Performance Tuning & Kernel Parameters (Sysctl)

Stop your high-concurrency apps from hitting the ephemeral port ceiling

🧩 The Challenge

You’ve probably seen your application randomly start throwing “connection refused” errors even when the server load looks perfectly fine. Turns out, your web server is running out of available ephemeral ports to open new connections because it’s churning through them faster than the kernel can recycle them.

💡 The Fix

You need to expand the port range the kernel allows for outgoing connections and shrink the timeout for those ports sitting in TIME_WAIT. This keeps your socket backlog clean and stops the connection errors dead in their tracks.

sysctl -w net.ipv4.ip_local_port_range="1024 65535"
sysctl -w net.ipv4.tcp_fin_timeout=15

⚙️ Why It Works

Expanding the port range gives you a much larger pool to draw from, while shortening the FIN timeout forces the kernel to reclaim stalled connections before they clog up the system. It’s a simple change that keeps your high-traffic proxies from choking on their own backlog.

🚀 Pro-Tip: Run sysctl -p to make these stick after a reboot or they’ll vanish the next time you bounce the box.

Linux Tips & Tricks | © ngelinux.com | 8/17/2026