Linux‑Systeme erlauben über die Dateien im Verzeichnis /proc/sys/vm die Feinabstimmung des virtuellen Speichers und des Schreibens von veränderten Daten auf die Festplatte.
https://docs.kernel.org/admin-guide/sysctl/vm.html
https://docs.kernel.org/admin-guide/sysctl/vm.html
November 7, 2026 at 2:31 PM
Linux‑Systeme erlauben über die Dateien im Verzeichnis /proc/sys/vm die Feinabstimmung des virtuellen Speichers und des Schreibens von veränderten Daten auf die Festplatte.
https://docs.kernel.org/admin-guide/sysctl/vm.html
https://docs.kernel.org/admin-guide/sysctl/vm.html
[love poem]
grep -rnw '/dev/null' -e ''
chmod 777 /dev/tty
ssh -i ~/.ssh/id_rsa -N -L 8080:localhost:8080 root@localhost
ln -sf /dev/null /dev/zero
fd = os·open("/dev/null", os.O_RDONLY)
flags=mmap.MAP_SHARED)
while true; do sleep 0; done
rsync -avz --delete /tmp/ /var/
sysctl -w vm.drop_caches=0
grep -rnw '/dev/null' -e ''
chmod 777 /dev/tty
ssh -i ~/.ssh/id_rsa -N -L 8080:localhost:8080 root@localhost
ln -sf /dev/null /dev/zero
fd = os·open("/dev/null", os.O_RDONLY)
flags=mmap.MAP_SHARED)
while true; do sleep 0; done
rsync -avz --delete /tmp/ /var/
sysctl -w vm.drop_caches=0
November 6, 2026 at 10:26 AM
[love poem]
grep -rnw '/dev/null' -e ''
chmod 777 /dev/tty
ssh -i ~/.ssh/id_rsa -N -L 8080:localhost:8080 root@localhost
ln -sf /dev/null /dev/zero
fd = os·open("/dev/null", os.O_RDONLY)
flags=mmap.MAP_SHARED)
while true; do sleep 0; done
rsync -avz --delete /tmp/ /var/
sysctl -w vm.drop_caches=0
grep -rnw '/dev/null' -e ''
chmod 777 /dev/tty
ssh -i ~/.ssh/id_rsa -N -L 8080:localhost:8080 root@localhost
ln -sf /dev/null /dev/zero
fd = os·open("/dev/null", os.O_RDONLY)
flags=mmap.MAP_SHARED)
while true; do sleep 0; done
rsync -avz --delete /tmp/ /var/
sysctl -w vm.drop_caches=0
netdev_budget_usecs'u
#Linux #Kernel #Network #Sysctl
https://mustafaerbay.com.tr/blog/technology/ayari-1000den-1001e-cikardim-saniyedeki-286-sikisma-sifirlandi/
#Linux #Kernel #Network #Sysctl
https://mustafaerbay.com.tr/blog/technology/ayari-1000den-1001e-cikardim-saniyedeki-286-sikisma-sifirlandi/
Ayarı 1000'den 1001'e Çıkardım, Saniyedeki 286 Sıkışma Sıfırlandı
netdev_budget_usecs mikrosaniye diye belgelenmiş, ama bir saat vuruşu çözünürlüğünde çalışıyor. 1, 500 ve 1000 aynı sonucu verdi; 1001 her şeyi değiştirdi.
mustafaerbay.com.tr
November 7, 2026 at 3:02 PM
netdev_budget_usecs'u
#Linux #Kernel #Network #Sysctl
https://mustafaerbay.com.tr/blog/technology/ayari-1000den-1001e-cikardim-saniyedeki-286-sikisma-sifirlandi/
#Linux #Kernel #Network #Sysctl
https://mustafaerbay.com.tr/blog/technology/ayari-1000den-1001e-cikardim-saniyedeki-286-sikisma-sifirlandi/
Thought I was tweaking a microsecond setting, but 1
#Linux #Kernel #Network #Sysctl
https://mustafaerbay.com.tr/en/blog/technology/ayari-1000den-1001e-cikardim-saniyedeki-286-sikisma-sifirlandi/
#Linux #Kernel #Network #Sysctl
https://mustafaerbay.com.tr/en/blog/technology/ayari-1000den-1001e-cikardim-saniyedeki-286-sikisma-sifirlandi/
I Raised It from 1000 to 1001 and 286 Squeezes a Second Went to Zero
netdev_budget_usecs is documented in microseconds but works at clock-tick resolution. 1, 500 and 1000 gave the same result; 1001 changed everything.
