AdminSysGNULinux

Outils pour utilisateurs

Outils du site

Piste : • blog
blog

Table des matières

4 billet(s) pour septembre 2026

Notes HTTP Strict Transport Security - HSTS2026/09/18 11:04Jean-Baptiste
Notes GNU Linux GPU carte graphiques2026/09/08 15:49Jean-Baptiste
Notes GNU Linux graphique2026/09/08 15:42Jean-Baptiste
Notes urlencoding - passer des mots de passe en HTTPS2026/09/03 17:58Jean-Baptiste

Reverse SSH tunnel - SSH comme VPN

Voir :

Putty

#ssh -R 3128:192.168.56.1:3128 user@192.168.1.20
 
plink -R 3128:192.168.56.1:3128 -pw P@ssw0rd -batch user@192.168.1.20

FIXME

2025/03/24 15:06
, , ,

Reverse proxy HTTP Headers - Disable compressed response - Nginx

Voir :

Disable the compressed response 

proxy_set_header Accept-Encoding "";

Context: http, server, location

2025/03/24 15:06
, , ,

Réseau Linux tc (Traffic Control)

Introduction to Network Emulation with tc (Traffic Control) The tc command is part of the iproute package

Source : https://bencane.com/simulating-network-latency-for-testing-in-linux-environments-29daad98efcc

tc (Traffic Control) is a powerful Linux command used to control the kernel's network scheduler. It interfaces with a component known as netem (Network Emulator), which provides functionalities for emulating network conditions like latency, packet loss, and more. This tool is crucial for replicating real-world network scenarios, such as a WAN, within a controlled test environment.

Determine Current Latency: Use the ping command to measure the current latency to a remote server. 

ping google.com

Calculate Additional Latency: Subtract the average current latency from your desired latency.

Desired Latency - Current Latency = Additional Latency

Apply the Latency using tc : Use the tc command to add the calculated delay to the network interface. 

tc qdisc add dev eth0 root netem delay 97ms

Verify the Rule : Use the tc -s command to ensure the delay has been correctly added. 

tc -s qdisc

Removing the Latency Rule 

tc qdisc del dev eth0 root netem
2025/03/24 15:06
,

Réseau Linux pile TCP/IP

Voir aussi :

  • MPTCP, SCTP, DCCP

Voir : 

man 7 tcp

Contrack

Voir :

  • /proc/net/nf_conntrack
  • /proc/sys/net/nf_conntrack_max
apt-get install conntrack

Flush 

conntrack -F
/proc/sys/net/ipv4/tcp_syn_retries
$ sysctl net.ipv4.tcp_syn_retries
net.ipv4.tcp_syn_retries = 6

Effectively, this takes 1+2+4+8+16+32+64=127s before the connection finally aborts.

/proc/sys/net/ipv4/tcp_synack_retries
/proc/sys/net/ipv4/tcp_retries2

Voir :

Voir aussi :

  • /proc/sys/net/ipv4/tcp_retries
  • /proc/sys/net/ipv4/tcp_syn_retries
  • /proc/sys/net/ipv4/tcp_synack_retries
Cluster

In a High Availability (HA) situation consider decreasing the setting to 3.

RFC 1122 recommends at least 100 seconds for the timeout, which corresponds to a value of at least 8. Oracle suggest a value of 3 for a RAC configuration.

Source : https://access.redhat.com/solutions/726753

Nb de retransmissions vs temps

An experiment confirms that (on a recent Linux at least) the timeout is more like 13s with the suggested net.ipv4.tcp_retries2=5

“Windows defaults to just 5 retransmissions which corresponds with a timeout of around 6 seconds.” “Five retransmissions corresponds with a timeout of around six seconds.” tcp_retries2=5 means timeout with first transmission plus 5 retransmissions: 12.6 seconds=(2^6 - 1) * 0.2. tcp_retries2=15: 924.6 seconds=(2^10 - 1) * 0.2 + (16 - 10) * 120.

