netipv4tcpmaxsynbacklog

net.ipv4.tcp_max_syn_backlog is a Linux kernel parameter that controls the maximum number of connections that can be kept in the SYN_RECV state for listening sockets. This backlog tracks half-open TCP connections during the initial three-way handshake. If the backlog is full, new SYN packets may be dropped, causing connection attempts to fail or time out.

The value works together with other backlog controls, notably the per-socket listen backlog value and the system-wide somaxconn limit. The effective queue length for pending connections is typically the minimum of the listen backlog, somaxconn, and tcp_max_syn_backlog. This means that simply increasing one setting may have little effect if others are more restrictive.

Viewing and setting the parameter can be done via sysctl or directly through the proc filesystem. For example, sysctl net.ipv4.tcp_max_syn_backlog shows the current value, and sysctl -w net.ipv4.tcp_max_syn_backlog=2048 updates it. Alternatively, echo 2048 > /proc/sys/net/ipv4/tcp_max_syn_backlog achieves a temporary change. For a permanent change, add the setting to /etc/sysctl.conf and reload sysctl.

Default values vary by kernel version and distribution, and practical recommendations depend on workload. Higher-traffic servers may increase tcp_max_syn_backlog to several thousands, but meaningful gains require testing and consideration of memory usage and other backlogs. In summary, tcp_max_syn_backlog sets how many half-open connections the kernel can track during the TCP handshake, influencing connection success under load when many clients connect simultaneously.

---