The exit relay we (Digitalcourage) run gets this warning a lot, but it started only recently. I guess it is related to the DDoS attacks (syn flood) we get lately.
Debian seems to set /proc/sys/net/ipv4/tcp_max_orphans automatically so that up to a quarter of the installed amount of RAM is used for this. (“Let me remind you again: each orphan eats up to 64K of unswappable memory” – https://serverfault.com/questions/624911/what-does-tcp-too-many-orphaned-soc...)
So 262,144 value in Torservers' config will eat up to 16 GiB. I am not sure if overriding Debian's setting is a good idea. Any advice? Is this warning more than an annoyance?
Cheers, Christian
On Mon, Aug 01, 2016 at 09:12:12PM -0500, Tristan wrote:
My default setting was 2048. I changed it to 200,000 for now. I haven't really played with sysctl at all. The only change I've ever made in there was for swappiness.
On Mon, Aug 1, 2016 at 8:04 PM, Green Dream greendream848@gmail.com wrote:
It's related to /proc/sys/net/ipv4/tcp_max_orphans
"Maximal number of TCP sockets not attached to any user file handle, held by system. If this number is exceeded orphaned connections are reset immediately and warning is printed."
So, I'd start by checking the value of tcp_max_orphans (with "cat /proc/sys/net/ipv4/tcp_max_orphans"). The widely distributed sysctl.conf tweaks for Linux relays suggests a value of 262144. I think the default in many distros may be 4096, perhaps too low for an Exit.
Some references:
https://serverfault.com/questions/624911/what-does-tcp-too-many-orphaned-soc...
https://raw.githubusercontent.com/torservers/server-config-templates/master/...
If you need help making the sysctl tweaks let me know.
tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays