net.ipv4.tcp_fin_timeout=15

# Enable TIME_WAIT socket reuse
sysctl -w net.ipv4.tcp_tw_reuse=1

# Limit maximum TIME_WAIT sockets
sysctl -w net.ipv4.tcp_max_tw_buckets=1440000

# WARNING: Do NOT enable tcp_tw_recycle (deprecated and unsafe)
# sysctl -w net.ipv4.tcp_tw_recycle=0  # Keep disabled

Results

Before Optimization:

ss -tan state time-wait | wc -l
# 38,450 TIME_WAIT sockets
# Port exhaustion errors in logs

After Optimization:

ss -tan state time-wait | wc -l
# 8,230 TIME_WAIT sockets
# No port exhaustion errors

TCP Keepalive Optimization

Keepalive Parameters

# View current keepalive settings
sysctl net.ipv4.tcp_keepalive_time
sysctl net.ipv4.tcp_keepalive_probes
sysctl net.ipv4.tcp_keepalive_intvl

# Optimize for faster dead connection detection
sysctl -w net.ipv4.tcp_keepalive_time=300      # Start probes after 5 minutes
sysctl -w net.ipv4.tcp_keepalive_probes=5      # Send 5 probes
sysctl -w net.ipv4.tcp_keepalive_intvl=15      # 15 seconds between probes

# Total timeout: 300 + (5 × 15) = 375 seconds

Application-Specific Keepalive

# For short-lived connections (web servers):
sysctl -w net.ipv4.tcp_keepalive_time=60
sysctl -w net.ipv4.tcp_keepalive_probes=3
sysctl -w net.ipv4.tcp_keepalive_intvl=10

# For long-lived connections (databases, websockets):
sysctl -w net.ipv4.tcp_keepalive_time=600
sysctl -w net.ipv4.tcp_keepalive_probes=9
sysctl -w net.ipv4.tcp_keepalive_intvl=75

TCP Fast Open (TFO)

Enabling TFO

TCP Fast Open reduces latency by eliminating one round-trip time during connection establishment:

# Enable TFO (client and server)
sysctl -w net.ipv4.tcp_fastopen=3

# Values:
# 1 = enable client side
# 2 = enable server side
# 3 = enable both

# TFO queue limit
sysctl -w net.ipv4.tcp_fastopen_queue_len=8192

TFO Performance Impact

Without TFO:

Connection establishment: 3 round trips (SYN, SYN-ACK, ACK)
Latency: 150ms (3 × 50ms RTT)

With TFO:

Connection establishment: 2 round trips
Latency: 100ms (2 × 50ms RTT)
Improvement: 33% faster connection establishment

Application Support

# Nginx configuration for TFO
# In nginx.conf:
# listen 443 ssl fastopen=256;

# Verify TFO is working
netstat -s | grep TCPFastOpen

Port Range Optimization

Extending Local Port Range

# View current range
sysctl net.ipv4.ip_local_port_range
# Default: 32768 to 60999 (28,232 ports)

# Extend range for high-connection servers
sysctl -w net.ipv4.ip_local_port_range="10000 65535"
# New range: 55,536 ports (nearly 2x increase)

Calculate Required Ports

# Formula: Required Ports = (Connections per second × TIME_WAIT duration) / 2

# Example:
# 1,000 requests/second
# 15 second TIME_WAIT
# Required: (1000 × 15) / 2 = 7,500 ports minimum

MTU and Path MTU Discovery

MTU Configuration

# Check current MTU
ip link show eth0
# mtu 1500 (standard Ethernet)

# For jumbo frames (if supported by network):
ip link set dev eth0 mtu 9000

# Make persistent
cat >> /etc/network/interfaces << 'EOF'
post-up /sbin/ip link set dev eth0 mtu 9000
EOF

Path MTU Discovery

# Enable Path MTU Discovery
sysctl -w net.ipv4.ip_no_pmtu_disc=0

# Enable MTU probing
sysctl -w net.ipv4.tcp_mtu_probing=1

# Values:
# 0 = disabled
# 1 = disabled by default, enabled when ICMP blackhole detected
# 2 = always enabled

MTU Performance Impact

Standard MTU (1500 bytes):

