Boost Linux Server Concurrency: Tuning ulimit, TCP, and I/O Settings

iptables related

If not required, disable or uninstall the iptables firewall and prevent the kernel from loading its modules, as they can affect concurrency performance.

Single‑process maximum open files limit

Typical distributions limit a single process to 1024 open files, which is insufficient for high concurrency. Increase this limit as follows: # ulimit -n 65535 If the command fails with "Operation not permitted", adjust the soft and hard limits in /etc/security/limits.conf:

# vim /etc/security/limits.conf
* soft nofile 65535
* hard nofile 65535

Then enable the PAM limits module by adding to /etc/pam.d/login:

# vim /etc/pam.d/login
session required /lib/security/pam_limits.so

Check the system‑wide maximum open files with:

# cat /proc/sys/fs/file-max
32568

To raise the system hard limit, edit /etc/sysctl.conf and set fs.file-max=131072, then apply with sysctl -p. After a reboot, the new limits take effect.

Kernel TCP parameters

When many connections close, they remain in TIME_WAIT, consuming ports. Use the following command to view TCP state counts:

# netstat -n | awk '/^tcp/ {++S[$NF]} END {for(a in S) print a, S[a]}'

If TIME_WAIT counts are high, edit /etc/sysctl.conf and add:

# vim /etc/sysctl.conf
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_fin_timeout = 30

Apply the changes with: # sysctl -p Explanation of the parameters: net.ipv4.tcp_syncookies=1 enables SYN cookies to mitigate SYN‑flood attacks. net.ipv4.tcp_tw_reuse=1 allows reuse of TIME_WAIT sockets for new connections. net.ipv4.tcp_tw_recycle=1 enables fast recycling of TIME_WAIT sockets. net.ipv4.tcp_fin_timeout=30 reduces the FIN‑WAIT timeout.

Additional TCP tuning for very high traffic servers:

net.ipv4.tcp_keepalive_time = 1200
net.ipv4.ip_local_port_range = 1024 65535
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_max_tw_buckets = 5000

Other useful kernel parameters:

net.core.netdev_max_backlog = 32768

net.core.somaxconn = 32768

net.core.wmem_default = 8388608

net.core.rmem_default = 8388608

net.core.rmem_max = 16777216

net.core.wmem_max = 16777216

net.ipv4.tcp_timestamps = 0

net.ipv4.tcp_synack_retries = 2

net.ipv4.tcp_syn_retries = 2

net.ipv4.tcp_tw_reuse = 1

net.ipv4.tcp_wmem = 8192 436600 873200

net.ipv4.tcp_rmem = 32768 436600 873200

net.ipv4.tcp_mem = 94500000 91500000 92700000

net.ipv4.tcp_max_orphans = 3276800

net.ipv4.tcp_fin_timeout = 30

These settings improve server load capacity and provide basic protection against low‑volume DoS, CC, and SYN attacks.

I/O event dispatch mechanism

For high‑concurrency TCP servers, avoid synchronous I/O with a thread per connection. Prefer non‑blocking I/O using select(), poll(), epoll(), or asynchronous I/O (AIO). select() and poll() scale poorly; epoll or modern AIO implementations handle large numbers of connections efficiently.

By applying the above kernel and I/O configurations, a Linux server can significantly increase its ability to handle massive concurrent TCP connections.