• Linux 内核文档：IP sysctl: https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt
• Linux 内核文档：sysctl: https://www.kernel.org/doc/Documentation/sysctl/

/proc/sys/net/ipv4/* Variables:

ip_forward - BOOLEAN
0 - disabled (default)
not 0 - enabled

Forward Packets between interfaces.

这个变量比较特殊,改变它会重置所有配置参数为默认状态(对主机为RFC1122,对路由器为RFC1812)

ip_forward - 布尔值
0 - 禁用 (默认)
非 0 - 启用

在接口间转发数据包。

这个变量比较特殊,改变它会重置所有配置参数为默认状态(对主机为RFC1122,对路由器为RFC1812)

ip_default_ttl - INTEGER
Default value of TTL field (Time To Live) for outgoing (but not forwarded) IP packets. Should be between 1 and 255 inclusive.
Default: 64 (as recommended by RFC1700)

ip_default_ttl - 整数值
发出的 (但不是转发的) IP 数据包 TTL 字段 (生存时间) 的默认值。应该在 1 到 255 之间 (包含 1 和 255)。
默认值：64 (RFC1700 推荐的值)

ip_no_pmtu_disc - INTEGER
Disable Path MTU Discovery. If enabled in mode 1 and a fragmentation-required ICMP is received, the PMTU to this destination will be set to min_pmtu (see below). You will need to raise min_pmtu to the smallest interface MTU on your system manually if you want to avoid locally generated fragments.

在模式2中,传入的路径MTU发现消息将被丢弃。传出的帧的处理方式与模式1相同,隐式地为每个创建的套接字设置IP_PMTUDISC_DONT。

ip_no_pmtu_disc - 整数
禁用路径 MTU 发现。如果在模式 1 下启用，并收到需要分片的 ICMP, 则此目的地的 PMTU 将设置为 min_pmtu (参见下文)。如果要避免本地生成的碎片，您需要手动将 min_pmtu 提高到系统上最小的接口 MTU。

在模式2中,传入的路径MTU发现消息将被丢弃。传出的帧的处理方式与模式1相同,隐式地为每个创建的套接字设置IP_PMTUDISC_DONT。

min_pmtu - INTEGER
default 552 - minimum discovered Path MTU

min_pmtu - 整数
默认 552 - 发现的最小路径 MTU

ipfrag_high_thresh - LONG INTEGER
Maximum memory used to reassemble IP fragments. When ipfrag_high_thresh bytes of memory is allocated for this purpose, the fragment handler will toss packets until ipfrag_low_thresh is reached.

ipfrag_high_thresh - 长整数
用于重新组装 IP 分片的最大内存。当为此目的分配 ipfrag_high_thresh 字节的内存时，分片处理程序将丢弃数据包，直到达到 ipfrag_low_thresh。

ipfrag_low_thresh - LONG INTEGER
(Obsolete since linux-4.17) Maximum memory used to reassemble IP fragments before the kernel begins to remove incomplete fragment queues to free up resources. The kernel still accepts new fragments for defragmentation.

ipfrag_low_thresh - 长整数
(自 linux-4.17 弃用) 在内核开始删除不完整的分片队列以释放资源之前，用于重新组装 IP 分片的最大内存。内核仍将接受新分片进行碎片重组。

ipfrag_time - INTEGER
Time in seconds to keep an IP fragment in memory.

ipfrag_time - 整数
在内存中保留 IP 分片的时间 (以秒为单位)。

inet peer storage:

inet 对等体存储:

inet_peer_threshold - INTEGER
The approximate size of the storage. Starting from this threshold
entries will be thrown aggressively. This threshold also determines
entries' time-to-live and time intervals between garbage collection
passes. More entries, less time-to-live, less GC interval.

inet_peer_threshold - 整数
存储的近似大小。从这个阈值开始，条目将被积极抛弃。
此阈值还确定条目的生存时间和垃圾收集遍历之间的时间间隔。
更多条目，生存时间更短，GC 间隔更短。

inet_peer_minttl - INTEGER
Minimum time-to-live of entries. Should be enough to cover fragment
time-to-live on the reassembling side. This minimum time-to-live
is guaranteed if the pool size is less than inet_peer_threshold.
Measured in seconds.