mustafaerbay.com.tr
November 7, 2026 at 3:03 PM
Thought I was tweaking a microsecond setting, but 1
#Linux #Kernel #Network #Sysctl
https://mustafaerbay.com.tr/en/blog/technology/ayari-1000den-1001e-cikardim-saniyedeki-286-sikisma-sifirlandi/
#Linux #Kernel #Network #Sysctl
https://mustafaerbay.com.tr/en/blog/technology/ayari-1000den-1001e-cikardim-saniyedeki-286-sikisma-sifirlandi/
[love poem]
grep -rnw '/dev/null' -e ''
chmod 777 /dev/tty
ssh -i ~/.ssh/id_rsa -N -L 8080:localhost:8080 root@localhost
ln -sf /dev/null /dev/zero
fd = os·open("/dev/null", os.O_RDONLY)
flags=mmap.MAP_SHARED)
while true; do sleep 0; done
rsync -avz --delete /tmp/ /var/
sysctl -w vm.drop_caches=0
grep -rnw '/dev/null' -e ''
chmod 777 /dev/tty
ssh -i ~/.ssh/id_rsa -N -L 8080:localhost:8080 root@localhost
ln -sf /dev/null /dev/zero
fd = os·open("/dev/null", os.O_RDONLY)
flags=mmap.MAP_SHARED)
while true; do sleep 0; done
rsync -avz --delete /tmp/ /var/
sysctl -w vm.drop_caches=0
November 6, 2026 at 10:26 AM
[love poem]
grep -rnw '/dev/null' -e ''
chmod 777 /dev/tty
ssh -i ~/.ssh/id_rsa -N -L 8080:localhost:8080 root@localhost
ln -sf /dev/null /dev/zero
fd = os·open("/dev/null", os.O_RDONLY)
flags=mmap.MAP_SHARED)
while true; do sleep 0; done
rsync -avz --delete /tmp/ /var/
sysctl -w vm.drop_caches=0
grep -rnw '/dev/null' -e ''
chmod 777 /dev/tty
ssh -i ~/.ssh/id_rsa -N -L 8080:localhost:8080 root@localhost
ln -sf /dev/null /dev/zero
fd = os·open("/dev/null", os.O_RDONLY)
flags=mmap.MAP_SHARED)
while true; do sleep 0; done
rsync -avz --delete /tmp/ /var/
sysctl -w vm.drop_caches=0
🚨 Outbound HTTPS calls failing with low CPU? Check Ephemeral Port Exhaustion!
🧠 28k+ ports stuck in 60s TIME_WAIT quarantine.
🛠️ Fix:
1️⃣ ss -s
2️⃣ sudo ss -tan state time-wait | head -n 5
3️⃣ sudo sysctl -w net.ipv4.tcp_tw_reuse=1
🧠 28k+ ports stuck in 60s TIME_WAIT quarantine.
🛠️ Fix:
1️⃣ ss -s
2️⃣ sudo ss -tan state time-wait | head -n 5
3️⃣ sudo sysctl -w net.ipv4.tcp_tw_reuse=1
November 5, 2026 at 5:30 AM
🚨 Outbound HTTPS calls failing with low CPU? Check Ephemeral Port Exhaustion!
🧠 28k+ ports stuck in 60s TIME_WAIT quarantine.
