Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Does setting tcp_orphan_retries to 0 mean there is no limit to retries, or does it mean that it won't retry at all?

share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

It doesn't mean "try forever", it means "don't try at all." This is the server trying to politely tell the client that the server is getting ready to close his socket, and if it would please do an orderly disconnect, or send some more data, that would be wonderful. It will try X times to get the client to respond, and after X, it reclaims the socket on the system side.

Setting that number to 0 would suggest to me that that server is heavily utilized, with a zero tolerance policy for orphans. It may also have been a response to a DDOS: lot of DDOS' work by opening a socket connection and then hanging on to it, doing nothing.

share|improve this answer
    
I had that number set to 0 by default and the result was that the orphans stick around forever. Had to set it to a larger number to make them go away. –  jjrv Feb 23 '12 at 13:28
add comment

Setting tcp_orphan_retries to 0 is a special case, see tcp_timer.c

 98 /* Calculate maximal number or retries on an orphaned socket. */
 99 static int tcp_orphan_retries(struct sock *sk, int alive)
 100 {
 101         int retries = sysctl_tcp_orphan_retries; /* May be zero. */
 102 
 103         /* We know from an ICMP that something is wrong. */
 104         if (sk->sk_err_soft && !alive)
 105                 retries = 0;
 106 
 107         /* However, if socket sent something recently, select some safe
 108          * number of retries. 8 corresponds to >100 seconds with minimal
 109          * RTO of 200msec. */
 110         if (retries == 0 && alive)
 111                 retries = 8;
 112         return retries;
 113 }
share|improve this answer
    
Which supports what the man page says. "tcp_orphan_retries (integer; default: 8; since Linux 2.4)" –  Matt May 15 at 2:33
add comment

Pretty sure it means it won't retry at all. These comments from kernel source (tcp_timer.c) support that:

/* Do not allow orphaned sockets to eat all our resources.
 * This is direct violation of TCP specs, but it is required
 * to prevent DoS attacks. It is called when a retransmission timeout
 * or zero probe timeout occurs on orphaned socket.
 *
 * Criteria is still not confirmed experimentally and may change.
 * We kill the socket, if:
 * 1. If number of orphaned sockets exceeds an administratively configured
 *    limit.
 * 2. If we have strong memory pressure.
 */
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.