Limiting total number of incoming connections for a port with iptables for high loading server
Regex version of strip() - Ch. 7 Automate the Boring Stuff
What is this airplane that sits in front of Barringer High School in Newark, NJ?
I wish, I yearn, for an answer to this riddle
Bash function: Execute $@ command with each argument in sequence executed separately
Does knowing the surface area of all faces uniquely determine a tetrahedron?
What does "vrit' mean with reference to documentaries?
Scaling an object to change its key
How do I become a better writer when I hate reading?
Why do you need to heat the pan before heating the olive oil?
Why swap space doesn't get filesystem check at boot time?
What is the context for Napoleon's quote "[the Austrians] did not know the value of five minutes"?
Is there a polite way to ask about one's ethnicity?
Is using Legacy mode is a bad thing to do?
Is it a bad idea to have a pen name with only an initial for a surname?
Got a new frameset, don't know why I need this split ring collar?
Having some issue with notation in a Hilbert space
Counterfeit check
Why was New Asgard established at this place?
First occurrence in the Sixers sequence
Automatically open a terminal window and run a command, robustly
What is the precise meaning of "подсел на мак"?
How could I create a situation in which a PC has to make a saving throw or be forced to pet a dog?
How to sort human readable size
How "fast" do astronomical events occur?
Limiting total number of incoming connections for a port with iptables for high loading server
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I have a server program listening on a port, and I want to limit the total number of incoming TCP connections for the port.
I tried the following rule:
-A INPUT -p tcp --syn --match multiport --dports 443,4443 -m connlimit --connlimit-above 15000 --connlimit-saddr --connlimit-mask 0 -j DROP
But it will introduce high CPU usage of "ksoftirqd", and high packet response latency.
The normal traffic of the server is to have about totally 14000 ~ 15000 connections coming from 9000 ~ 11000 different source IPs.
Is there any other solution?
OS: Red Hat Enterprise Linux Server release 7.5.
iptables: v1.4.21
linux iptables redhat
asked May 31 at 23:53
someonesomeone
31
add a comment |
I have a server program listening on a port, and I want to limit the total number of incoming TCP connections for the port.
I tried the following rule:
-A INPUT -p tcp --syn --match multiport --dports 443,4443 -m connlimit --connlimit-above 15000 --connlimit-saddr --connlimit-mask 0 -j DROP
But it will introduce high CPU usage of "ksoftirqd", and high packet response latency.
The normal traffic of the server is to have about totally 14000 ~ 15000 connections coming from 9000 ~ 11000 different source IPs.
Is there any other solution?
OS: Red Hat Enterprise Linux Server release 7.5.
iptables: v1.4.21
linux iptables redhat
asked May 31 at 23:53
someonesomeone
31
add a comment |
I have a server program listening on a port, and I want to limit the total number of incoming TCP connections for the port.
I tried the following rule:
-A INPUT -p tcp --syn --match multiport --dports 443,4443 -m connlimit --connlimit-above 15000 --connlimit-saddr --connlimit-mask 0 -j DROP
But it will introduce high CPU usage of "ksoftirqd", and high packet response latency.
The normal traffic of the server is to have about totally 14000 ~ 15000 connections coming from 9000 ~ 11000 different source IPs.
Is there any other solution?
OS: Red Hat Enterprise Linux Server release 7.5.
iptables: v1.4.21
linux iptables redhat
asked May 31 at 23:53
someonesomeone
31
I have a server program listening on a port, and I want to limit the total number of incoming TCP connections for the port.
I tried the following rule:
-A INPUT -p tcp --syn --match multiport --dports 443,4443 -m connlimit --connlimit-above 15000 --connlimit-saddr --connlimit-mask 0 -j DROP
But it will introduce high CPU usage of "ksoftirqd", and high packet response latency.
The normal traffic of the server is to have about totally 14000 ~ 15000 connections coming from 9000 ~ 11000 different source IPs.
Is there any other solution?