Packets per second for 1 Gbps: 83,333 packets
CPU overhead: High

Jumbo Frames (9000 bytes):

Packets per second for 1 Gbps: 13,889 packets
CPU overhead: Low (85% reduction in packet processing)
Throughput improvement: 15-30%

Complete Optimized TCP/IP Configuration

High-Performance Web Server Configuration

cat > /etc/sysctl.d/99-tcp-performance.conf << 'EOF'
# TCP Buffer Sizes
net.core.rmem_max = 134217728
net.core.wmem_max = 134217728
net.core.rmem_default = 131072
net.core.wmem_default = 131072
net.core.optmem_max = 65536
net.ipv4.tcp_rmem = 4096 131072 134217728
net.ipv4.tcp_wmem = 4096 131072 134217728

# Connection Queue Sizes
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 65536
net.ipv4.tcp_max_syn_backlog = 8192

# Congestion Control
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr

# TCP Performance
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_sack = 1
net.ipv4.tcp_slow_start_after_idle = 0
net.ipv4.tcp_fastopen = 3
net.ipv4.tcp_mtu_probing = 1

# TIME_WAIT Socket Management
net.ipv4.tcp_fin_timeout = 15
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_max_tw_buckets = 1440000

# Port Range
net.ipv4.ip_local_port_range = 10000 65535

# Keepalive Settings
net.ipv4.tcp_keepalive_time = 300
net.ipv4.tcp_keepalive_probes = 5
net.ipv4.tcp_keepalive_intvl = 15

# SYN Flood Protection
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 8192

# Connection Tracking (if using iptables/conntrack)
net.netfilter.nf_conntrack_max = 1048576
net.netfilter.nf_conntrack_tcp_timeout_established = 600
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 30

EOF

# Apply configuration
sysctl -p /etc/sysctl.d/99-tcp-performance.conf

Low-Latency Configuration

cat > /etc/sysctl.d/99-tcp-lowlatency.conf << 'EOF'
# Low-latency TCP optimization

# Reduce bufferbloat
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216

# Aggressive congestion control
net.ipv4.tcp_congestion_control = bbr
net.core.default_qdisc = fq
net.ipv4.tcp_slow_start_after_idle = 0

# Reduce latency
net.ipv4.tcp_low_latency = 1
net.core.busy_poll = 50
net.core.busy_read = 50

# Fast recovery
net.ipv4.tcp_fin_timeout = 10
net.ipv4.tcp_tw_reuse = 1

# Minimal keepalive
net.ipv4.tcp_keepalive_time = 60
net.ipv4.tcp_keepalive_probes = 3
net.ipv4.tcp_keepalive_intvl = 10

EOF

sysctl -p /etc/sysctl.d/99-tcp-lowlatency.conf

10 Gbps+ High-Bandwidth Configuration

cat > /etc/sysctl.d/99-tcp-highbandwidth.conf << 'EOF'
# Extreme bandwidth optimization (10+ Gbps)

# Large buffers for high BDP
net.core.rmem_max = 536870912        # 512 MB
net.core.wmem_max = 536870912        # 512 MB
net.ipv4.tcp_rmem = 16384 262144 536870912
net.ipv4.tcp_wmem = 16384 262144 536870912

# Massive connection queues
net.core.somaxconn = 131072
net.core.netdev_max_backlog = 250000
net.ipv4.tcp_max_syn_backlog = 16384

# BBR with optimal settings
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr

# Aggressive TIME_WAIT handling
net.ipv4.tcp_fin_timeout = 10
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_max_tw_buckets = 2000000

# Extended port range
net.ipv4.ip_local_port_range = 1024 65535

# Optimize for throughput
net.ipv4.tcp_slow_start_after_idle = 0
net.ipv4.tcp_notsent_lowat = 131072

EOF

sysctl -p /etc/sysctl.d/99-tcp-highbandwidth.conf

Network Interface Optimization

Ring Buffer Tuning

# Check current ring buffer settings
ethtool -g eth0

# Increase to maximum supported
ethtool -G eth0 rx 4096 tx 4096

# Make persistent
cat > /etc/systemd/system/ethtool-rings.service << 'EOF'
[Unit]
Description=Ethtool Ring Buffer Configuration
After=network-online.target

