Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does setting tcp_orphan_retries to 0 mean there is no limit to retries, or does it mean that it won't retry at all?

share|improve this question
up vote 2 down vote accepted

It doesn't mean "try forever", it means "don't try at all." This is the server trying to politely tell the client that the server is getting ready to close his socket, and if it would please do an orderly disconnect, or send some more data, that would be wonderful. It will try X times to get the client to respond, and after X, it reclaims the socket on the system side.

Setting that number to 0 would suggest to me that that server is heavily utilized, with a zero tolerance policy for orphans. It may also have been a response to a DDOS: lot of DDOS' work by opening a socket connection and then hanging on to it, doing nothing.

share|improve this answer
I had that number set to 0 by default and the result was that the orphans stick around forever. Had to set it to a larger number to make them go away. – jjrv Feb 23 '12 at 13:28
it means "don't try at all." : incorrect. see the answer with the kernel function tcp_orphan_retries() – Massimo Dec 2 '15 at 18:45
This answer is incorrect! Setting tcp_orphan_retries to 0 means 8. See xrtgavin's answer below. – Elad Nava Jul 19 at 12:47

Setting tcp_orphan_retries to 0 is a special case, see tcp_timer.c

 98 /* Calculate maximal number or retries on an orphaned socket. */
 99 static int tcp_orphan_retries(struct sock *sk, int alive)
 100 {
 101         int retries = sysctl_tcp_orphan_retries; /* May be zero. */
 103         /* We know from an ICMP that something is wrong. */
 104         if (sk->sk_err_soft && !alive)
 105                 retries = 0;
 107         /* However, if socket sent something recently, select some safe
 108          * number of retries. 8 corresponds to >100 seconds with minimal
 109          * RTO of 200msec. */
 110         if (retries == 0 && alive)
 111                 retries = 8;
 112         return retries;
 113 }
share|improve this answer
Which supports what the man page says. "tcp_orphan_retries (integer; default: 8; since Linux 2.4)" – Matt May 15 '14 at 2:33

Pretty sure it means it won't retry at all. These comments from kernel source (tcp_timer.c) support that:

/* Do not allow orphaned sockets to eat all our resources.
 * This is direct violation of TCP specs, but it is required
 * to prevent DoS attacks. It is called when a retransmission timeout
 * or zero probe timeout occurs on orphaned socket.
 * Criteria is still not confirmed experimentally and may change.
 * We kill the socket, if:
 * 1. If number of orphaned sockets exceeds an administratively configured
 *    limit.
 * 2. If we have strong memory pressure.
share|improve this answer
This comment is for tcp_out_of_resources(), and "an administratively configured limit" is closer in definition to tcp_max_orphans. – Andrew B Sep 10 '14 at 17:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.