Performance Tuning & Kernel Parameters (Sysctl)

Stop letting your web server choke on too many half-open connections

🧩 The Challenge

You’ve got a high-traffic app and suddenly it starts dropping requests like it’s allergic to users, but your CPU is barely breaking a sweat. It turns out the kernel is silently nuking your SYN backlog because it’s not configured to handle spikes in connection attempts.

💡 The Fix

Bumping up the SYN backlog and enabling SYN cookies ensures your server doesn’t fall over when the internet decides to bash your door down all at once. It’s a massive sanity saver for any production box facing the wild.

sysctl -w net.ipv4.tcp_max_syn_backlog=4096
sysctl -w net.ipv4.tcp_syncookies=1
sysctl -p

⚙️ Why It Works

By increasing the backlog, you’re giving the kernel a bigger buffer for those incoming connections that haven’t fully completed the handshake yet. SYN cookies kick in when that buffer gets overwhelmed, effectively filtering out connection attempts that aren’t actually ready to talk.

🚀 Pro-Tip: Don’t just set these on the fly, make sure to add them to /etc/sysctl.conf so you don’t lose the config after a reboot.

Linux Tips & Tricks | © ngelinux.com | 9/20/2026