PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThere is no safe, universal “high-performance” sysctl bundle for Linux web servers. Start with the running distribution and kernel defaults, measure the queue, memory, socket, and file-descriptor bottleneck, change only the parameter group related to that bottleneck, and repeat the same workload to verify the result. Larger backlogs and buffers can prevent drops, but they also consume memory and can conceal an application or proxy problem.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What sysctl tuning can—and cannot—fix
sysctl changes kernel behavior at runtime. They are useful when a measured kernel limit is constraining a correctly configured web server, reverse proxy, or load balancer. They are not a substitute for accepting connections promptly, sizing worker pools, fixing slow upstreams, or choosing an appropriate keep-alive policy.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →A value copied from another host is not a recommendation for yours. The useful setting depends on kernel and distribution defaults, available RAM, CPU count, request concurrency, connection lifetime, network round-trip time, and whether TLS termination or proxying happens on the machine. Treat every change as a hypothesis with a measurable target.
Establish a baseline before changing anything
Record the environment and effective values first. Keep this capture with your change ticket so a rollback can restore the exact previous state.
uname -r
cat /etc/os-release
nproc
free -h
sysctl net.core.somaxconn
net.ipv4.tcp_max_syn_backlog
net.ipv4.tcp_rmem
net.ipv4.tcp_wmem
net.ipv4.tcp_mem
net.ipv4.tcp_max_tw_buckets
net.ipv4.tcp_max_orphans
fs.file-max
sysctl -a > /var/tmp/sysctl-before.txtAlso record the web server and proxy versions, listener addresses and ports, worker and connection limits, service-manager limits, RAM, and the traffic pattern you intend to test. A one-minute burst, a steady keep-alive workload, and many short-lived connections stress different controls.
Capture the metrics that identify pressure
- Requests per second, error rate, and both median and tail latency (for example, the 95th and 99th percentiles).
- Established connections and sockets in
SYN_RECV. - For each listener, the
Recv-QandSend-Qshown byss. - TCP retransmissions, receive or transmit drops, and listen-overflow counters exposed by your monitoring system.
- Socket memory, total host memory, reclaim or swap activity, and pressure-stall information.
- Open file counts for the service process and the effective limit imposed by its service manager.
ss -lntp
ss -s
ss -ant state syn-recv
cat /proc/meminfo
cat /proc/sys/fs/file-nr
systemctl show your-web-service --property=LimitNOFILERed Hat’s troubleshooting procedure compares a listening socket’s queue fields over time. A queue that remains near its limit while clients wait is evidence for backlog pressure; an empty queue means raising a backlog is unlikely to help.
Recommended Free Tools
Understand the two separate backlog limits
“The backlog” is not one kernel setting. A server accepting TCP connections has two relevant queues:
| Parameter | What it limits | Evidence required before raising it |
|---|---|---|
net.core.somaxconn |
The kernel’s cap on the completed-connection listen backlog requested by the application. | The application requests a larger backlog and ss shows the listen Recv-Q repeatedly approaching the Send-Q limit. |
net.ipv4.tcp_max_syn_backlog |
Per-listener storage for unacknowledged SYN requests while the handshake is incomplete. | SYN_RECV rises during legitimate bursts or overload and the SYN queue, rather than workers or upstreams, is dropping connections. |
The application can request a larger completed-connection backlog, but the kernel will cap it at somaxconn. Raising only the application setting therefore cannot exceed the kernel cap. Conversely, raising somaxconn does not enlarge the half-open SYN queue.
How to test listen-queue pressure
- Run
ss -lntpduring the busiest period and note the listener’sRecv-QandSend-Q. - Correlate queue growth with connection failures, tail latency, and accept-loop or worker saturation in the web server logs.
- Check
ss -ant state syn-recvseparately. A full completed queue and a full SYN queue indicate different causes and may require different changes. - Change the smallest relevant value, retest the same traffic, and compare drops and tail latency rather than relying on a higher numeric limit.
The Linux kernel documentation page for kernel 6.7 (2023) lists 4096 as the documented default for net.core.somaxconn. That is a documentation value, not a guarantee for every distribution or running kernel; verify your host before treating it as a baseline.
Set tcp_max_syn_backlog only for measured SYN pressure
net.ipv4.tcp_max_syn_backlog governs unacknowledged SYN requests for each listening socket. Current Linux documentation (6.17, 2026) states that the minimum is 128 on low-memory machines and says to increase the value when a server suffers overload. The same documentation estimates that one SYN_RECV request socket consumes about 304 bytes.
That estimate makes the trade-off clear: a larger queue can absorb a short connection burst, but its memory cost is multiplied by every listener and by the number of pending requests. Do not increase it merely because a benchmark or blog lists a large number. Check whether SYN packets are genuine client traffic, a load-balancer burst, or an attack; filtering or rate limiting may be more appropriate.
When a change is justified, examine somaxconn at the same time. The two queues protect different phases of connection establishment, so changing one while the other remains the bottleneck can leave failure rates unchanged.
Treat TCP buffers as dynamic memory budgets
Linux TCP receive-buffer autotuning can grow an individual socket up to the third value in net.ipv4.tcp_rmem. Send autotuning uses net.ipv4.tcp_wmem. The aggregate net.ipv4.tcp_mem thresholds still constrain total TCP memory, so a generous per-connection maximum can become expensive when thousands of connections are active.
| Setting | Role | How to reason about a change |
|---|---|---|
net.ipv4.tcp_rmem |
Minimum, default, and autotuning maximum receive-buffer sizes. | Consider path RTT, bandwidth, concurrent flows, and observed receive-window growth. A high maximum is useful only if long-distance flows can fill it and memory remains available. |
net.ipv4.tcp_wmem |
Minimum, default, and autotuning maximum send-buffer sizes. | Relate the maximum to sustained outbound throughput and congestion behavior. Large values do not make a slow application produce data faster. |
net.ipv4.tcp_mem |
System-wide TCP memory pressure thresholds. | Keep aggregate limits consistent with RAM and connection concurrency; inspect socket memory and reclaim activity before modifying them. |
For a web server serving short responses over nearby networks, default autotuning may already be sufficient. For high-throughput transfers over high-RTT paths, first measure throughput, retransmissions, window scaling, and route characteristics. Increase one bound at a time and verify that tail latency and host memory pressure do not worsen. Never copy buffer triplets from a larger machine without recalculating the per-connection and aggregate cost.
Do not use TIME_WAIT and orphan limits as folklore performance switches
net.ipv4.tcp_max_tw_buckets
This is a protective ceiling for sockets in TIME_WAIT, not a latency control. Kernel documentation warns against lowering it artificially. A growing TIME_WAIT population usually calls for examining connection reuse, HTTP keep-alive, proxy behavior, client churn, and available memory. Raise the ceiling only when measurements show that the existing ceiling is reached, the workload is legitimate, and the host has enough memory.
net.ipv4.tcp_max_orphans
Orphaned sockets are no longer owned by a user-space file descriptor and consume unswappable kernel memory. A rising orphan count is an overload or connection-lifecycle symptom. Lowering the limit to hide the symptom can cause earlier connection failures. Trace why sockets lose their owner, check worker and proxy shutdown behavior, and correlate orphan growth with memory pressure before changing this value.
The kernel documentation’s warning about a loaded web server is a reminder that orphan retries and memory behavior must be considered together: “If your machine is a loaded WEB server, you should think about lowering this value, such sockets may consume significant resources.” That warning concerns resource protection, not a blanket tuning recipe.
File descriptors require both kernel and service limits
fs.file-max is the kernel-wide ceiling for allocated file handles. It is only one layer. A web worker can still fail with “too many open files” when its per-process limit or service-manager limit is lower.
- Inspect the process limit with
cat /proc/<pid>/limits. - Inspect systemd’s effective setting with
systemctl show your-web-service --property=LimitNOFILE. - For other service managers, check the equivalent
nofileor open-file setting. - Compare current usage with
/proc/sys/fs/file-nrand application connection counts.
Raising fs.file-max alone does not grant a worker more descriptors. Set a coherent kernel ceiling, service limit, worker configuration, and monitoring alert, then verify that the process actually receives the intended limit after restart.
Choose between a default-based and backlog-focused profile
| Decision axis | Conservative default-based profile | Backlog-focused profile |
|---|---|---|
| Use when | Queues are not persistently pressured or the bottleneck is unknown. | Measurements show a listener queue or SYN queue reaching its limit during a known burst. |
| Values | Keep distribution and kernel defaults; tune application workers and keep-alive first. | Raise the matching backlog limit(s) in small steps, while checking the other queue. |
| Expected benefit | Lowest memory and rollback risk; preserves tested defaults. | Fewer queue-related drops and potentially lower connection tail latency during bursts. |
| Costs to watch | Short bursts may overflow a genuinely undersized queue. | More queued requests, SYN sockets, memory use, and delayed failure if workers remain saturated. |
| Validation | Confirm stable queue depth, latency, retransmissions, and memory under representative load. | Require lower drops or tail latency without increased memory pressure, retransmissions, or application errors. |
| Rollback complexity | Minimal; remove an unnecessary override. | Moderate; restore every changed queue value and retest the original failure mode. |
A larger number wins only when it improves the target metric at an acceptable resource cost. If latency remains high while queues are empty, investigate application processing, upstream services, CPU, or storage instead of raising sysctl values.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Persist changes with an explicit rollback
Runtime changes made with sysctl -w disappear at reboot. For a reviewed change, use a uniquely named file under /etc/sysctl.d/; avoid editing a distribution-managed file.
- Save the current values:
sysctl net.core.somaxconn net.ipv4.tcp_max_syn_backlog > /var/tmp/backlog-before.txt. - Create a file such as
/etc/sysctl.d/90-web-server-tuning.confcontaining only the tested parameters and comments explaining the measured bottleneck. - Apply the distribution-approved loader, commonly
sysctl --system, or apply a single file withsysctl -p /etc/sysctl.d/90-web-server-tuning.confwhere supported. - Verify effective values with targeted
sysctlqueries and confirm the service still starts and accepts connections. - Run the same workload and retain before-and-after metrics.
- If memory pressure, latency, drops, retransmissions, or connection failures increase, restore the recorded values, remove or edit the override file, reload sysctl, and repeat the test.
sudo install -m 0644 /dev/null /etc/sysctl.d/90-web-server-tuning.conf
sudoedit /etc/sysctl.d/90-web-server-tuning.conf
sudo sysctl --system
sysctl net.core.somaxconn net.ipv4.tcp_max_syn_backlogKeep one logical change group per file or clearly separated block. That makes it possible to remove a backlog experiment without accidentally reverting unrelated hardening or networking settings.
Validate the result, not just the new value
Repeat the baseline workload for long enough to include ramp-up and peak periods. Compare request rate, 95th/99th-percentile latency, connection failures, listen-queue occupancy, SYN_RECV, retransmissions, drops, socket memory, total memory pressure, and open-file headroom. A successful change reduces the identified symptom without moving the bottleneck into memory, workers, upstream connections, or file descriptors.
Rollback is the correct outcome when a queue becomes less visible but requests take longer, memory reclaim or swap increases, retransmissions rise, or the application reports descriptor or connection errors. Tuning should leave the system easier to explain, not merely able to hold a larger number.
Quick Recap
Common symptoms and the next check
| Symptom | First check | Avoid doing first |
|---|---|---|
Listen Recv-Q repeatedly reaches its limit |
Whether the application requested a larger backlog and whether workers are accepting promptly; then evaluate somaxconn. |
Raising TCP buffers or TIME_WAIT limits. |
Many SYN_RECV sockets during bursts |
tcp_max_syn_backlog, traffic legitimacy, SYN drops, and load-balancer burst behavior. |
Assuming the completed-connection backlog is the same queue. |
| High memory use with many established flows | TCP socket memory, autotuning maxima, connection count, and tcp_mem pressure. |
Copying large tcp_rmem/tcp_wmem values from another host. |
| Large TIME_WAIT population | Keep-alive, connection reuse, proxy and client behavior, and memory pressure. | Lowering tcp_max_tw_buckets as a routine fix. |
| “Too many open files” | Process limits, service-manager LimitNOFILE/nofile, and actual descriptor usage. |
Raising only fs.file-max. |
| Orphaned sockets or unswappable memory growth | Connection shutdown paths, overload, and owner loss. | Using a low tcp_max_orphans value to conceal the cause. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