inet_peer_minttl - 整数
条目的最小生存时间。应该足以覆盖重组端的分片生存时间。
如果池大小小于 inet_peer_threshold, 则保证此最短生存时间。
以秒为单位测量。

inet_peer_maxttl - INTEGER
Maximum time-to-live of entries. Unused entries will expire after
this period of time if there is no memory pressure on the pool (i.e.
when the number of entries in the pool is very small).
Measured in seconds.

inet_peer_maxttl - 整数
条目的最大生存时间。如果池上没有内存压力 (即池中的条目数很少), 未使用的条目将在此时间段后过期。
以秒为单位测量。

TCP variables:

TCP 变量:

somaxconn - INTEGER
Limit of socket listen() backlog, known in userspace as SOMAXCONN.
Defaults to 4096. (Was 128 before linux-5.4)
See also tcp_max_syn_backlog for additional tuning for TCP sockets.

somaxconn - 整数
listen () 背压日志的限制，在用户空间中称为 SOMAXCONN。
默认值为 4096。(linux-5.4 之前为 128)
另请参阅 tcp_max_syn_backlog 以获取 TCP 套接字的其他调优。

tcp_abort_on_overflow - BOOLEAN
If listening service is too slow to accept new connections,
reset them. Default state is FALSE. It means that if overflow
occurred due to a burst, connection will recover. Enable this
option only if you are really sure that listening daemon
cannot be tuned to accept connections faster. Enabling this
option can harm clients of your server.

tcp_abort_on_overflow - 布尔值
如果侦听服务太慢，无法接受新连接，请重置它们。默认状态为 FALSE。这意味着如果由于突发而导致溢出，连接将恢复。仅在确定侦听守护程序无法调整为更快地接受连接时，才启用此选项。启用此选项可能会损害您服务器的客户端。

tcp_adv_win_scale - INTEGER
Count buffering overhead as bytes/2^tcp_adv_win_scale
(if tcp_adv_win_scale > 0) or bytes-bytes/2^(-tcp_adv_win_scale),
if it is <= 0.
Possible values are [-31, 31], inclusive.
Default: 1

tcp_adv_win_scale - 整数
将缓冲开销计为 bytes/2^tcp_adv_win_scale (如果 tcp_adv_win_scale> 0) 或 bytes-bytes/2^(-tcp_adv_win_scale), 如果 <= 0。
可能的值范围为 [-31, 31]。
默认值：1

tcp_allowed_congestion_control - STRING
Show/set the congestion control choices available to non-privileged
processes. The list is a subset of those listed in
tcp_available_congestion_control.
Default is "reno" and the default setting (tcp_congestion_control).

tcp_allowed_congestion_control - 字符串
显示 / 设置可用于非特权进程的可用拥塞控制选择。该列表是 tcp_available_congestion_control 中列出的子集。
默认值为 “reno”, 默认设置为默认的拥塞控制 (tcp_congestion_control)。

tcp_app_win - INTEGER
Reserve max(window/2^tcp_app_win, mss) of window for application
buffer. Value 0 is special, it means that nothing is reserved.
Default: 31

tcp_app_win - 整数
为应用程序缓冲区保留窗口的最大值 (窗口 / 2^tcp_app_win,mss)。值 0 具有特殊意义，表示不保留任何内容。
默认值：31

tcp_autocorking - BOOLEAN
Enable TCP auto corking :
When applications do consecutive small write()/sendmsg() system calls,
we try to coalesce these small writes as much as possible, to lower
total amount of sent packets. This is done if at least one prior
packet for the flow is waiting in Qdisc queues or device transmit
queue. Applications can still use TCP_CORK for optimal behavior
when they know how/when to uncork their sockets.
Default : 1

tcp_autocorking - 布尔值
启用 TCP 自动 corking:
当应用程序执行连续的小型 write ()/sendmsg () 系统调用时，我们会尽可能合并这些小型写入，以降低总发送数据包数。如果至少有一个先前的数据包正在等待中的 qdisc 队列或设备传输队列中，则执行此操作。应用程序仍可以在知道如何 / 何时取消其套接字 cork 时使用 TCP_CORK 获得最佳行为。
默认值：1

tcp_available_congestion_control - STRING
Shows the available congestion control choices that are registered.
More congestion control algorithms may be available as modules,
but not loaded.

tcp_available_congestion_control - 字符串
显示已注册的可用拥塞控制选择。可以作为模块提供更多拥塞控制算法，但未加载。

tcp_base_mss - INTEGER
The initial value of search_low to be used by the packetization layer
Path MTU discovery (MTU probing). If MTU probing is enabled,
this is the initial MSS used by the connection.

tcp_base_mss - 整数
路径 MTU 发现 (MTU 探测) 数据包化层初始化搜索_low 的值。如果启用了 MTU 探测，
这是连接使用的初始 MSS。

tcp_ecn - INTEGER
Control use of Explicit Congestion Notification (ECN) by TCP.
ECN is used only when both ends of the TCP connection indicate
support for it. This feature is useful in avoiding losses
due to congestion by allowing supporting routers to signal
congestion before having to drop packets.
Possible values are:
0 Disable ECN. Neither initiate nor accept ECN.
1 Enable ECN when requested by incoming connections and
also request ECN on outgoing connection attempts.
2 Enable ECN when requested by incoming connections
but do not request ECN on outgoing connections.
Default: 2

tcp_ecn - 整数
控制 TCP 对显式拥塞通知 (ECN) 的使用。仅当 TCP 连接的两端都指示支持时，才使用 ECN。此功能可避免因拥塞而导致的损失，方法是允许支持路由器在丢弃数据包之前发出拥塞信号。
可能的值是:
0 禁用 ECN。不启动或接受 ECN。
1 在传入连接请求 ECN 时启用 ECN, 并在发起连接尝试时请求 ECN。
2 当传入连接请求 ECN 时启用 ECN, 但不要求发起连接的 ECN。
默认值为 2

tcp_fack - BOOLEAN
This is a legacy option, it has no effect anymore.

tcp_fack - 布尔值
这是一个遗留选项，它不再有任何效果。

tcp_fin_timeout - INTEGER
The length of time an orphaned (no longer referenced by any
application) connection will remain in the FIN_WAIT_2 state
before it is aborted at the local end.
Cf. tcp_max_orphans

tcp_fin_timeout - 整数
当 RTO 重传仍未得到确认时，孤立的 (不再由任何应用程序引用的) 连接保持在 FIN_WAIT_2 状态的时间长度。
与 tcp_max_orphans 相比较。

tcp_fwmark_accept - BOOLEAN
If set, incoming connections to listening sockets that do not have a
socket mark will set the mark of the accepting socket to the fwmark of
the incoming SYN packet. This will cause all packets on that connection
(starting from the first SYNACK) to be sent with that fwmark. The
listening socket's mark is unchanged. Listening sockets that already
have a fwmark set via setsockopt(SOL_SOCKET, SO_MARK, ...) are
unaffected.

默认值:0

tcp_fwmark_accept - 布尔值
如果设置，则对未设置套接字标记的侦听套接字的传入连接将接收套接字的标记设置为 SYN 数据包的 fwmark。这将导致该连接上的所有数据包 (从第一个 SYNACK 开始) 都发送该 fwmark。侦听套接字的标记不变。使用 setsockopt (SOL_SOCKET,SO_MARK,...) 设置了 fwmark 的侦听套接字不受影响。

默认值:0

tcp_invalid_ratelimit - INTEGER
Limit the maximal rate for sending duplicate acknowledgments
in response to incoming TCP packets that are for an existing
connection but that are invalid due to any of these reasons:

livecodeserver

(a) out-of-window sequence number,  
(b) out-of-window acknowledgment number, or  
(c) PAWS (Protection Against Wrapped Sequence numbers) check failure

This can help mitigate simple "ack loop" DoS attacks, wherein  
a buggy or malicious middlebox or man-in-the-middle can  
rewrite TCP header fields in manner that causes each endpoint  
to think that the other is sending invalid TCP segments, thus  
causing each side to send an unterminating stream of duplicate  
acknowledgments for invalid segments.

Using 0 disables rate-limiting of dupacks in response to  
invalid segments; otherwise this value specifies the minimal  
space between sending such dupacks, in milliseconds.

Default: 500 (milliseconds).

tcp_invalid_ratelimit - 整数
限制对传入 TCP 数据包的无效重复确认的最大速率，这些数据包用于现有连接，但由于以下任一原因无效:

(a)序列号超出窗口,
(b)确认号超出窗口,或
(c)PAWS(保护折叠的序列号)检查失败

这可以帮助缓解简单的“确认循环”DoS攻击,其中错误或恶意中间设备或中间人可以以导致每个端点认为另一端正在发送无效TCP段的方式重写TCP头字段,因此导致每一端发送一个无穷无尽的重复确认无效段流。

使用0禁用对无效段的重复确认的速率限制;否则此值指定发送这些重复确认之间的最小间隔,以毫秒为单位。

默认值:500(毫秒)。

tcp_keepalive_time - INTEGER
How often TCP sends out keepalive messages when keepalive is enabled.
Default: 2hours.

tcp_keepalive_time - 整数
启用 keepalive 时，TCP 发送 keepalive 消息的频率。
默认值：2 小时。

tcp_keepalive_probes - INTEGER
How many keepalive probes TCP sends out, until it decides that the
connection is broken. Default value: 9.

tcp_keepalive_probes - 整数
在 TCP 决定连接已断开之前发送的 keepalive 探测数。默认值：9。

tcp_keepalive_intvl - INTEGER
How frequently the probes are send out. Multiplied by
tcp_keepalive_probes it is time to kill not responding connection,
after probes started. Default value: 75sec i.e. connection
will be aborted after ~11 minutes of retries.

tcp_keepalive_intvl - 整数
发送探测的频率。乘以 tcp_keepalive_probes, 就是在探测启动后，终止不响应的连接的时间。默认值：75 秒，即在约 11 分钟的重试后，连接将被中止。

tcp_max_orphans - INTEGER
Maximal number of TCP sockets not attached to any user file handle,
held by system. If this number is exceeded orphaned connections are
reset immediately and warning is printed. This limit exists
only to prevent simple DoS attacks, you must not rely on this
or lower the limit artificially, but rather increase it
(probably, after increasing installed memory),
if network conditions require more than default value,
and tune network services to linger and kill such states
more aggressively. Let me to remind again: each orphan eats
up to ~64K of unswappable memory.

tcp_max_orphans - 整数
系统保持的未附加到任何用户文件句柄的 TCP 套接字的最大数量。如果超过此数字，则立即重置孤立连接并打印警告。此限制仅用于防止简单的 DoS 攻击，您不应依赖此限制或人为降低限制，而应该在需要时增加它 (可能在增加已安装内存之后), 如果网络条件需要比默认值更多，并调整网络服务以更积极地保持和终止这些状态。 让我再次提醒：每个孤立的套接字占用约 64K 的不可换页内存。

tcp_max_syn_backlog - INTEGER
Maximal number of remembered connection requests (SYN_RECV),
which have not received an acknowledgment from connecting client.
This is a per-listener limit.
The minimal value is 128 for low memory machines, and it will
increase in proportion to the memory of machine.
If server suffers from overload, try increasing this number.
Remember to also check /proc/sys/net/core/somaxconn
A SYN_RECV request socket consumes about 304 bytes of memory.

tcp_max_syn_backlog - 整数
记住的连接请求 (SYN_RECV) 的最大数量，这些连接请求尚未从连接的客户端收到确认。这是每个侦听器的限制。
对于低内存机器，最小值为 128, 它将与机器内存成比例增加。
如果服务器遭受过载，请尝试增加此数字。
还要检查 /proc/sys/net/core/somaxconn
SYN_RECV 请求套接字消耗约 304 字节的内存。

tcp_no_metrics_save - BOOLEAN
By default, TCP saves various connection metrics in the route cache
when the connection closes, so that connections established in the
near future can use these to set initial conditions. Usually, this
increases overall performance, but may sometimes cause performance
degradation. If set, TCP will not cache metrics on closing
connections.

tcp_no_metrics_save - 布尔值
默认情况下，TCP 在连接关闭时会在路由缓存中保存各种连接指标，以便在不久的将来建立的连接可以使用这些指标来设置初始条件。通常，这会提高总体性能，但有时可能会降低性能。如果设置，TCP 将不会在关闭连接时缓存指标。

tcp_orphan_retries - INTEGER
This value influences the timeout of a locally closed TCP connection,
when RTO retransmissions remain unacknowledged.
See tcp_retries2 for more details.

The default value is 8.  
If your machine is a loaded WEB server,  
you should think about lowering this value, such sockets  
may consume significant resources. Cf. tcp_max_orphans.

tcp_orphan_retries - 整数
当 RTO 重传保持未确认时，此值会影响本地关闭的 TCP 连接的超时。
有关更多详细信息，请参阅 tcp_retries2。

默认值为8。
如果您的机器是一个繁忙的WEB服务器,您应考虑降低此值,这样的套接字可能会消耗大量资源。 与tcp_max_orphans进行比较。

tcp_reordering - INTEGER
Initial reordering level of packets in a TCP stream.
TCP stack can then dynamically adjust flow reordering level
between this initial value and tcp_max_reordering
Default: 3

tcp_reordering - 整数
TCP 流中数据包的初始重排序级别。
然后，TCP 堆栈可以在此初始值和 tcp_max_reordering 之间动态调整流重排序级别
默认值：3

tcp_retries1 - INTEGER
This value influences the time, after which TCP decides, that
something is wrong due to unacknowledged RTO retransmissions,
and reports this suspicion to the network layer.
See tcp_retries2 for more details.

RFC 1122 recommends at least 3 retransmissions, which is the
default.

tcp_retries1 - 整数
此值影响 TCP 决定由于未确认的 RTO 重传导致某些问题的时间，并将此怀疑报告给网络层后的时间。
有关更多详细信息，请参阅 tcp_retries2。

RFC 1122建议至少3次重传,这是默认值。

tcp_retries2 - INTEGER
This value influences the timeout of an alive TCP connection,
when RTO retransmissions remain unacknowledged.
Given a value of N, a hypothetical TCP connection following
exponential backoff with an initial RTO of TCP_RTO_MIN would
retransmit N times before killing the connection at the (N+1)th RTO.

The default value of 15 yields a hypothetical timeout of 924.6
seconds and is a lower bound for the effective timeout.
TCP will effectively time out at the first RTO which exceeds the
hypothetical timeout.

RFC 1122 recommends at least 100 seconds for the timeout,
which corresponds to a value of at least 8.

tcp_retries2 - 整数
当 RTO 重传保持未确认时，此值会影响活动 TCP 连接的超时。
给定值为 N, 则遵循指数后退且初始 RTO 为 TCP_RTO_MIN 的假设 TCP 连接将在第 (N+1) 个 RTO 之前重传 N 次，然后终止连接。

默认值为15,会产生924.6秒的假设超时,并且是有效超时的下限。
当第一个RTO超过假设超时时,TCP将会有效超时。

RFC 1122建议超时至少为100秒,这对应值为至少8。

tcp_rfc1337 - BOOLEAN
If set, the TCP stack behaves conforming to RFC1337. If unset,
we are not conforming to RFC, but prevent TCP TIME_WAIT
assassination.
Default: 0

tcp_rfc1337 - 布尔值
如果设置，TCP 堆栈的行为符合 RFC1337。 如果未设置，我们不符合 RFC, 但可防止 TCP TIME_WAIT 暗杀。
默认值：0

tcp_rmem - vector of 3 INTEGERs: min, default, max
min: Minimal size of receive buffer used by TCP sockets.
It is guaranteed to each TCP socket, even under moderate memory
pressure.
Default: 4K

default: initial size of receive buffer used by TCP sockets.
This value overrides net.core.rmem_default used by other protocols.
Default: 87380 bytes. This value results in window of 65535 with
default setting of tcp_adv_win_scale and tcp_app_win:0 and a bit  
less for default tcp_app_win. See below about these variables.

max: maximal size of receive buffer allowed for automatically
selected receiver buffers for TCP socket. This value does not override
net.core.rmem_max.  Calling setsockopt() with SO_RCVBUF disables
automatic tuning of that socket's receive buffer size, in which
case this value is ignored.  
Default: between 87380B and 6MB, depending on RAM size.

tcp_rmem - 整数向量：最小值，默认值，最大值
min: TCP 套接字使用的接收缓冲区的最小大小。即使在中等内存压力下，也保证每个 TCP 套接字。默认值：4K

default: TCP套接字使用的接收缓冲区的初始大小。此值覆盖其他协议使用的net.core.rmem_default。默认值:87380字节。使用tcp_adv_win_scale和tcp_app_win:0的默认设置,此值会产生65535的窗口,对于默认的tcp_app_win则稍小一些。请参阅关于这些变量的说明。

max: 用于TCP套接字的自动选择的接收缓冲区的最大大小。此值不会覆盖net.core.rmem_max。调用setsockopt()且SO_RCVBUF会禁用对该套接字接收缓冲区大小的自动调节,在这种情况下,此值会被忽略。默认值: 根据RAM大小在87380B和6MB之间。

tcp_sack - BOOLEAN
Enable select acknowledgments (SACKS).

tcp_sack - 布尔值
启用选择性确认 (SACK)。

tcp_slow_start_after_idle - BOOLEAN
If set, provide RFC2861 behavior and time out the congestion
window after an idle period. An idle period is defined at
the current RTO. If unset, the congestion window will not
be timed out after an idle period.
Default: 1

tcp_slow_start_after_idle - 布尔值
如果设置，在空闲期后提供 RFC2861 行为和拥塞窗口超时。空闲期定义为当前的 RTO。如果未设置，在空闲期后不会超时拥塞窗口。
默认值：1

tcp_stdurg - BOOLEAN
Use the Host requirements interpretation of the TCP urgent pointer field.
Most hosts use the older BSD interpretation, so if you turn this on
Linux might not communicate correctly with them.
Default: FALSE

tcp_stdurg - 布尔值
使用主机要求的 TCP 紧急指针字段解释。大多数主机使用较旧的 BSD 解释，因此如果您打开此功能，Linux 可能无法与它们正确通信。
默认值：FALSE

tcp_syn_retries - INTEGER
Number of times initial SYNs for an active TCP
connection attempt will be retransmitted. Should not be higher than 127. Default value
is 6, which corresponds to 63seconds till the last retransmission
with the current initial RTO of 1second. With this the final timeout
for an active TCP connection attempt will happen after 127seconds.

tcp_syn_retries - 整数
主动 TCP 连接尝试的初始 SYN 的重传次数。不应超过 127。默认值是 6, 对应于最后一次重传为 63 秒，当前的初始 RTO 为 1 秒。因此，主动 TCP 连接尝试的最终超时将在 127 秒后发生。

tcp_synack_retries - INTEGER
Number of times SYNACKs for a passive TCP connection attempt will
be retransmitted. Should not be higher than 255. Default value
is 5, which corresponds to 31seconds till the last retransmission
with the current initial RTO of 1second. With this the final timeout
for a passive TCP connection will happen after 63seconds.

tcp_synack_retries - 整数
被动 TCP 连接尝试的 SYNACK 段的重传次数。不应超过 255。默认值为 5, 对应于最后一次重传为 31 秒，当前的初始 RTO 为 1 秒。因此，被动 TCP 连接的最终超时将在 63 秒后发生。

tcp_timestamps - INTEGER
Enable timestamps as defined in RFC1323.
0: Disabled.
1: Enable timestamps as defined in RFC1323 and use random offset for
each connection rather than only using the current time.
2: Like 1, but without random offsets.
Default: 1

tcp_timestamps - 整数
启用 RFC1323 中定义的时间戳。
0: 禁用。
1: 启用 RFC1323 中定义的时间戳，并为每个连接使用随机偏移量，而不仅仅使用当前时间。
2: 像 1 一样，但没有随机偏移量。
默认值：1

tcp_tso_win_divisor - INTEGER
This allows control over what percentage of the congestion window
can be consumed by a single TSO frame.
The setting of this parameter is a choice between burstiness and
building larger TSO frames.
Default: 3

tcp_tso_win_divisor - 整数
这允许控制单个 TSO 框架可以消耗拥塞窗口的百分比。
此参数的设置在突发性和构建更大的 TSO 框架之间进行选择。
默认值：3

tcp_tw_reuse - INTEGER
Enable reuse of TIME-WAIT sockets for new connections when it is
safe from protocol viewpoint.
0 - disable
1 - global enable
2 - enable for loopback traffic only
It should not be changed without advice/request of technical
experts.
Default: 2

tcp_tw_reuse - 整数
当从协议视角来看安全时，允许 TIME-WAIT sockets 重用新连接。
0 - 禁用
1 - 全局启用
2 - 仅对环回流量启用
如果没有技术专家的建议 / 请求，不应更改此设置。
默认值：2

tcp_window_scaling - BOOLEAN
Enable window scaling as defined in RFC1323.

tcp_window_scaling - 布尔值
启用 RFC1323 中定义的窗口缩放。

tcp_wmem - vector of 3 INTEGERs: min, default, max
min: Amount of memory reserved for send buffers for TCP sockets.
Each TCP socket has rights to use it due to fact of its birth.
Default: 4K

default: initial size of send buffer used by TCP sockets.  This
value overrides net.core.wmem_default used by other protocols.  
It is usually lower than net.core.wmem_default.
Default: 16K

max: Maximal amount of memory allowed for automatically tuned
send buffers for TCP sockets. This value does not override
net.core.wmem_max.  Calling setsockopt() with SO_SNDBUF disables
automatic tuning of that socket's send buffer size, in which case
this value is ignored.
Default: between 64K and 4MB, depending on RAM size.

tcp_wmem - 整数向量：最小值，默认值，最大值
min: 为 TCP 套接字保留的发送缓冲区的内存量。由于 TCP 套接字的产生，每个套接字都有权使用它。默认值：4K

default: TCP套接字使用的发送缓冲区的初始大小。此值覆盖其他协议使用的net.core.wmem_default。它通常低于net.core.wmem_default。默认值:16K

max: 允许用于TCP套接字自动调整的发送缓冲区的最大内存量。此值不会覆盖net.core.wmem_max。调用setsockopt()且SO_SNDBUF会禁用对该套接字发送缓冲区大小的自动调节,在这种情况下,此值会被忽略。默认值: 根据RAM大小在64K和4MB之间。

UDP variables:

udp_l3mdev_accept - BOOLEAN
Enabling this option allows a "global" bound socket to work
across L3 master domains (e.g., VRFs) with packets capable of
being received regardless of the L3 domain in which they
originated. Only valid when the kernel was compiled with
CONFIG_NET_L3_MASTER_DEV.
Default: 0 (disabled)

UDP 变量:

udp_l3mdev_accept - 布尔值
启用此选项可允许 “全局” 绑定的套接字跨 L3 主域 (例如 VRF) 工作，并能够接收数据包，而与数据包的原始 L3 域无关。 仅当内核使用 CONFIG_NET_L3_MASTER_DEV 编译时才有效。
默认值：0 (禁用)

udp_mem - vector of 3 INTEGERs: min, pressure, max
Number of pages allowed for queueing by all UDP sockets.

min: Below this number of pages UDP is not bothered about its
memory appetite. When amount of memory allocated by UDP exceeds
this number, UDP starts to moderate memory usage.

pressure: This value was introduced to follow format of tcp_mem.  

max: Number of pages allowed for queueing by all UDP sockets.

Default is calculated at boot time from amount of available memory.

udp_mem - 整数向量：最小值，压力值，最大值
允许所有 UDP 套接字排队的页面数量。

min: 在此数量的页面以下,UDP不会关心其内存需求。 当UDP分配的内存量超过此数字时,UDP会开始适度使用内存。

pressure: 引入此值是为了遵循tcp_mem的格式。

max: 允许所有UDP套接字排队的页面数。

默认值在启动时根据可用内存量计算。

RAW variables:

RAW 变量:

raw_l3mdev_accept - BOOLEAN
Enabling this option allows a "global" bound socket to work
across L3 master domains (e.g., VRFs) with packets capable of
being received regardless of the L3 domain in which they
originated. Only valid when the kernel was compiled with
CONFIG_NET_L3_MASTER_DEV.
Default: 1 (enabled)

raw_l3mdev_accept - 布尔值
启用此选项可允许 “全局” 绑定的套接字跨 L3 主域 (例如 VRF) 工作，并能够接收数据包，而与数据包的原始 L3 域无关。 仅当内核使用 CONFIG_NET_L3_MASTER_DEV 编译时才有效。
默认值：1 (启用)

CIPSOv4 Variables:

CIPSOv4 变量:

cipso_cache_enable - BOOLEAN
If set, enable additions to and lookups from the CIPSO label mapping
cache. If unset, additions are ignored and lookups always result in a
miss. However, regardless of the setting the cache is still
invalidated when required when means you can safely toggle this on and
off and the cache will always be "safe".
Default: 1

cipso_cache_enable - 布尔值
如果设置，启用对 CIPSO 标签映射缓存的添加和查找。 如果未设置，添加将被忽略，查找总会导致未命中。 但是，无论设置如何，在需要时缓存仍会被 INVALIDATE, 这意味着您可以安全地打开和关闭此功能，缓存总是 “安全” 的。
默认值：1

cipso_cache_bucket_size - INTEGER
The CIPSO label cache consists of a fixed size hash table with each
hash bucket containing a number of cache entries. This variable limits
the number of entries in each hash bucket; the larger the value the
more CIPSO label mappings that can be cached. When the number of
entries in a given hash bucket reaches this limit adding new entries
causes the oldest entry in the bucket to be removed to make room.
Default: 10

cipso_cache_bucket_size - 整数
CIPSO 标签缓存由固定大小的哈希表组成，每个哈希桶包含多个缓存条目。 此变量限制每个哈希桶中的条目数；值越大，可以缓存的 CIPSO 标签映射就越多。 当给定哈希桶中的条目数达到此限制时，添加新条目会导致桶中最旧的条目被删除以腾出空间。
默认值：10