Source : https://github.com/elastic/elasticsearch/issues/102788

Voir aussi : https://www.elastic.co/guide/en/elasticsearch/reference/current/system-config-tcpretries.html#_related_configuration

F_RTO

https://access.redhat.com/solutions/4978771

TCP keepalive

Voir :

tcp_keepalive_time https://www.veritas.com/support/en_US/article.100028680

Configuring TCP/IP keepalive parameters for high availability clients (JDBC)

tcp_keepalive_probes - the number of probes that are sent and unacknowledged before the client considers the connection broken and notifies the application layer

tcp_keepalive_time - the interval between the last data packet sent and the first keepalive probe

tcp_keepalive_intvl - the interval between subsequent keepalive probes

tcp_retries2 - the maximum number of times a packet is retransmitted before giving up 

echo "6" > /proc/sys/net/ipv4/tcp_keepalive_time
echo "1" > /proc/sys/net/ipv4/tcp_keepalive_intvl
echo "10" > /proc/sys/net/ipv4/tcp_keepalive_probes
echo "3" > /proc/sys/net/ipv4/tcp_retries2

Source : https://www.ibm.com/docs/en/db2/9.7?topic=ctkp-configuring-operating-system-tcpip-keepalive-parameters-high-availability-clients 

ss -o

Process / diag tools

Voir :

Outils

TCP retransmissions

Voir :

Outils :

Connaitre le rto_min et le rto_max 

# grep ^Tcp /proc/net/snmp | column -t | cut -c1-99
Tcp:  RtoAlgorithm  RtoMin  RtoMax  MaxConn  ActiveOpens  PassiveOpens  AttemptFails  EstabResets
Tcp:  1             200     120000  -1       6834         964           161           4614
yum install bpftrace
/usr/share/bcc/tools/tcpretrans
timeout 60 ./tcpretrans | nl
sar -n ETCP
sar -n TCP
# netstat -s | egrep 'segments retransmited | segments send out'
    107428604792 segments send out
    47511527 segments retransmited

# echo "$(( 47511527 * 10000 / 107428604792 ))"
4

https://www.ibm.com/support/pages/tracking-tcp-retransmissions-linux

tcpretransmits.sh 

#! /usr/bin/bash
 
test -x /usr/sbin/tcpretrans.bt && TCPRETRANS=/usr/sbin/tcpretrans.bt
test -x /usr/share/bpftrace/tools/tcpretrans.bt && TCPRETRANS=/usr/share/bpftrace/tools/tcpretrans.bt
# https://github.com/brendangregg/perf-tools/blob/master/net/tcpretrans
test -x ./tcpretrans.pl && TCPRETRANS=./tcpretrans.pl
 
OUT=/tmp/tcpretransmits.log
 
if [ -z "$TCPRETRANS" ]; then
  echo "It looks like 'bpftrace' is not installed"
else
  date > $OUT
  netstat -s | awk '/segments sen. out$/ { R=$1; } /segments retransmit+ed$/ { printf("%.4f\n", ($1/R)*100); }' >> $OUT
  $TCPRETRANS | tee -a $OUT
  netstat -s | awk '/segments sen. out$/ { R=$1; } /segments retransmit+ed$/ { printf("%.4f\n", ($1/R)*100); }' >> $OUT
fi

Resolving The Problem
TCP retransmissions are almost exclusively caused by failing network hardware, not applications or middleware. Report the failing IP pairs to a network administrator.

Autres

horodatages TCP https://access.redhat.com/documentation/fr-fr/red_hat_enterprise_linux/9/html/monitoring_and_managing_system_status_and_performance/benefits-of-tcp-timestamps_tuning-the-network-performance

tcp_low_latency (Boolean; default: disabled; since Linux 2.4.21/2.6; obsolete since Linux 4.14) 

net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_sack = 1
net.ipv4.tcp_moderate_rcvbuf = 1
# ip route get 192.168.100.11
192.168.100.11 dev virbr1 src 192.168.100.1 uid 1000 
    cache 
    
# ip route show dev virbr1
192.168.100.0/24 proto kernel scope link src 192.168.100.1


# ip route change dev virbr1 192.168.100.0/24 proto kernel scope link src 192.168.100.1 rto_min 8ms
2025/03/24 15:06
, , , , ,

Réseau Linux pile TCP/IP rto_min scripts

Voir :

Le hack ci-dessous ne semble plus utile pour RedHat 9.

“NetworkManager now supports advmss, rto_min, and quickack route attributes” https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html-single/9.1_release_notes/index

network_tcp_tune_change_mto_min.sh 

#! /bin/bash
 
set -euo pipefail
 
declare -i ALREADY_SET
 
# check if file exist
file_exist() {
	[ -e "$1" ]
}
 
LINE="$(ip route show default | grep ^default)"
 
if echo "$LINE" | grep -q -e rto_min; then
	ALREADY_SET=1
else
	ALREADY_SET=0
fi
 
usage() {
	cat <<EOF
SysV init script.
Args are : status, stop, start, restart
 
EOF
}
 
status() {
	if [ $ALREADY_SET -eq 1 ]; then
		echo Started
	else
		echo Stopped
	fi
	ip route show default | grep -e '^default'
	echo
	echo "/proc/sys/net/ipv4/tcp_thin_dupack"
	file_exist /proc/sys/net/ipv4/tcp_thin_dupack && cat /proc/sys/net/ipv4/tcp_thin_dupack
	echo
	echo "/proc/sys/net/ipv4/tcp_thin_linear_timeouts"
	cat /proc/sys/net/ipv4/tcp_thin_linear_timeouts
}
 
start() {
	echo "Starting..."
	file_exist /proc/sys/net/ipv4/tcp_thin_dupack && echo 1 > /proc/sys/net/ipv4/tcp_thin_dupack
	echo 1 > /proc/sys/net/ipv4/tcp_thin_linear_timeouts
	if [ $ALREADY_SET -eq 0 ]; then
		NEW_LINE="$LINE rto_min 8ms"
		echo "ip route change $NEW_LINE"
		echo "$NEW_LINE" | xargs ip route change 
	else
		echo "Already started"
	fi
}
 
stop() {
	echo "Stopping..."
	if [ $ALREADY_SET -eq 1 ]; then
		NEW_LINE="$(echo "$LINE" | sed -e 's/ lock / /g' -e 's/rto_min [[:alnum:]]\+//')"
		echo "ip route change $NEW_LINE"
		echo "$NEW_LINE" | xargs ip route change 
	else
		echo "Already stopped"
	fi
}
 
case "${1:-}" in
start)
	start
	;;
restart)
	start
	;;
stop)
	stop
	;;
status)
	status
	;;
-h | --help)
	usage
	;;
*)
	usage
	exit 1
	;;
esac
 
echo .

network_tcp_tune_change_mto_min.service 

[Unit]
Description=Network setting on default gateway. Change rto_min to 8ms. Don not alwaays wait 200ms to resend packet
Wants=network.target network-online.target
After=network.target network-online.target
 
[Service]
Type=oneshot
# ExecStartPre=/usr/bin/sleep 5
ExecStart=/bin/bash /root/scripts/network_tcp_tune_change_mto_min.sh start
ExecStop=/bin/bash /root/scripts/network_tcp_tune_change_mto_min.sh stop
RemainAfterExit=yes
 
[Install]
WantedBy=multi-user.target

Mesures

rsync
truncate -s 1G big_file.img
Avant
$ rsync --compress-level=0 --progress --human-readable -v --log-file=rsync.log big_file.img target:big_file.img | grep MB
          1.07G 100%   76.63MB/s    0:00:13 (xfr#1, to-chk=0/1)
          1.07G 100%   64.51MB/s    0:00:15 (xfr#1, to-chk=0/1)
          1.07G 100%   69.04MB/s    0:00:14 (xfr#1, to-chk=0/1)
          1.07G 100%   45.00MB/s    0:00:22 (xfr#1, to-chk=0/1)
          1.07G 100%   44.32MB/s    0:00:23 (xfr#1, to-chk=0/1)
          1.07G 100%  129.67MB/s    0:00:07 (xfr#1, to-chk=0/1)
          1.07G 100%   44.98MB/s    0:00:22 (xfr#1, to-chk=0/1)
Après
$ rsync --compress-level=0 --progress --human-readable -v --log-file=rsync.log big_file.img target:big_file.img | grep MB
          1.07G 100%  110.12MB/s    0:00:09 (xfr#1, to-chk=0/1)
          1.07G 100%  137.35MB/s    0:00:07 (xfr#1, to-chk=0/1)
          1.07G 100%   98.45MB/s    0:00:10 (xfr#1, to-chk=0/1)
          1.07G 100%  129.62MB/s    0:00:07 (xfr#1, to-chk=0/1)
          1.07G 100%  110.69MB/s    0:00:09 (xfr#1, to-chk=0/1)
          1.07G 100%  152.42MB/s    0:00:06 (xfr#1, to-chk=0/1)
          1.07G 100%  110.20MB/s    0:00:09 (xfr#1, to-chk=0/1)
          1.07G 100%  135.79MB/s    0:00:07 (xfr#1, to-chk=0/1)
Iperf

Serveur 

iperf3 -s -p 8080
Avant
$ iperf3 -i 1 -P 1 -t 600 -p 8080 -c 192.168.10.10
Connecting to host 192.168.10.10, port 8080
[  4] local 192.168.10.11 port 43100 connected to 192.168.10.10 port 8080
[ ID] Interval           Transfer     Bandwidth       Retr  Cwnd
[  4]   0.00-1.00   sec  69.0 MBytes   579 Mbits/sec   19    836 KBytes
[  4]   1.00-2.00   sec  23.8 MBytes   199 Mbits/sec  633    652 KBytes
[  4]   2.00-3.00   sec  68.8 MBytes   577 Mbits/sec  894    724 KBytes
[  4]   3.00-4.00   sec  53.8 MBytes   451 Mbits/sec  1251    731 KBytes
[  4]   4.00-5.00   sec  72.5 MBytes   608 Mbits/sec  455    680 KBytes
[  4]   5.00-6.00   sec   158 MBytes  1.32 Gbits/sec   95    921 KBytes
[  4]   6.00-7.00   sec   124 MBytes  1.04 Gbits/sec   25   1.07 MBytes
[  4]   7.00-8.00   sec  57.5 MBytes   483 Mbits/sec  1063   1.27 MBytes
[  4]   8.00-9.00   sec  60.0 MBytes   503 Mbits/sec  761   1.24 MBytes
[  4]   9.00-10.00  sec  63.8 MBytes   535 Mbits/sec  2013   1.18 MBytes
[  4]  10.00-11.00  sec   124 MBytes  1.04 Gbits/sec   33   2.02 MBytes
Après
$ iperf3 -i 1 -P 1 -t 600 -p 8080 -c 192.168.10.10
Connecting to host 192.168.10.10, port 8080
[  4] local 192.168.10.11 port 43348 connected to 192.168.10.10 port 8080
[ ID] Interval           Transfer     Bandwidth       Retr  Cwnd
[  4]   0.00-1.00   sec   142 MBytes  1.19 Gbits/sec  612   1.11 MBytes
[  4]   1.00-2.00   sec   232 MBytes  1.95 Gbits/sec   26   1.51 MBytes
[  4]   2.00-3.00   sec   220 MBytes  1.85 Gbits/sec  2551   1.29 MBytes
[  4]   3.00-4.00   sec   139 MBytes  1.16 Gbits/sec  1769    459 KBytes
[  4]   4.00-5.00   sec   130 MBytes  1.09 Gbits/sec  1301    451 KBytes
[  4]   5.00-6.00   sec   125 MBytes  1.05 Gbits/sec  1541    396 KBytes
[  4]   6.00-7.00   sec   126 MBytes  1.06 Gbits/sec  751    448 KBytes
[  4]   7.00-8.00   sec   118 MBytes   986 Mbits/sec  1071    535 KBytes
[  4]   8.00-9.00   sec   124 MBytes  1.04 Gbits/sec  1162    518 KBytes
Netcat

Serveur 

nc -p 8080 -lk > /dev/null
Avant
$ while sleep 0.2 ; do echo -n -e "$(date --rfc-3339=seconds)\t" ; (dd if=/dev/zero bs=100000k count=1 | nc 192.168.10.10 8080) 2>&1 | awk '/copied/ { print $8 }' ; done
2024-01-27 11:10:31+01:00       149
2024-01-27 11:10:32+01:00       57.1
2024-01-27 11:10:34+01:00       25.6
2024-01-27 11:10:38+01:00       64.5
2024-01-27 11:10:40+01:00       62.8
2024-01-27 11:10:42+01:00       115
2024-01-27 11:10:43+01:00       215
2024-01-27 11:10:44+01:00       134
2024-01-27 11:10:45+01:00       89.8
2024-01-27 11:10:46+01:00       30.8
2024-01-27 11:10:50+01:00       58.7
Après
$ while sleep 0.2 ; do echo -n -e "$(date --rfc-3339=seconds)\t" ; (dd if=/dev/zero bs=100000k count=1 | nc 192.168.10.10 8080) 2>&1 | awk '/copied/ { print $8 }' ; done
2024-01-27 11:11:21+01:00       164
2024-01-27 11:11:21+01:00       164
2024-01-27 11:11:22+01:00       165
2024-01-27 11:11:23+01:00       217
2024-01-27 11:11:24+01:00       229
2024-01-27 11:11:24+01:00       151
2024-01-27 11:11:25+01:00       121
2024-01-27 11:11:26+01:00       141
2024-01-27 11:11:27+01:00       118
2024-01-27 11:11:28+01:00       123

Autres

quickack
ip route change default via 10.0.0.1 quickack 1
2025/03/24 15:06
, , , , , , , , , ,

<< Billets récents | Anciens billets >>

blog.txt · Dernière modification : de 127.0.0.1
Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki