netdev - Re: [PATCH 2/2] socket: add minimum listen queue length sysctl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1301123169.2979.4.camel@edumazet-laptop>
Date:	Sat, 26 Mar 2011 08:06:09 +0100
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Hagen Paul Pfeifer <hagen@...u.net>
Cc:	Rick Jones <rick.jones2@...com>, netdev@...r.kernel.org
Subject: Re: [PATCH 2/2] socket: add minimum listen queue length sysctl

Le samedi 26 mars 2011 à 00:51 +0100, Hagen Paul Pfeifer a écrit :

> IMHO, _if_ a programmer modifies the send or receive buffer he _knows_ exactly
> why. If he does not modify the buffer it is fine too, because _we_ tune the
> buffers as good as we can - and we are good in this.
> 
> But, the backlog is different. Often the programmer does _not_ know how to
> tune this variable. And, often the backlog depends on the target system, on
> the network characteristic and the like.
> 
> Therefore we provide the system administrator the _ability_ to tune the actual
> backlog.

What you want to tune is not the backlog (max number of ready to be
delivered connections to accept()), but the number of SYN_RECV half
connections, still waiting for a second packet coming from clients.

An application might really want to have a listen(fd, 1) to accept one
incoming connection, but still be able to survive to a SYNFLOOD.

By the way, you still are confused by the fact that tcp_max_syn_backlog
has nothing to do with the 'backlog', as I already mentioned it, its a
parameter to cap the size of the hash table associated to a listener
socket.

You can have a hash table with 1024 slots, and still have a backlog of
16384 for example.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html