IP Variables:

IP 变量:

ip_local_port_range - 2 INTEGERS
Defines the local port range that is used by TCP and UDP to
choose the local port. The first number is the first, the
second the last local port number.
If possible, it is better these numbers have different parity
(one even and one odd value).
Must be greater than or equal to ip_unprivileged_port_start.
The default values are 32768 and 60999 respectively.

ip_local_port_range - 2 个整数
定义 TCP 和 UDP 用于选择本地端口的本地端口范围。第一个数字是第一个本地端口，第二个数字是最后一个本地端口。
如果可能，最好这些数字具有不同的奇偶校验 (一个为偶数，一个为奇数)。
必须大于或等于 ip_unprivileged_port_start。
默认值分别为 32768 和 60999。

ip_unprivileged_port_start - INTEGER
This is a per-namespace sysctl. It defines the first
unprivileged port in the network namespace. Privileged ports
require root or CAP_NET_BIND_SERVICE in order to bind to them.
To disable all privileged ports, set this to 0. They must not
overlap with the ip_local_port_range.

Default: 1024

ip_unprivileged_port_start - 整数
这是每个网络命名空间的 sysctl。它定义了网络命名空间中的第一个非特权端口。绑定到特权端口需要 root 权限或 CAP_NET_BIND_SERVICE 功能。要禁用所有特权端口，请将此设置为 0。它们不能与 ip_local_port_range 重叠。

默认值:1024

ip_nonlocal_bind - BOOLEAN
If set, allows processes to bind() to non-local IP addresses,
which can be quite useful - but may break some applications.
Default: 0

ip_nonlocal_bind - 布尔值
如果设置，允许进程绑定到非本地 IP 地址，这可能非常有用，但可能会破坏一些应用程序。
默认值：0

ip_dynaddr - BOOLEAN
If set non-zero, enables support for dynamic addresses.
If set to a non-zero value larger than 1, a kernel log
message will be printed when dynamic address rewriting
occurs.
Default: 0

ip_dynaddr - 布尔值
如果设置为非零，则启用对动态地址的支持。
如果设置为大于 1 的非零值，则在发生动态地址重写时会打印内核日志消息。
默认值：0

ip_early_demux - BOOLEAN
Optimize input packet processing down to one demux for
certain kinds of local sockets. Currently we only do this
for established TCP and connected UDP sockets.

It may add an additional cost for pure routing workloads that
reduces overall throughput, in such case you should disable it.
Default: 1

ip_early_demux - 布尔值
优化某些类型本地套接字的输入数据包处理，降低到一个 demux。 当前，我们只针对已建立的 TCP 和连接的 UDP 套接字执行此操作。

对于纯路由工作负载,这可能增加额外成本并降低整体吞吐量,在这种情况下,您应该禁用它。
默认值:1

作为备用参考吧，参数太多，实在记不住，其他看上述官网

/proc/sys/net 目录

　　所有的 TCP/IP 参数都位于 /proc/sys/net 目录下（请注意，对 /proc/sys/net 目录下内容的修改都是临时的，任何修改在系统重启后都会丢失），例如下面这些重要的参数：

/etc/sysctl.conf 文件

　　/etc/sysctl.conf 是一个允许你改变正在运行中的 Linux 系统的接口。它包含一些 TCP/IP 堆栈和虚拟内存系统的高级选项，可用来控制 Linux 网络配置，由于 /proc/sys/net 目录内容的临时性，建议把 TCPIP 参数的修改添加到 /etc/sysctl.conf 文件，然后保存文件，使用命令 “/sbin/sysctl –p” 使之立即生效。具体修改方案参照上文：

net.core.rmem_default = 256960
net.core.rmem_max = 513920
net.core.wmem_default = 256960
net.core.wmem_max = 513920
net.core.netdev_max_backlog = 2000
net.core.somaxconn = 2048
net.core.optmem_max = 81920
net.ipv4.tcp_mem = 131072  262144  524288
net.ipv4.tcp_rmem = 8760  256960  4088000
net.ipv4.tcp_wmem = 8760  256960  4088000
net.ipv4.tcp_keepalive_time = 1800
net.ipv4.tcp_keepalive_intvl = 30
net.ipv4.tcp_keepalive_probes = 3
net.ipv4.tcp_sack = 1
net.ipv4.tcp_fack = 1
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.ip_local_port_range = 1024  65000
net.ipv4.tcp_max_syn_backlog = 2048