linux - tcp_tw_reuse 和 tcp_tw_recycle 在原理上有什么区别？

Question

我的理解是，reuse 只会抛弃时间戳后退的 fin 包来，而 recycle 会抛弃所有时间戳后退的包，不止 fin 包，这个理解对不对？

如果对，那么如果遇到了 NAT 后面的多个客户端，reuse 打开的情况下为什么能够正确关闭连接？NAT 后面的多个客户端的时钟不一定一致，fin 包有可能时间戳后退，就被抛弃了。

Answer 1

First of all, you should post this question to Stackoverflow. There are still very few masters in the Chinese community, and even fewer specific points!
net.ipv4.tcp_tw_recycle = {0|1} Whether to enable timewait fast recycling; Note: turning on this function may cause serious problems in a NAT environment: because TCP has a behavior, it can cache The latest timestamp of each connection. If the timestamp in subsequent requests is smaller than the timestamp in the cache, it will be considered invalid and the corresponding request message will be discarded; whether Linux enables this behavior depends on tcp_timestamp and tcp_tw_recycle, and the former parameter is enabled by default, so enabling the latter parameter will activate this function; therefore, if it is a NAT environment, for security reasons, tcp_tw_recycle should be disabled . Another solution: Setting tcp_timestamps to 0 and tcp_tw_recycle to 1 will not work as expected, because once tcp_timestamps is turned off , then even if tcp_tw_recycle is turned on, the following parameters will have no effect. At this time, lowering the value of net.ipv4.tcp_max_tw_buckets can significantly reduce the number of tw connections. net.ipv4.tcp_tw_recycle = {0|1} 是否启用timewait快速回收；注意：开启此功能在NAT环境下可能会出现严重的问题：因为TCP有一种行为，它可以缓存每个连接最新的时间戳，后续请求中如果时间戳小于缓存中的时间戳，即被视为无效并丢弃相应的请求报文；Linux是否启用这种行为取决于tcp_timestamp和tcp_tw_recycle，而前一个参数默认是启用的，所以启用后面的参数就会激活此功能； 因此，如果是NAT环境，安全起见，应该禁用tcp_tw_recycle。另一种解决方案：把tcp_timestamps设置为0，tcp_tw_recycle设置为1并不会如想象中奏效，因为一旦关闭了tcp_timestamps，那么即便打开了tcp_tw_recycle，后面的参数也没有效果。此时降低net.ipv4.tcp_max_tw_buckets的值就可以显著降低tw连接的数量了。

net.ipv4.tcp_tw_reuse = {0|1} 是否开启tw重用，即是否允许将TIME-WAIT sockets

net.ipv4.tcp_tw_reuse = {0|1} Whether to enable tw reuse, that is, whether to allow TIME-WAIT sockets to be used for new TCP connections, that is, the data structure is not Yes, just change the IP and port and continue using it. This is not the function you mentioned! 🎜