🛠️ Fix:
1️⃣ ss -s
2️⃣ sudo ss -tan state time-wait | head -n 5
3️⃣ sudo sysctl -w net.ipv4.tcp_tw_reuse=1
🧠 28k+ ports stuck in 60s TIME_WAIT quarantine.
🛠️ Fix:
1️⃣ ss -s
2️⃣ sudo ss -tan state time-wait | head -n 5
3️⃣ sudo sysctl -w net.ipv4.tcp_tw_reuse=1
To check if you've got any multipath listeners up after this:
sudo ss -Mlp
You gotta restart apps after doing the sysctl thing, it doesn't kill existing sockets
sudo ss -Mlp
You gotta restart apps after doing the sysctl thing, it doesn't kill existing sockets
Self-hosters can force an immediate Caddy update with:
sudo pdsadmin update
For additional confidence, you can disable mptcp system-wide with:
sudo sysctl -w net.mptcp.enabled=0
We recommend upgrading your system kernel and rebooting as soon as distro packages are available.
sudo pdsadmin update
For additional confidence, you can disable mptcp system-wide with:
sudo sysctl -w net.mptcp.enabled=0
We recommend upgrading your system kernel and rebooting as soon as distro packages are available.
October 30, 2026 at 8:48 PM
To check if you've got any multipath listeners up after this:
sudo ss -Mlp
You gotta restart apps after doing the sysctl thing, it doesn't kill existing sockets
sudo ss -Mlp
You gotta restart apps after doing the sysctl thing, it doesn't kill existing sockets
or kernel limits, in which case try checking and setting kernel variables under net.ipv4 with sysctl
October 31, 2026 at 7:20 PM
or kernel limits, in which case try checking and setting kernel variables under net.ipv4 with sysctl
Self-hosters can force an immediate Caddy update with:
sudo pdsadmin update
For additional confidence, you can disable mptcp system-wide with:
sudo sysctl -w net.mptcp.enabled=0
We recommend upgrading your system kernel and rebooting as soon as distro packages are available.
sudo pdsadmin update
For additional confidence, you can disable mptcp system-wide with:
sudo sysctl -w net.mptcp.enabled=0
We recommend upgrading your system kernel and rebooting as soon as distro packages are available.
October 30, 2026 at 8:20 PM
Self-hosters can force an immediate Caddy update with:
sudo pdsadmin update
For additional confidence, you can disable mptcp system-wide with:
sudo sysctl -w net.mptcp.enabled=0
We recommend upgrading your system kernel and rebooting as soon as distro packages are available.
sudo pdsadmin update
For additional confidence, you can disable mptcp system-wide with:
sudo sysctl -w net.mptcp.enabled=0
We recommend upgrading your system kernel and rebooting as soon as distro packages are available.
Setting vm.swappiness=0 from a blog post once got a payments team an OOM kill on prod. This guide covers the sysctl params that actually matter, and the ones people cargo-cult from Stack Overflow. https://www.valtersit.com/guides/linux/linux-kernel-tuning-sysctl-parameters-that-matter/
Linux Kernel Tuning: sysctl Parameters That Matter
www.valtersit.com
October 30, 2026 at 7:20 PM
Setting vm.swappiness=0 from a blog post once got a payments team an OOM kill on prod. This guide covers the sysctl params that actually matter, and the ones people cargo-cult from Stack Overflow. https://www.valtersit.com/guides/linux/linux-kernel-tuning-sysctl-parameters-that-matter/
Deploy CIS Control 7 continuous vuln scanning with OpenSCAP: one command evaluates the CIS Benchmark profile, probing files, packages, sysctl, and services, outputting ARF XML for ingestion. https://www.valtersit.com/vault/deploy-cis-control-7-continuous-vulnerability-scanning-with--a320d7/
Deploy CIS Control 7 continuous vulnerability scanning with OpenSCAP profile
www.valtersit.com
November 2, 2026 at 6:40 PM
Deploy CIS Control 7 continuous vuln scanning with OpenSCAP: one command evaluates the CIS Benchmark profile, probing files, packages, sysctl, and services, outputting ARF XML for ingestion. https://www.valtersit.com/vault/deploy-cis-control-7-continuous-vulnerability-scanning-with--a320d7/
Note that Tailscale also uses Go and shows up when checking for Multipath TCP listeners with:
sudo ss -Mlp
I solved this by putting the sysctl setting into a config file with:
echo net.mptcp.enabled=0 >/etc/sysctl.d/mptcp.conf
And reboot.
