8

Does setting tcp_orphan_retries to 0 mean there is no limit to retries, or does it mean that it won't retry at all?

3 Answers 3

4

It doesn't mean "try forever", it means "don't try at all." This is the server trying to politely tell the client that the server is getting ready to close his socket, and if it would please do an orderly disconnect, or send some more data, that would be wonderful. It will try X times to get the client to respond, and after X, it reclaims the socket on the system side.

Setting that number to 0 would suggest to me that that server is heavily utilized, with a zero tolerance policy for orphans. It may also have been a response to a DDOS: lot of DDOS' work by opening a socket connection and then hanging on to it, doing nothing.

3
  • I had that number set to 0 by default and the result was that the orphans stick around forever. Had to set it to a larger number to make them go away.
    – jjrv
    Feb 23, 2012 at 13:28
  • 2
    it means "don't try at all." : incorrect. see the answer with the kernel function tcp_orphan_retries()
    – Massimo
    Dec 2, 2015 at 18:45
  • 2
    This answer is incorrect! Setting tcp_orphan_retries to 0 means 8. See xrtgavin's answer below.
    – Elad Nava
    Jul 19, 2016 at 12:47
9

Setting tcp_orphan_retries to 0 is a special case, see tcp_timer.c

 98 /* Calculate maximal number or retries on an orphaned socket. */
 99 static int tcp_orphan_retries(struct sock *sk, int alive)
 100 {
 101         int retries = sysctl_tcp_orphan_retries; /* May be zero. */
 102 
 103         /* We know from an ICMP that something is wrong. */
 104         if (sk->sk_err_soft && !alive)
 105                 retries = 0;
 106 
 107         /* However, if socket sent something recently, select some safe
 108          * number of retries. 8 corresponds to >100 seconds with minimal
 109          * RTO of 200msec. */
 110         if (retries == 0 && alive)
 111                 retries = 8;
 112         return retries;
 113 }
1
  • 1
    Which supports what the man page says. "tcp_orphan_retries (integer; default: 8; since Linux 2.4)"
    – hookenz
    May 15, 2014 at 2:33
0

Pretty sure it means it won't retry at all. These comments from kernel source (tcp_timer.c) support that:

/* Do not allow orphaned sockets to eat all our resources.
 * This is direct violation of TCP specs, but it is required
 * to prevent DoS attacks. It is called when a retransmission timeout
 * or zero probe timeout occurs on orphaned socket.
 *
 * Criteria is still not confirmed experimentally and may change.
 * We kill the socket, if:
 * 1. If number of orphaned sockets exceeds an administratively configured
 *    limit.
 * 2. If we have strong memory pressure.
 */
1
  • This comment is for tcp_out_of_resources(), and "an administratively configured limit" is closer in definition to tcp_max_orphans.
    – Andrew B
    Sep 10, 2014 at 17:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .