Modify the TCP TIME-WAIT timeout to improve network performance - Alibaba Cloud Linux

By default, the TCP TIME_WAIT state lasts 60 seconds in the Linux kernel. In high-load TCP scenarios, reducing this timeout improves network performance. Alibaba Cloud Linux 2 (kernel version 4.19.43-13.al7 and later) and Alibaba Cloud Linux 3 introduce the net.ipv4.tcp_tw_timeout kernel parameter to configure this value.

Important

Starting from Alibaba Cloud Linux 4, this parameter is deprecated.

Background information

When too many connections accumulate in the TIME_WAIT state, network performance degrades. This typically occurs on servers handling large numbers of short-lived connections. The TCP/IP TIME_WAIT state is a waiting period after an application closes a socket. During this period, the TCP/IP stack keeps the socket open to ensure all data is transferred between the server and client. The default wait is 60 seconds. Alibaba Cloud Linux provides the net.ipv4.tcp_tw_timeout parameter to reduce this timeout in high-concurrency scenarios. The valid range is 1 to 600 seconds.

Usage notes

Reducing the TIME_WAIT timeout below 60 seconds contradicts the TCP/IP "quiet time" concept. This can cause the TCP stack to accept old, delayed packets as new data, or reject valid new packets as duplicates. Adjust this value only under the guidance of a networking expert. For more information, see IETF RFC 793.
Due to differences in kernel versions and parameter configurations, such as tcp_tw_reuse (see System configuration optimization) and tcp_tw_recycle (see Differences between Alibaba Cloud Linux 3 and CentOS 7), the number of TIME_WAIT connections on Alibaba Cloud Linux may be higher than on other Linux distributions such as CentOS 7. This is expected behavior.
Under the default Alibaba Cloud Linux configuration, the number of connections in the TIME_WAIT state stays below 5,000, with negligible impact on network performance.

Configuration methods

The following methods modify net.ipv4.tcp_tw_timeout. Replace [$TIME_VALUE] with the timeout value in seconds.

Important

Modifying this parameter may cause service disruptions. Perform this operation during off-peak hours to minimize business impact.

Use the sysctl command to modify the timeout. This change takes effect immediately but does not persist across reboots.
```
sudo sysctl -w "net.ipv4.tcp_tw_timeout=[$TIME_VALUE]"
```
Write the value directly to /proc/sys/net/ipv4/tcp_tw_timeout. This change takes effect immediately but does not persist across reboots.
```
sudo sh -c "echo [$TIME_VALUE] > /proc/sys/net/ipv4/tcp_tw_timeout"
```
Edit /etc/sysctl.conf to make the change persist across reboots.
1. Open /etc/sysctl.conf in a text editor such as vim.
```
sudo vim /etc/sysctl.conf
```
2. Press i to enter Insert mode, then add or modify the following line at the end of the file.
```
net.ipv4.tcp_tw_timeout = [$TIME_VALUE]
```
3. Press Esc, type :wq, and press Enter to save and exit.
4. Apply the changes without rebooting.
```
sudo sysctl -p
```
5. Verify that the value has been updated.
```
sysctl net.ipv4.tcp_tw_timeout
```

Note

You can run the netstat -ant | grep TIME_WAIT | wc -l command to count the number of connections currently in the TIME_WAIT state.

For servers handling a high volume of short-lived connections — such as Nginx running as a Layer 7 proxy — Alibaba Cloud recommends setting [$TIME_VALUE] to 5 (a 5-second TIME_WAIT timeout).