The exit relay we (Digitalcourage) run gets this warning a lot, but it started only recently. I guess it is related to the DDoS attacks (syn flood) we get lately. Debian seems to set /proc/sys/net/ipv4/tcp_max_orphans automatically so that up to a quarter of the installed amount of RAM is used for this. (“Let me remind you again: each orphan eats up to 64K of unswappable memory” – https://serverfault.com/questions/624911/what-does-tcp-too-many-orphaned-sockets-mean) So 262,144 value in Torservers' config will eat up to 16 GiB. I am not sure if overriding Debian's setting is a good idea. Any advice? Is this warning more than an annoyance? Cheers, Christian On Mon, Aug 01, 2016 at 09:12:12PM -0500, Tristan wrote: > My default setting was 2048. I changed it to 200,000 for now. I haven't > really played with sysctl at all. The only change I've ever made in there > was for swappiness. > > On Mon, Aug 1, 2016 at 8:04 PM, Green Dream <greendream848@xxxxxxxxx> wrote: > > > It's related to /proc/sys/net/ipv4/tcp_max_orphans > > > > "Maximal number of TCP sockets not attached to any user file handle, held > > by system. If this number is exceeded orphaned connections are reset > > immediately and warning is printed." > > > > So, I'd start by checking the value of tcp_max_orphans (with "cat > > /proc/sys/net/ipv4/tcp_max_orphans"). The widely distributed sysctl.conf > > tweaks for Linux relays suggests a value of 262144. I think the default in > > many distros may be 4096, perhaps too low for an Exit. > > > > Some references: > > > > > > https://serverfault.com/questions/624911/what-does-tcp-too-many-orphaned-sockets-mean > > > > https://raw.githubusercontent.com/torservers/server-config-templates/master/sysctl.conf > > > > If you need help making the sysctl tweaks let me know. > > > > > > _______________________________________________ > > tor-relays mailing list > > tor-relays@xxxxxxxxxxxxxxxxxxxx > > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > > > > -- Digitalcourage e.V., Marktstr. 18, D-33602 Bielefeld, Germany Tel: +49-521-1639 1639 | Fax: +49-521-61172 | mail@xxxxxxxxxxxxxxxxx https://digitalcourage.de | https://bigbrotherawards.de Vorratsdatenspeicherung? Nicht schon wieder! Unterstützen Sie unsere Verfassungsbeschwerde: https://digitalcourage.de/weg-mit-vds
Attachment:
signature.asc
Description: PGP signature
_______________________________________________ tor-relays mailing list tor-relays@xxxxxxxxxxxxxxxxxxxx https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays