TCP TIME-WAIT
Contents
TCP TIME-WAIT#
Linux 2MSL#
Coping with the TCP TIME-WAIT state on busy Linux servers
RFC 793 requires the TIME-WAIT state to last twice the time of the MSL. On Linux, this duration is not tunable and is defined in include/net/tcp.h as one minute:
#define TCP_TIMEWAIT_LEN (60*HZ) /* how long to wait to destroy TIME-WAIT * state, about 60 seconds */
Lower the conntrack tracking time for TIME_WAIT connections
TCP connections in
TIME_WAIT
are maintained for sixty seconds by the Linux kernel.Note: There’s many misleading Google hits indicating that this is configurable through the sysctl value
net.ipv4.tcp_fin_timeout
but after some digging that turned out to be bogus. It’s a constant defined in the Linux lernel in include/net/tcp.h
:However
nf_conntrack
tracks these for 120 seconds by default (configurable through the sysctl valuenf_conntrack_tcp_timeout_time_wait
) Reduce this to 65 (the maximum time used by the kernel plus a five seconds error margin).