How to Tame Over 100K TCP Connections: Full‑Stack Kernel and Application Tuning

1. Identify connection state and growth

Use ss -s to get aggregate TCP state counts (ESTAB, SYN‑RECV, TIME‑WAIT, CLOSE‑WAIT) and monitor them over time to establish a baseline.

2. Gather kernel and service metrics

Show relevant sysctl values:

sysctl -a | rg '^(fs\.file-max|net\.core\.somaxconn|net\.ipv4\.tcp_.*)'

Obtain the service’s main PID and its file‑descriptor limit:

systemctl show <service> -p MainPID -p LimitNOFILE

Count open file descriptors for the PID:

ls /proc/<PID>/fd | wc -l

3. Inspect listening queues and backlog

Show the receive and send queues for the listening socket:

ss -ltn '( sport = :<port> )'

Recv‑Q

indicates connections waiting for accept(); Send‑Q shows the configured backlog limit. Persistent high values suggest a bottleneck in the accept path, net.core.somaxconn, or the application’s listen backlog.

4. Check system‑wide file‑descriptor and conntrack limits

Current FD usage: cat /proc/sys/fs/file-nr Maximum FD count: sysctl fs.file-max Conntrack usage:

sysctl net.netfilter.nf_conntrack_count net.netfilter.nf_conntrack_max

5. Tune kernel parameters (capacity first)

Create a dedicated sysctl snippet (values must be validated with load testing):

# /etc/sysctl.d/60-tcp-capacity.conf
fs.file-max = 2097152
net.core.somaxconn = 65535
net.ipv4.tcp_max_syn_backlog = 65535
net.core.netdev_max_backlog = 16384
net.ipv4.tcp_syncookies = 1
net.ipv4.ip_local_port_range = 10240 65535

Load the new file:

sysctl -p /etc/sysctl.d/60-tcp-capacity.conf

6. Adjust systemd service limits

Create an override to raise LimitNOFILE for the target service:

# /etc/systemd/system/<service>.service.d/limits.conf
[Service]
LimitNOFILE=262144

Reload systemd and restart the service:

systemctl daemon-reload
systemctl restart <service>

7. Tune Nginx reverse‑proxy settings

Verify compiled modules: nginx -V 2>&1 Export the effective configuration for inspection: nginx -T > /tmp/nginx-effective.conf Set worker connections and enable multi‑accept:

events {
    worker_connections 65535;
    multi_accept on;
}

Configure keep‑alive and timeouts in the http block:

http {
    keepalive_timeout 65s;
    keepalive_requests 1000;
    client_header_timeout 10s;
    client_body_timeout 30s;
    send_timeout 30s;
}

Define upstream connection reuse and failure limits:

upstream app_backend {
    server 10.0.0.1:8080 max_fails=3 fail_timeout=10s;
    server 10.0.0.2:8080 max_fails=3 fail_timeout=10s;
    keepalive 256;
}

8. Verify changes with a minimal acceptance checklist

ss -s
nstat -az TcpExtListenDrops TcpExtListenOverflows TcpRetransSegs
systemctl show <service> -p LimitNOFILE -p MainPID
nginx -t

Compare the metrics before and after the change: listening‑queue overflows should stop growing, retransmissions should drop, FD usage must stay below the limits, and request latency must not degrade.

9. Rollback procedures

Remove the sysctl snippet and reload the default configuration:

rm /etc/sysctl.d/60-tcp-capacity.conf
sysctl -p /etc/sysctl.conf

Delete the systemd override and restart the service:

rm /etc/systemd/system/<service>.service.d/limits.conf
systemctl daemon-reload
systemctl restart <service>

Restore the previous Nginx configuration from backup and reload:

cp <conf>.bak <conf>
nginx -t
systemctl reload nginx

All steps should be performed on a single node in a gray‑scale window, with traffic drained from load balancers, and with full logging of before‑and‑after metrics to guarantee a repeatable remediation process.