Sysctl Connection Tuning Calculator

Work out sysctl connection tuning instantly with clear inputs, formula shown and shareable results.

About Sysctl Connection Tuning Calculator

Every closed outbound connection holds its local port in TIME_WAIT for twice the maximum segment lifetime, so sockets in that state are connections per second times the TIME_WAIT duration. At 8,000 connections per second and 60 seconds, 480,000 sockets far exceed the default ephemeral range of about 28,000 — which is why high-rate proxies must widen the range and reuse connections.

Formula

TIME_WAIT accumulation

TIME_WAIT sockets = new connections per second x TIME_WAIT duration; port utilisation = sockets / ephemeral ports

Worked example

With the default values below, Sysctl Connection Tuning Calculator returns Sockets held in TIME_WAIT of 480,000. Change any input above and every figure here is recalculated in your browser.

Inputs used

New connections per secondminimum 0.001: 8,000
TIME_WAIT durationaccepts 1–240 s: 60 s
Ephemeral ports availableminimum 1,024: 28,232
nf_conntrack_maxminimum 1,024: 262,144

Results

Sockets held in TIME_WAIT: 480,000
Ephemeral port utilisation: 1,700.2%
conntrack table utilisation: 183.1%
Assessment: Ephemeral port exhaustion - widen the range or enable connection reuse

Step by step

1Values used
2TIME_WAIT accumulation
3Sockets held in TIME_WAIT= 480,000
4Ephemeral port utilisation= 1,700.2
5conntrack table utilisation= 183.1
6Assessment= Ephemeral port exhaustion - widen the range or enable connection reuse

Assumptions and limits

The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Is tcp_tw_recycle a fix?

No, it was removed because it breaks connections from behind NAT. Use tcp_tw_reuse for outbound connections, widen the port range, and above all use keep-alive.

Why does conntrack matter here?

Any host doing NAT or stateful filtering tracks each connection, and the table has its own limit. Exceeding it drops packets with a table full message in dmesg.