cat /etc/sysctl.conf
...
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_timestamps = 1
...
k8s集群pod中请求服务端的http接口
tcpdump -i bond0 host 10.1.xxx.xxx and port 80 -nnA -w xxx.pcap
通过抓包发现是服务端没有返回SYN,ACK
tcp_tw_recycle
参数。它用来快速回收TIME_WAIT
连接,不过如果在NAT
环境下会引发问题。
RFC1323中有如下一段描述:
An additional mechanism could be added to the TCP, a per-host cache of the last timestamp received from any connection. This value could then be used in the PAWS mechanism to reject old duplicate segments from earlier incarnations of the connection, if the timestamp clock can be guaranteed to have ticked at least once since the old connection was open. This would require that the TIME-WAIT delay plus the RTT together must be at least one tick of the sender’s timestamp clock. Such an extension is not part of the proposal of this RFC.
tcp_timestamps
和tcp_tw_recycle
,因为tcp_timestamps
缺省就是开启的,所以当tcp_tw_recycle
被开启后,实际上这种行为就被激活了,当客户端或服务端以NAT方式构建的时候就可能出现问题,下面以客户端NAT
为例来说明:NAT
方式联网并与服务端交互时,服务端看到的是同一个IP,也就是说对服务端而言这些客户端实际上等同于一个,可惜由于这些客户端的时间戳可能存在差异,于是乎从服务端的视角看,便可能出现时间戳错乱的现象,进而直接导致时间戳小的数据包被丢弃。如果发生了此类问题,具体的表现通常是是客户端明明发送的SYN,但服务端就是不响应ACK。cat /etc/sysctl.conf
...
net.ipv4.tcp_tw_recycle = 0
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_max_tw_buckets = 262144
...
tcp_tw_recycle
tcp_tw_reuse
(允许将TIME-WAIT
sockets重新用于新的TCP连接)tcp_max_tw_buckets
对应的是系统同时保持的TIME_WAIT
的最大数量,不宜设置过小,超过这个数量将会导致部分连接异常或者新的连接建立失败当有大量的TIME-WAIT
时,不建议开启tcp_tw_recycle
,上面也说到了会在NAT
环境中导致请求失败, 而且在4.12之后的内核已移除tcp_tw_recycle
内核参数。
参考:
如果这篇文章对你有所帮助,可以通过下边的“打赏”功能进行小额的打赏。
本网站部分内容来源于互联网,如有侵犯版权请来信告知,我们将立即处理。