On a busy† Debian Lenny server of mine I am considering disabling TCP Window Scaling. Why?
- I'd like to enable syn cookies, which disables TCP Window Scaling. This server is locally firewalled and the protection against syn flood attacks could be a good thing, right?
- The kernel logs have many "TCP: Treason uncloaked!" messages. It does not appear to be an attack, having occurred regularly for ages, but it still concerns me. From what I understand, this message is a result of a disagrement between client and server about the size of the TCP window and is generally not a big deal.
So I ask myself "Does the box really need TCP Window Scaling?" Before I even try to experiment and benchmark, it seems prudent to query the boffins of ServerFault.
Some relevant details:
- many (10-30%) of requests are for 5-50MB files
- the large files are sent at a regulated bit rate (~2Mbps)
- clients are on the Internet and 90% within 250km
How valuable is TCP Window Scaling?
- Is the CPU dramatically impacted? If so, how much?
- Is networking performance degraded? Latency does not bother me, but throughput below a minimum threshold would.
- Anything else I might be missing?
† = 3Gbps worth of LACP'd NICs + hundreds of millions of HTTP requests + tens of terabytes of traffic per month