What are the ramifications of setting tcp_tw_recycle/reuse to 1?

Question

I set both tcp_tw_recycle/reuse to 1 in my configuration file.

What are the ramifications of doing this?

If a tcp socket is re-used, does that pose a security risk? i.e. 2 different connections both potentially being able to send data in?

Is it suitable for short-lived connections with litle chance of reconnection?

Answer 1

From 'man 7 tcp' You will see this:

   tcp_tw_recycle (Boolean; default: disabled; since Linux 2.4)
          Enable fast recycling of TIME_WAIT sockets.  Enabling this option is not recommended since this causes problems when working with NAT
          (Network Address Translation).

   tcp_tw_reuse (Boolean; default: disabled; since Linux 2.4.19/2.6)
          Allow  to  reuse  TIME_WAIT  sockets  for  new connections when it is safe from protocol viewpoint.  It should not be changed without
          advice/request of technical experts.

Not much help there. This uestion also has some good insight:

http://stackoverflow.com/questions/6426253/tcp-tw-reuse-vs-tcp-tw-recycle-which-to-use-or-both

But not specific info on why reuse is safer than recycle. The basic answer is that tcp_tw_reuse will allow one to make use of the same socket if there is already one in TIME_WAIT with the same TCP parameters and that is in a state where no further traffic is expected (I believe its when a FIN has been sent). tcp_tw_recycle on the other hand will just reuse the sockets that are in TIME_WAIT with the same parameters regardless of the state, which can confuse stateful firewalls which might be expecting different packets.

tcp_tw_reuse can be done selectively in code by setting the SO_REUSEADDR socket option, documented in man 7 socket as such:

   SO_REUSEADDR
          Indicates that the rules used in validating addresses supplied in a bind(2) call should allow reuse of local addresses.  For  AF_INET
          sockets  this means that a socket may bind, except when there is an active listening socket bound to the address.  When the listening
          socket is bound to INADDR_ANY with a specific port then it is not possible to bind to this port for any local address.   Argument  is
          an integer boolean flag.