firewall4 icon indicating copy to clipboard operation
firewall4 copied to clipboard

Limit mss fixup to connection start

Open brada4 opened this issue 1 year ago • 3 comments

Use conntrack flow packet counter to limit mss fixup filter to the very start of connection flows where adjustable syn/syn can possibly appear.

Two initial packets +

sysctl net.ipv4.tcp_syn_retries net.ipv4.tcp_synack_retries net.ipv4.tcp_syn_retries = 6 net.ipv4.tcp_synack_retries = 5

Signed-off-by: Andris PE [email protected]

brada4 avatar Sep 10 '24 17:09 brada4

Other heuristics take twice bytecode like !assured/assured & ct tcp, Rises throughput ~10% in default case both unicast and forward.

brada4 avatar Sep 10 '24 18:09 brada4

Any idea when your fw4 improvements will be accepted into a build with the new build 23.05.5 having no firewall updates? They are still all pending incorporation into master by jow.

Thanks Peter

Message ID: @.***>

whiskerp avatar Sep 26 '24 13:09 whiskerp

He comes here twice a year, if he misses few watch shifts ill make a branch and add readme ;-)

brada4 avatar Sep 26 '24 18:09 brada4

Shouldn't the hardcoded 14 value be calculated dynamically if it relates to net.ipv4.tcp_syn_retries and net.ipv4.tcp_synack_retries ?

Also this looks like very specific, hard to maintain low level optimizations - what's the significance of this change? Are there any throughput tests?

jow- avatar Mar 17 '25 15:03 jow-

Will adapt in a week

brada4 avatar Mar 17 '25 16:03 brada4

This is about state of internet. Windows limits all retransmits to 5 to https://support.microsoft.com/en-us/topic/how-to-modify-the-tcp-ip-maximum-retransmission-time-out-7ae0982a-4963-fa7e-ee79-ff6d0da73db8 Thus one obtained from linux covers it. If you achieve more than few retransmits under normal operation, mss size is least of your woes.

brada4 avatar Mar 27 '25 07:03 brada4

This can be done even quicker, no point keeping it another yesr

brada4 avatar May 19 '25 07:05 brada4