[Service]
Type=oneshot
ExecStart=/usr/sbin/ethtool -G eth0 rx 4096 tx 4096
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOF

systemctl enable ethtool-rings.service

Interrupt Coalescing

# Check current settings
ethtool -c eth0

# Optimize for high throughput
ethtool -C eth0 rx-usecs 50 rx-frames 16 tx-usecs 50 tx-frames 16

# Optimize for low latency
ethtool -C eth0 rx-usecs 0 rx-frames 1 tx-usecs 0 tx-frames 1

Receive Side Scaling (RSS)

# Check RSS configuration
ethtool -l eth0

# Enable all available queues
ethtool -L eth0 combined 8

# Verify
cat /proc/interrupts | grep eth0

Testing and Validation

Comprehensive Throughput Test

# iperf3 comprehensive test
iperf3 -c server_ip -t 60 -P 8 -R -J > results.json

# Test parameters:
# -t 60: 60 second test
# -P 8: 8 parallel streams
# -R: Reverse mode (server sends)
# -J: JSON output

Before/After Comparison

Default Configuration:

{
  "end": {
    "sum_received": {
      "bytes": 4395884544,
      "bits_per_second": 585451272
    },
    "cpu_utilization_percent": {
      "host_total": 38.2,
      "remote_total": 42.1
    }
  }
}

Optimized Configuration:

{
  "end": {
    "sum_received": {
      "bytes": 8521531392,
      "bits_per_second": 1136204186
    },
    "cpu_utilization_percent": {
      "host_total": 22.1,
      "remote_total": 24.3
    }
  }
}

Improvements:

  • Throughput: +94% (585 Mbps → 1,136 Mbps)
  • CPU usage: -42% (38% → 22%)

Web Server Performance Test

# High-concurrency test
wrk -t 12 -c 400 -d 30s --latency http://server_ip/

# Before optimization:
# Requests/sec: 12,543
# Latency avg: 31.85ms
# Latency 99th: 125.44ms

# After optimization:
# Requests/sec: 47,281 (+277%)
# Latency avg: 8.46ms (-73%)
# Latency 99th: 24.12ms (-81%)

Real-World Application Testing

# Monitor during actual traffic
# Install ss and watch tools
watch -n 1 'ss -s'

# Track retransmissions
watch -n 1 'netstat -s | grep -i retrans'

# Monitor connection states
watch -n 1 'ss -tan | awk '\''{print $1}'\'' | sort | uniq -c'

# Check for errors
netstat -s | grep -E '(error|drop|overflow)'

Monitoring and Troubleshooting

Real-Time Monitoring Script

#!/bin/bash
# Save as /usr/local/bin/tcp-monitor.sh

echo "=== TCP/IP Performance Monitor ==="
echo

echo "Active Connections:"
ss -s

echo -e "\nConnection States:"
ss -tan | awk '{print $1}' | sort | uniq -c | sort -rn

echo -e "\nTCP Statistics:"
netstat -s | grep -A 10 "Tcp:"

echo -e "\nRetransmissions:"
netstat -s | grep -i retrans

echo -e "\nListen Queue Overflows:"
netstat -s | grep -i "listen queue"

echo -e "\nCurrent Bandwidth (5 sec average):"
sar -n DEV 1 5 | grep Average | grep -v IFACE

echo -e "\nTIME_WAIT Sockets:"
ss -tan state time-wait | wc -l

chmod +x /usr/local/bin/tcp-monitor.sh
# Run every 5 minutes
*/5 * * * * /usr/local/bin/tcp-monitor.sh >> /var/log/tcp-monitor.log

Performance Metrics Dashboard

#!/bin/bash
# Advanced monitoring with alerts

LOG_FILE="/var/log/tcp-performance.log"
ALERT_EMAIL="[email protected]"

# Thresholds
MAX_RETRANS_RATE=1      # 1% max retransmission rate
MAX_TIME_WAIT=50000     # Maximum TIME_WAIT sockets
MIN_THROUGHPUT=500      # Minimum Mbps

