lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Mon, 17 May 2021 10:00:04 +0200
From:   Troels Arvin <troels@...in.dk>
To:     netdev@...r.kernel.org
Subject: Default value of ipv4.tcp_keepalive_time

Hello,

At work, we have spent a great deal of work on a situation which ended 
up being resolved by changing the net.ipv4.tcp_keepalive_time sysctl to 
a value much lower than the default (we set it to 300). This was two 
Linux-based systems communicating without any firewalls in-between, 
where some long-running connections would be considered down by one 
system, while the other expected them to still be around.

The following is the description of the setting:
"The interval between the last data packet sent (simple ACKs are not 
considered data) and the first keepalive probe; after the connection is 
marked to need keepalive, this counter is not used any further."

The default value of net.ipv4.tcp_keepalive_time sysctl is 7200 seconds, 
i.e. two hours.

It seems odd to me to still have such a long period of waiting, before 
keep-alive kicks in. With such a long initial wait, it's questionable 
how much value the keep-alive functionality has, I think.

Could it be that it's time to change the default? I would suggest a 
value of 10 minutes, i.e. 600 seconds, but I have to admit, that I don't 
have any objective argument for exactly that value.

-- 
Regards,
Troels Arvin


Powered by blists - more mailing lists