Why Do TCP Backlog Queues Fill Up? Exploring Half‑Open and Full Connections

Author: Bogon Link: https://www.jianshu.com/p/7c9b5f8fef6e

Understanding TCP Half‑Open and Full‑Connection Queues

When a server listens for incoming connections, the kernel maintains two queues: the half‑open (SYN‑received) queue and the full‑connection (established) queue. The half‑open queue stores sockets that have received a SYN but not yet completed the three‑way handshake, while the full‑connection queue holds sockets that have completed the handshake and are ready for the application.

What Happens When the Queues Are Full?

If either queue reaches its configured limit, new connection attempts are dropped. In the half‑open queue, this manifests as SYN‑loss, leading to client retries and increased latency. In the full‑connection queue, accepted connections may be refused, causing errors such as “listen backlog overflow” or “socket creation failed”.

Mitigation Strategies

Administrators can adjust kernel parameters such as net.core.somaxconn, net.ipv4.tcp_max_syn_backlog, and net.ipv4.tcp_synack_retries to enlarge the queues. Additionally, employing SYN cookies, load balancers, or tuning application‑level accept loops can help absorb bursts of traffic and prevent overflow.

Further Reading

https://network.51cto.com/article/687595.html

https://www.cnblogs.com/sidesky/p/6844228.html

https://developer.aliyun.com/article/79972

https://blog.csdn.net/weixin_34256074/article/details/89079053

https://zhuanlan.zhihu.com/p/266540301

https://www.cnblogs.com/xiaolincoding/p/12995358.html

http://veithen.io/2014/01/01/how-tcp-backlog-works-in-linux.html

https://blog.csdn.net/puma_dong/article/details/46669499

https://blog.csdn.net/ptonlix/article/details/76528206

https://www.cnblogs.com/qqmomery/p/6036823.html

https://developer.aliyun.com/article/409634

https://www.cnblogs.com/niejunlei/p/13919726.html