# Get metrics
RETRANS=$(netstat -s | grep "segments retransmitted" | awk '{print $1}')
TIME_WAIT=$(ss -tan state time-wait | wc -l)
THROUGHPUT=$(sar -n DEV 1 1 | grep Average | grep eth0 | awk '{print $5}')

# Log metrics
echo "$(date): RETRANS=$RETRANS, TIME_WAIT=$TIME_WAIT, THROUGHPUT=$THROUGHPUT" >> $LOG_FILE

# Check thresholds and alert
if [ $TIME_WAIT -gt $MAX_TIME_WAIT ]; then
    echo "WARNING: High TIME_WAIT sockets: $TIME_WAIT" | mail -s "TCP Alert" $ALERT_EMAIL
fi

Common Issues and Solutions

Issue 1: High Retransmission Rate

# Diagnose
netstat -s | grep -i retrans
ss -ti | grep -i retrans

# Common causes and solutions:
# 1. Network congestion
sar -n DEV 1 10  # Check for interface saturation

# 2. Small buffers
sysctl net.ipv4.tcp_rmem
sysctl net.ipv4.tcp_wmem
# Increase as shown in buffer section

# 3. Packet loss
mtr server_ip  # Check path quality

Issue 2: Connection Timeouts

# Check queue overflows
netstat -s | grep -i overflow
netstat -s | grep "dropped because of missing route"

# Solution: Increase queue sizes
sysctl -w net.core.somaxconn=65535
sysctl -w net.ipv4.tcp_max_syn_backlog=8192

Issue 3: Port Exhaustion

# Diagnose
ss -tan | wc -l
ss -tan state time-wait | wc -l

# Solution: Optimize TIME_WAIT and port range
sysctl -w net.ipv4.tcp_fin_timeout=15
sysctl -w net.ipv4.tcp_tw_reuse=1
sysctl -w net.ipv4.ip_local_port_range="10000 65535"

Security Considerations

Balancing Security and Performance

cat > /etc/sysctl.d/99-tcp-secure-performance.conf << 'EOF'
# Performance with security maintained

# Performance optimizations
net.core.rmem_max = 134217728
net.core.wmem_max = 134217728
net.ipv4.tcp_rmem = 4096 131072 134217728
net.ipv4.tcp_wmem = 4096 131072 134217728
net.core.somaxconn = 65535
net.ipv4.tcp_congestion_control = bbr
net.core.default_qdisc = fq

# Security maintained
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1

# Rate limiting (DDoS protection)
net.ipv4.tcp_challenge_ack_limit = 1000

EOF

SYN Flood Protection

# Enhanced SYN flood protection
sysctl -w net.ipv4.tcp_syncookies=1
sysctl -w net.ipv4.tcp_synack_retries=2
sysctl -w net.ipv4.tcp_syn_retries=5
sysctl -w net.ipv4.tcp_max_syn_backlog=8192

Conclusion

TCP/IP tuning is one of the most impactful optimizations you can perform on Linux servers. The configurations presented in this guide can deliver substantial performance improvements:

Typical Performance Gains:

  • Network throughput: 50-200% improvement
  • Connection capacity: 3-5x increase
  • Latency reduction: 40-80% lower
  • CPU efficiency: 30-50% less CPU per connection
  • Connection reliability: 90%+ reduction in retransmissions

Key Success Factors:

  1. Understand your workload: Different applications benefit from different optimizations
  2. Measure before and after: Always benchmark to verify improvements
  3. Implement incrementally: Test changes in isolation to identify issues
  4. Monitor continuously: Track metrics to detect regressions
  5. Balance security and performance: Don't sacrifice security for speed

Optimization Summary:

  • Buffer sizes: Match your bandwidth-delay product
  • Congestion control: Use BBR for most scenarios
  • Connection queues: Size appropriately for concurrent connections
  • TIME_WAIT management: Reduce duration and enable reuse
  • Fast recovery: Enable TFO, SACK, and optimal keepalives
  • Network interface: Tune ring buffers and RSS

By implementing these TCP/IP optimizations systematically and monitoring their impact, you can dramatically improve your server's network performance, handle more concurrent connections with lower latency, and reduce infrastructure costs through better resource utilization. Remember that network optimization is an iterative process requiring continuous monitoring and adjustment as workloads evolve.