Tuning Linux kernel parameters with sysctl

The Linux kernel exposes hundreds of tunable parameters through sysctl. You can change how the kernel handles networking, memory, security, and more without rebooting. Most defaults are fine, but certain workloads benefit from tuning.

Reading parameters

Read a single parameter:

sysctl net.ipv4.ip_forward
# or
cat /proc/sys/net/ipv4/ip_forward

Read all parameters:

sysctl -a

Setting parameters

Temporarily (lost on reboot):

sudo sysctl -w net.ipv4.ip_forward=1

Or edit /etc/sysctl.conf for permanent changes:

sudo nano /etc/sysctl.conf

Add lines like:

net.ipv4.ip_forward = 1

Apply changes:

sudo sysctl -p

You can also drop config files in /etc/sysctl.d/:

sudo nano /etc/sysctl.d/99-custom.conf
sudo sysctl --system

Network tuning

Increase connection tracking table size (for busy servers):

net.netfilter.nf_conntrack_max = 262144
net.netfilter.nf_conntrack_tcp_timeout_established = 600

Enable IP forwarding (for routers/gateways):

net.ipv4.ip_forward = 1

Increase the range of ephemeral ports:

net.ipv4.ip_local_port_range = 1024 65535

Enable TCP Fast Open:

net.ipv4.tcp_fastopen = 3

Increase socket buffer sizes for high-bandwidth connections:

net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216

Reduce TIME_WAIT connections:

net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 30

Memory tuning

Control swap aggressiveness:

vm.swappiness = 10

Cache pressure (how aggressively the kernel reclaims dentry/inode caches):

vm.vfs_cache_pressure = 50

Overcommit memory (0 = heuristic, 1 = always, 2 = never):

vm.overcommit_memory = 0

For Redis or databases that use large amounts of memory:

vm.overcommit_memory = 1
vm.max_map_count = 262144

Security hardening

Disable IP source routing:

net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0

Enable SYN flood protection:

net.ipv4.tcp_syncookies = 1

Disable ICMP redirects:

net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

Ignore ICMP broadcasts:

net.ipv4.icmp_echo_ignore_broadcasts = 1

Enable reverse path filtering (anti-spoofing):

net.ipv4.conf.all.rp_filter = 1

Using a sysctl config file

Create a dedicated config file:

sudo nano /etc/sysctl.d/99-hardening.conf

# Network hardening
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.tcp_syncookies = 1

# Memory
vm.swappiness = 10

Apply:

sudo sysctl --system

Using /etc/sysctl.d/ keeps your changes separate from distribution defaults.

Checking current values

sysctl net.ipv4.ip_forward
# or with pattern matching:
sysctl -a | grep forward
# or from proc:
cat /proc/sys/net/ipv4/ip_forward

Common mistakes

Editing /proc/sys directly. Changes are temporary and lost on reboot. Use sysctl.

Not applying changes. Editing /etc/sysctl.conf doesn’t change anything until you run sysctl -p.

Typos in parameter names. sysctl silently ignores unknown parameters in config files. Check sysctl -p output for warnings.

Setting parameters that don’t exist. A parameter that works on one kernel version might not exist on another. Always verify with sysctl -a | grep name.

Remarks

Sysctl gives you direct control over kernel behavior without recompiling or rebooting. The defaults are reasonable for most systems, but specific workloads benefit from tuning. Network-heavy servers need connection tracking tuning, memory-hungry applications need swap and overcommit settings, and security-conscious setups need hardening parameters. Create a dedicated file in /etc/sysctl.d/ for your changes and document why each setting is there.