lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 17 May 2021 10:00:04 +0200 From: Troels Arvin <troels@...in.dk> To: netdev@...r.kernel.org Subject: Default value of ipv4.tcp_keepalive_time Hello, At work, we have spent a great deal of work on a situation which ended up being resolved by changing the net.ipv4.tcp_keepalive_time sysctl to a value much lower than the default (we set it to 300). This was two Linux-based systems communicating without any firewalls in-between, where some long-running connections would be considered down by one system, while the other expected them to still be around. The following is the description of the setting: "The interval between the last data packet sent (simple ACKs are not considered data) and the first keepalive probe; after the connection is marked to need keepalive, this counter is not used any further." The default value of net.ipv4.tcp_keepalive_time sysctl is 7200 seconds, i.e. two hours. It seems odd to me to still have such a long period of waiting, before keep-alive kicks in. With such a long initial wait, it's questionable how much value the keep-alive functionality has, I think. Could it be that it's time to change the default? I would suggest a value of 10 minutes, i.e. 600 seconds, but I have to admit, that I don't have any objective argument for exactly that value. -- Regards, Troels Arvin
Powered by blists - more mailing lists