OS: Red Hat Enterprise Linux Server release 7.5.
iptables: v1.4.21
linux iptables redhat
linux iptables redhat
asked May 31 at 23:53
someonesomeone
31
asked May 31 at 23:53
someonesomeone
31
asked May 31 at 23:53
someonesomeone
31
asked May 31 at 23:53
someonesomeone
31
asked May 31 at 23:53
someonesomeone
31
31
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
It's not surprising you are having a performance issue, since you're now asking the system to spend a lot of time counting connections to determine if there are more than an arbitrary number of them, and it has to do this on every new request. (And for some reason it seems you are making lots of short-lived connections. Try to avoid that if you can.)
Ultimately if you want to keep this level of performance, you should put a separate firewall in front of the server, which can do all the necessary connection tracking and allow your server to focus on serving its application. This will introduce a slight bit of latency, though, so if your application is very latency-sensitive then you might not have any good solution at all. (Except for making the short-lived connections longer-lived.)
answered Jun 1 at 0:34
Michael Hampton♦Michael Hampton
180k28331664
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f969727%2flimiting-total-number-of-incoming-connections-for-a-port-with-iptables-for-high%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
It's not surprising you are having a performance issue, since you're now asking the system to spend a lot of time counting connections to determine if there are more than an arbitrary number of them, and it has to do this on every new request. (And for some reason it seems you are making lots of short-lived connections. Try to avoid that if you can.)
Ultimately if you want to keep this level of performance, you should put a separate firewall in front of the server, which can do all the necessary connection tracking and allow your server to focus on serving its application. This will introduce a slight bit of latency, though, so if your application is very latency-sensitive then you might not have any good solution at all. (Except for making the short-lived connections longer-lived.)
answered Jun 1 at 0:34
Michael Hampton♦Michael Hampton
180k28331664
add a comment |
It's not surprising you are having a performance issue, since you're now asking the system to spend a lot of time counting connections to determine if there are more than an arbitrary number of them, and it has to do this on every new request. (And for some reason it seems you are making lots of short-lived connections. Try to avoid that if you can.)
Ultimately if you want to keep this level of performance, you should put a separate firewall in front of the server, which can do all the necessary connection tracking and allow your server to focus on serving its application. This will introduce a slight bit of latency, though, so if your application is very latency-sensitive then you might not have any good solution at all. (Except for making the short-lived connections longer-lived.)
answered Jun 1 at 0:34
Michael Hampton♦Michael Hampton
180k28331664
add a comment |
It's not surprising you are having a performance issue, since you're now asking the system to spend a lot of time counting connections to determine if there are more than an arbitrary number of them, and it has to do this on every new request. (And for some reason it seems you are making lots of short-lived connections. Try to avoid that if you can.)
Ultimately if you want to keep this level of performance, you should put a separate firewall in front of the server, which can do all the necessary connection tracking and allow your server to focus on serving its application. This will introduce a slight bit of latency, though, so if your application is very latency-sensitive then you might not have any good solution at all. (Except for making the short-lived connections longer-lived.)
answered Jun 1 at 0:34
Michael Hampton♦Michael Hampton
180k28331664
It's not surprising you are having a performance issue, since you're now asking the system to spend a lot of time counting connections to determine if there are more than an arbitrary number of them, and it has to do this on every new request. (And for some reason it seems you are making lots of short-lived connections. Try to avoid that if you can.)
Ultimately if you want to keep this level of performance, you should put a separate firewall in front of the server, which can do all the necessary connection tracking and allow your server to focus on serving its application. This will introduce a slight bit of latency, though, so if your application is very latency-sensitive then you might not have any good solution at all. (Except for making the short-lived connections longer-lived.)
answered Jun 1 at 0:34
Michael Hampton♦Michael Hampton
180k28331664
answered Jun 1 at 0:34
Michael Hampton♦Michael Hampton
180k28331664
answered Jun 1 at 0:34
Michael Hampton♦Michael Hampton
180k28331664
answered Jun 1 at 0:34
Michael Hampton♦Michael Hampton
180k28331664
180k28331664
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f969727%2flimiting-total-number-of-incoming-connections-for-a-port-with-iptables-for-high%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