h/t @iame.li
sudo ss -Mlp
I solved this by putting the sysctl setting into a config file with:
echo net.mptcp.enabled=0 >/etc/sysctl.d/mptcp.conf
And reboot.
h/t @iame.li
Self-hosters can force an immediate Caddy update with:
sudo pdsadmin update
For additional confidence, you can disable mptcp system-wide with:
sudo sysctl -w net.mptcp.enabled=0
We recommend upgrading your system kernel and rebooting as soon as distro packages are available.
sudo pdsadmin update
For additional confidence, you can disable mptcp system-wide with:
sudo sysctl -w net.mptcp.enabled=0
We recommend upgrading your system kernel and rebooting as soon as distro packages are available.
October 30, 2026 at 9:14 PM
Note that Tailscale also uses Go and shows up when checking for Multipath TCP listeners with:
sudo ss -Mlp
I solved this by putting the sysctl setting into a config file with:
echo net.mptcp.enabled=0 >/etc/sysctl.d/mptcp.conf
And reboot.
h/t @iame.li
sudo ss -Mlp
I solved this by putting the sysctl setting into a config file with:
echo net.mptcp.enabled=0 >/etc/sysctl.d/mptcp.conf
And reboot.
h/t @iame.li
Pretty sure there is a way to increase that limit in sysctl.
October 30, 2026 at 9:08 PM
Pretty sure there is a way to increase that limit in sysctl.
TCP BBR vs Cubic: Fix Slow Transfers on Lossy Links
Cubic collapsed to 20 KB/s on a lossy long-haul path. One sysctl on the sender made it 50x faster. How to diagnose with ss and mtr, enable BBR, and get it on CentOS 7.
Cubic collapsed to 20 KB/s on a lossy long-haul path. One sysctl on the sender made it 50x faster. How to diagnose with ss and mtr, enable BBR, and get it on CentOS 7.
TCP BBR vs Cubic: Fix Slow Transfers on Lossy Links
Cubic collapsed to 20 KB/s on a lossy long-haul path. One sysctl on the sender made it 50x faster. How to diagnose with ss and mtr, enable BBR, and get it on CentOS 7.
www.getpagespeed.com
October 31, 2026 at 4:15 PM
TCP BBR vs Cubic: Fix Slow Transfers on Lossy Links
Cubic collapsed to 20 KB/s on a lossy long-haul path. One sysctl on the sender made it 50x faster. How to diagnose with ss and mtr, enable BBR, and get it on CentOS 7.
Cubic collapsed to 20 KB/s on a lossy long-haul path. One sysctl on the sender made it 50x faster. How to diagnose with ss and mtr, enable BBR, and get it on CentOS 7.
(2/4) Qué hacer, según LND: desactivar MPTCP en la máquina con el comando «sudo sysctl -w net.mptcp.enabled=0», porque otros servicios del equipo no quedan cubiertos por esta versión, e instalar un kernel parcheado en cuanto la distribución lo publique.
October 31, 2026 at 7:22 AM
(2/4) Qué hacer, según LND: desactivar MPTCP en la máquina con el comando «sudo sysctl -w net.mptcp.enabled=0», porque otros servicios del equipo no quedan cubiertos por esta versión, e instalar un kernel parcheado en cuanto la distribución lo publique.
(2/4) Qué hacer, según LND: desactivar MPTCP en la máquina con el comando «sudo sysctl -w net.mptcp.enabled=0», porque otros servicios del equipo no quedan cubiertos por esta versión, e instalar un kernel parcheado en cuanto la distribución lo publique.
October 31, 2026 at 7:22 AM
(2/4) Qué hacer, según LND: desactivar MPTCP en la máquina con el comando «sudo sysctl -w net.mptcp.enabled=0», porque otros servicios del equipo no quedan cubiertos por esta versión, e instalar un kernel parcheado en cuanto la distribución lo publique.
Your nginx box hits 100% CPU at 3AM and dmesg fills with TCP out of memory warnings. Stop cargo-culting sysctl.conf. https://www.valtersit.com/guides/linux/linux-kernel-tuning-for-high-traffic-servers-sysctl-parameters/
Linux Kernel Tuning for High-Traffic Servers: sysctl Parameters
www.valtersit.com
October 29, 2026 at 10:50 PM
Your nginx box hits 100% CPU at 3AM and dmesg fills with TCP out of memory warnings. Stop cargo-culting sysctl.conf. https://www.valtersit.com/guides/linux/linux-kernel-tuning-for-high-traffic-servers-sysctl-parameters/
https://blog.gslin.org/archives/2026/11/01/13313/linux-%e9%80%99%e6%ac%a1-mptcp-%e7%9a%84-use-after-free-%e6%bc%8f%e6%b4%9e-cve-2026-98432/
Linux 這次 MPTCP 的 Use-after-free 漏洞 (CVE-2026-98432)
#advis
Linux 這次 MPTCP 的 Use-after-free 漏洞 (CVE-2026-98432)
#advis
Gea-Suan Lin (@gslin@abpe.org)
https://blog.gslin.org/archives/2026/11/01/13313/linux-%e9%80%99%e6%ac%a1-mptcp-%e7%9a%84-use-after-free-%e6%bc%8f%e6%b4%9e-cve-2026-98432/
Linux 這次 MPTCP 的 Use-after-free 漏洞 (CVE-2026-98432)
#advisory #kernel #linux #mitigation #mptcp #multipath #network #patch #security #sysctl #tcp #ubuntu #UseAfterFree #vulnerability
abpe.org
November 1, 2026 at 3:22 AM
https://blog.gslin.org/archives/2026/11/01/13313/linux-%e9%80%99%e6%ac%a1-mptcp-%e7%9a%84-use-after-free-%e6%bc%8f%e6%b4%9e-cve-2026-98432/
Linux 這次 MPTCP 的 Use-after-free 漏洞 (CVE-2026-98432)
#advis
Linux 這次 MPTCP 的 Use-after-free 漏洞 (CVE-2026-98432)
#advis
ちょっと対応が遅れたが、bsky方面で流れていたとりあえずの対処としてウチのUbuntu 20.04LTS(ESM on)サーバで "sudo sysctl -w net.mptcp.enabled=0" を実行してmptcpを無効化、および/etc/sysctl.d/99-mptcp.confにも同じ設定を書いて永続化。効果あるかどうかは分からないが…
October 31, 2026 at 12:48 AM
ちょっと対応が遅れたが、bsky方面で流れていたとりあえずの対処としてウチのUbuntu 20.04LTS(ESM on)サーバで "sudo sysctl -w net.mptcp.enabled=0" を実行してmptcpを無効化、および/etc/sysctl.d/99-mptcp.confにも同じ設定を書いて永続化。効果あるかどうかは分からないが…
For those of you running Linux, do this immediately:
```
sudo tee /etc/sysctl.d/99-disable-mptcp-cve-2026-98432.conf >/dev/null <<'EOF'
# Temporary mitigation for CVE-2026-98432.
net.mptcp.enabled = 0
EOF
sudo sysctl --system
```
Shit is bad, remote root exploit with no complexity, all my […]
```
sudo tee /etc/sysctl.d/99-disable-mptcp-cve-2026-98432.conf >/dev/null <<'EOF'
