67 votes

Optimal value for Nginx worker_connections

Let's take the pragmatic approach. All these limits are things that were hardcoded and designed in the past century when hardware was slow and expensive. We're in 2016 now, an average wall-mart ...
  • 2,829
60 votes

I accidentaly forbid SSH connection to a remote server... What's next?

There are several alternatives: See if they have IPMI / "KVM" / console access to the server which lets you control it as if you had a physical keyboard plugged into it. If they don't offer that, see ...
  • 973
47 votes

I accidentaly forbid SSH connection to a remote server... What's next?

If you have not yet saved the IPtables rule, you can reboot server on VPS (if available) and the rule should disappear.
  • 1,414
34 votes

RDP fakeout when connectiong: does nothing, no error

I've encountered this type of behavior several times so far with Windows 8/8.1 or Server 2012 machines when they've been rebooted and have a lot of updates to install. For whatever reason it appears ...
30 votes

I accidentaly forbid SSH connection to a remote server... What's next?

This is what human-staffed help lines are for. Call the service provider, and have one of their operators remove the rule for you.
  • 301
26 votes

Optimal value for Nginx worker_connections

ulimit -a will tell you how many open files your system allows a process to use. Also, net.ipv4.ip_local_port_range sets the total range of sockets to enable per IP. So, your worker_connections ...
  • 1,700
26 votes
Accepted

What causes SSH error: kex_exchange_identification: Connection closed by remote host?

Weirdly, none actually try to authenticate to open a session. Some spiders and services like Shodan scans public ipv4 addresses for open services, e.g. salt masters, ftp servers, RDPs, and also SSH ...
  • 2,536
15 votes
Accepted

Why are connections in FIN_WAIT2 state not closed by the Linux kernel?

The kernel timeout only applies if the connection is orphaned. If the connection is still attached to a socket, the program that owns that socket is responsible for timing out the shutdown of the ...
14 votes

When using nmcli, what is considered a device, an interface and a connection? What's the difference?

A "network device" (in the context of a computer) typically refers to a piece of hardware - the network interface card (NIC). Once upon a time, back when dinosaurs roamed the internet and lots of ...
  • 53.6k
13 votes
Accepted

What does ConnectTimeout in ssh_config mean?

man ssh_config /ConnectTimeout ConnectTimeout Specifies the timeout (in seconds) used when connecting to the SSH server, instead of using the default system TCP timeout. This timeout is applied both ...
  • 115k
12 votes

Is ARP Connection oriented or connectionless?

ARP Connection oriented or connectionless? Connectionless - it's just a request and a response (or a broadcast just letting everyone know about something). It uses TCP It doesn't use TCP - TCP is ...
12 votes

Siege: descriptor table full sock.c:119: Too many open files

To solve this problem for myself, I had to adjust the OS "ulimit" setting: ulimit -a -- Check current setting ulimit -n 10000 -- Edit setting value Source: https://bugs.debian.org/cgi-bin/bugreport....
11 votes

RDP fakeout when connectiong: does nothing, no error

IT has been my experience that when you can authenticate but it does not launch the desktop, the remote server is installing updates or is in the middle of building the desktop environment. give it a ...
  • 111
9 votes

How to intentionally cause ssh root connection refused

You can't do that. Your server has no way of knowing what user the remote connection will try to login as, until after it has already connected! You should consider using fail2ban to block repeated ...
8 votes

wget ftp connection failing after PASV command

Another way is to avoid the passive mode, add --no-passive argument in your wget command can do it. wget -r --no-passive --no-parent ftp://account:<password>@<ip address>/folder/ -P /root
  • 181
8 votes
Accepted

After using killall -u root, I am unable to access server and all websites are down

From the killall(1) man page killall sends a signal to all processes running any of the specified commands. If no signal name is specified, SIGTERM is sent. ... -u, --user Kill only ...
  • 115k
8 votes
Accepted

Opening 1 million connections maxes out at 469K

Not necessarily an answer but too big to put in a comment. tcp_mem (since Linux 2.4) This is a vector of 3 integers: [low, pressure, high]. These bounds, measured in units of the system page ...
  • 23.1k
7 votes

What causes SSH error: kex_exchange_identification: Connection closed by remote host?

I've just had this exact issue, and the cause was that I had a port translation happening internally to the load balancer, meaning that my ssh connections were reaching the host on port 80 instead of ...
  • 285
5 votes

"ssh root@server" hangs forever

I had the same issue and used the Linux "timeout" to kill a hanging scp session. timeout -s 9 1h command command_arguments Will send a kill -9 if the command takes over an hour. FYI the ...
  • 172
5 votes

What happens if a machine gets a SYN/ACK packet without sending initial SYN packet?

If a session does not exist for the source/destination pair, the packet will not be accepted by B. In the case of a SYN-ACK packet, B will reply with a RST (reset) packet, telling the server that no ...
5 votes

better alternative for tcp_syncookies in linux

Ubuntu 10.04 has default "sysctl.d/10-network-security.conf" setting below: # Turn on SYN-flood protections. Starting with 2.6.26, there is no loss # of TCP functionality/features under normal ...
  • 2,300
5 votes
Accepted

AWS connect to private subnet instance without going through NAT

if you want to ssh your instance without NAT, it has to be reachable from your network (where your laptop is). thus I see two solutions: set an elastic IP to your instance + internet gateway/route to ...
  • 616
5 votes
Accepted

Running nginx on AWS is sending back 'ERR_CONNECTION_TIMED_OUT' responses

Configure a security group for the instance which allows inbound tcp 8080. Also ensure a local firewall (iptables, ufw, firewalld or similar) on the instance isn't blocking the traffic.
  • 686
4 votes

ssh tunnel refusing connections with "channel 2: open failed"

For me adding leading ":" works so command in your case would look like this: ssh -L :7000:localhost:7000 user@host -N -v
  • 295
4 votes

NIC seems slow, even on 100Mb/s full duplex

As Rex mentioned, the difference there is in bits versus bytes. MB is megabytes, and Mb is megabits. Network speeds are almost always measured in bits. The 10 MB/s performance you're seeing is ...
  • 75
4 votes

better alternative for tcp_syncookies in linux

Apparently, tcp_syncookies introduces more benefits than disadvantages. Instead of the typical speculation on random blogs, perhaps we could consult "the source": With the updates for IPv6 and ...
  • 140
4 votes

Best ways to establish connectivity at each layer of OSI model

Layer 2 requires layer 1 and layer 3 requires layer 2. Everything above that requires a functioning transport layer (3) and therefore tests above that are application specific and will vary between ...
4 votes
Accepted

Best ways to establish connectivity at each layer of OSI model

If you are debugging connectivity(Layer 3) you need ping and traceroute. If you want to check open ports you need tcptraceroute(Layer 4 TCP) or nmap (Layer 4 TCP/UDP), but it's pretty hard to debug ...
  • 1,579
3 votes

ssh tunnel refusing connections with "channel 2: open failed"

I encountered this error when I was forwarding ports with a full domain name instead of localhost: ssh -L 5900:host.name.com:5900 x11vnc The port was being opened only for localhost, so to accept ...
  • 131
3 votes

Able to connect by SSH, but not x2go

Encountered the same problem from Windows could not connect to remote linux client with SSH Key. Even Auto Login with Pageant running from PuTTY directly or running the included X2GO Pageant would ...

Only top scored, non community-wiki answers of a minimum length are eligible