linux下系统配置

sysctl settings are defined through files in

/usr/lib/sysctl.d/, /run/sysctl.d/, and /etc/sysctl.d/.

Vendors settings live in /usr/lib/sysctl.d/.

To override a whole file, create a new file with the same in

/etc/sysctl.d/ and put new settings there. To override

only specific settings, add a file with a lexically later

name in /etc/sysctl.d/ and put new settings there.

For more information, see sysctl.conf(5) and sysctl.d(5).

系统最大文件打开数

fs.file-max =10240000

多网卡内部转换

net.ipv4.ip_forward =0
#检测源数据校验，减少ddos攻击
net.ipv4.conf.default.rp_filter=1
#禁用所有IP源路由
net.ipv4.conf.default.accept_source_route = 0

全连接队列长度,默认128

net.core.somaxconn = 3000

网卡数据包队列长度

net.core.netdev_max_backlog = 262144

tcp报文探测时间间隔, 单位s

net.ipv4.tcp_keepalive_intvl = 15

探测次数

net.ipv4.tcp_keepalive_probes = 5
#Useful for debugging multi-threaded applications.
#core文件名中添加pid作为扩展名
kernel.core_uses_pid = 1
#对外连接端口范围
net.ipv4.ip_local_port_range = 1024 65535
#Controls the maximum size of a message, in bytes
kernel.msgmax = 65536
#Controls the default maxmimum size of a mesage queue
kernel.msgmax = 65536
net.ipv4.conf.all.promote_secondaries = 1
net.ipv4.conf.default.promote_secondaries = 1
net.ipv6.neigh.default.gc_thresh3 = 4096
net.ipv4.neigh.default.gc_thresh3 = 4096
net.ipv6.conf.all.disable_ipv6=0
net.ipv6.conf.default.disable_ipv6=0
net.ipv6.conf.lo.disable_ipv6=0
kernel.softlockup_panic = 1
kernel.sysrq = 1
kernel.printk = 5
#关闭tcp_sack，启用有选择的应答（Selective Acknowledgment），
#这可以通过有选择地应答乱序接收到的报文来提高性能（这样可以让发送者只发送丢失的报文段）,
#（对于广域网通信来说）这个选项应该启用，但是这会增加对CPU的占用
net.ipv4.tcp_sack = 1
#设置TCP滑窗
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 16384 4194304
net.core.wmem_default = 8388608
net.core.rmem_default = 8388608
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216

#开启ssr
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
#禁用ping
net.ipv4.icmp_echo_ignore_all = 1
#禁止广播icmp
net.ipv4.icmp_echo_ignore_broadcasts =1
#半连接队列长度，当使用sysncookies无效，默认128
net.ipv4.tcp_max_syn_backlog = 6000
#安全考虑和端口复用
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 5
#syn优化
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 2
#表示操作系统允许保持TIME_WAIT套接字数量的最大值
net.ipv4.tcp_max_tw_buckets = 18000
#开启恶意icmp错误消息保护
net.ipv4.icmp_ignore_bogus_error_responses = 1
#开启恶意icmp错误消息保护
net.ipv4.icmp_echo_ignore_broadcasts = 1
#校验时间戳
net.ipv4.tcp_timestamps=0
net.ipv4.route.flush=1
net.ipv4.tcp_fastopen= 3
#启用转发应答，可以进行有选择应答
net.ipv4.tcp_fack=1
#选项用于设定系统中最多有多少个TCP套接字不被关联到任何一个用户文件句柄上(防止简单的DOSS)
net.ipv4.tcp_max_orphans=262114
#开启数据包的反向地址校验,防止ip欺骗
net.ipv4.conf.all.rp_filter = 1
#table full, dropping packet
net.netfilter.nf_conntrack_max = 655350
net.netfilter.nf_conntrack_tcp_timeout_established = 1200
#生成core文件
kernel.core_pattern = %e.core.%p
配完之后，直接执行sysctl -p