Socket queues and connection states - TCP tuning

TCP buffers, the listen backlog, and the SYN queue determine how many connections a host can handle. This lesson covers how to read and tune them.

TCP buffers

Each TCP connection has:

• Send buffer: outgoing data the application has not yet been ACKed.
• Receive buffer: incoming data the application has not yet read.

The kernel autotunes these within sysctl limits.

# Default sizes (read from /proc)
sysctl net.ipv4.tcp_rmem    # min, default, max receive
sysctl net.ipv4.tcp_wmem    # min, default, max send

Typical values:

net.ipv4.tcp_rmem = 4096 87380 6291456
net.ipv4.tcp_wmem = 4096 16384 4194304

• tcp_rmem: 4 KB minimum, 87 KB default, 6 MB max.
• tcp_wmem: 4 KB minimum, 16 KB default, 4 MB max.

The application can set buffer sizes via SO_RCVBUF and SO_SNDBUF. The kernel autotunes within the sysctl limits.

Listen backlog

When a TCP server listens, incoming SYNs are queued. The backlog is the size of the queue:

sysctl net.core.somaxconn    # system-wide max backlog

The application sets its own backlog (often 128 by default). The kernel clamps to net.core.somaxconn.

If the backlog is full, new SYNs are dropped. Symptoms:

• Connection refused (ECONNREFUSED) on a service that should be listening.
• SYN cookies is enabled but the connection is slow.

For high-traffic servers, increase:

echo 4096 > /proc/sys/net/core/somaxconn

In the application, set the listen backlog higher (e.g. listen(sock, 4096)).

SYN cookies

SYN cookies protect against SYN flood attacks. When the backlog is full, the kernel uses cookies instead of dropping:

sysctl net.ipv4.tcp_syncookies

1 (default) is recommended. SYN cookies have minor limitations (no TCP options) but provide DDoS protection.

Read socket state

ss -s                    # summary
ss -tinp                # TCP connections with process info
ss -lunp                # listening sockets
ss -o state established  # only established
ss -t state time-wait | wc -l    # TIME_WAIT count

Common state issues:

• High TIME_WAIT: many short connections, not cleaned up.
• High CLOSE_WAIT: application not closing connections.
• High SYN_RECV: SYN flood or slow application accept.

Tune sysctl for high-connection workloads

# Increase file descriptor limit
sysctl fs.file-max
ulimit -n

# Increase ephemeral port range
sysctl net.ipv4.ip_local_port_range

# Reduce TIME_WAIT
sysctl net.ipv4.tcp_tw_reuse

# Increase listen backlog
sysctl net.core.somaxconn

# Increase TCP buffers
sysctl net.ipv4.tcp_rmem
sysctl net.ipv4.tcp_wmem

# Increase SYN backlog
sysctl net.ipv4.tcp_max_syn_backlog

For a high-traffic web server:

sysctl -w net.core.somaxconn=4096
sysctl -w net.ipv4.tcp_max_syn_backlog=4096
sysctl -w net.ipv4.tcp_tw_reuse=1
sysctl -w net.ipv4.tcp_rmem='4096 87380 16777216'
sysctl -w net.ipv4.tcp_wmem='4096 65536 16777216'

Common patterns

Knowledge check