# Temporary mitigation for CVE-2026-98432.
net.mptcp.enabled = 0
EOF
sudo sysctl --system
```
Shit is bad, remote root exploit with no complexity, all my […]
Original post on piaille.fr
piaille.fr
October 30, 2026 at 12:20 PM
For those of you running Linux, do this immediately:
```
sudo tee /etc/sysctl.d/99-disable-mptcp-cve-2026-98432.conf >/dev/null <<'EOF'
# Temporary mitigation for CVE-2026-98432.
net.mptcp.enabled = 0
EOF
sudo sysctl --system
```
Shit is bad, remote root exploit with no complexity, all my […]
```
sudo tee /etc/sysctl.d/99-disable-mptcp-cve-2026-98432.conf >/dev/null <<'EOF'
# Temporary mitigation for CVE-2026-98432.
net.mptcp.enabled = 0
EOF
sudo sysctl --system
```
Shit is bad, remote root exploit with no complexity, all my […]
IPv6 smokes tests green, monitoring lies: blackbox probing IPv4 while v6-first mobile traffic fails. Dual-stack safely with nftables inet rules, sequenced AAAA rollout, sysctl baselines. https://www.valtersit.com/guides/networking/ipv6-in-production-dual-stack-without-breaking-ipv4/
IPv6 in Production: Dual-Stack Without Breaking IPv4
www.valtersit.com
October 30, 2026 at 3:20 AM
IPv6 smokes tests green, monitoring lies: blackbox probing IPv4 while v6-first mobile traffic fails. Dual-stack safely with nftables inet rules, sequenced AAAA rollout, sysctl baselines. https://www.valtersit.com/guides/networking/ipv6-in-production-dual-stack-without-breaking-ipv4/
Harden CIS Control 9: drop-in at /etc/sysctl.d/99-cis- wins lexical order, enforcing ASLR, SYN cookies, rp_filter, no forwarding/redirects. Idempotent, rollback included. https://www.valtersit.com/vault/harden-cis-control-9-kernel-sysctl-profile-with-idempotent-d-344c2c/
Harden CIS Control 9 kernel sysctl profile with idempotent drop-in and rollback
www.valtersit.com
October 28, 2026 at 8:50 PM
Harden CIS Control 9: drop-in at /etc/sysctl.d/99-cis- wins lexical order, enforcing ASLR, SYN cookies, rp_filter, no forwarding/redirects. Idempotent, rollback included. https://www.valtersit.com/vault/harden-cis-control-9-kernel-sysctl-profile-with-idempotent-d-344c2c/
Your nginx edge box pegs at 100% and dmesg floods with TCP out of memory warnings. Stop cargo-culting sysctl.conf. https://www.valtersit.com/guides/linux/linux-kernel-tuning-for-high-traffic-servers-sysctl-parameters/
Linux Kernel Tuning for High-Traffic Servers: sysctl Parameters
www.valtersit.com
October 28, 2026 at 4:40 AM
Your nginx edge box pegs at 100% and dmesg floods with TCP out of memory warnings. Stop cargo-culting sysctl.conf. https://www.valtersit.com/guides/linux/linux-kernel-tuning-for-high-traffic-servers-sysctl-parameters/
Today’s Bash security topic is Practice: System hardening toolkit. The shell should help you prove host state, not guess at it. I want strict defaults, obvious paths, and evidence from find, stat, chmod, sysctl, and baseline files under /etc so the result survives an audit or incident review.
October 27, 2026 at 1:07 AM
Today’s Bash security topic is Practice: System hardening toolkit. The shell should help you prove host state, not guess at it. I want strict defaults, obvious paths, and evidence from find, stat, chmod, sysctl, and baseline files under /etc so the result survives an audit or incident review.
spent twenty minutes debugging why my local vault sync was dropping tailscale packets only to realize a systemd update silently reverted a sysctl conf. left a three line comment on the closed issue and went back to cold brew.
#selfhosting #systemd
#selfhosting #systemd
October 25, 2026 at 4:15 PM
spent twenty minutes debugging why my local vault sync was dropping tailscale packets only to realize a systemd update silently reverted a sysctl conf. left a three line comment on the closed issue and went back to cold brew.
#selfhosting #systemd
#selfhosting #systemd