Member Avatar for Member #545322

Does enabling all the sysctl.conf settings impact the performance(speed)
of my network connection? #ubuntu.

I had enabled few to prevent some spoofing and MIM attack even though I
experience none. Any suggestion regarding this?

#
# /etc/sysctl.conf - Configuration file for setting system variables
# See /etc/sysctl.d/ for additional system variables.
# See sysctl.conf (5) for information.
#

#kernel.domainname = example.com

# Uncomment the following to stop low-level messages on console
#kernel.printk = 3 4 1 3

##############################################################3
# Functions previously found in netbase
#

# Uncomment the next two lines to enable Spoof protection (reverse-path filter)
# Turn on Source Address Verification in all interfaces to
# prevent some spoofing attacks
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.all.rp_filter=1

# Uncomment the next line to enable TCP/IP SYN cookies
# See http://lwn.net/Articles/277146/
# Note: This may impact IPv6 TCP sessions too
#net.ipv4.tcp_syncookies=1

# Uncomment the next line to enable packet forwarding for IPv4
#net.ipv4.ip_forward=1

# Uncomment the next line to enable packet forwarding for IPv6
#  Enabling this option disables Stateless Address Autoconfiguration
#  based on Router Advertisements for this host
#net.ipv6.conf.all.forwarding=1


###################################################################
# Additional settings - these settings can improve the network
# security of the host and prevent against some network attacks
# including spoofing attacks and man in the middle attacks through
# redirection. Some network environments, however, require that these
# settings are disabled so review and enable them as needed.
#
# Do not accept ICMP redirects (prevent MITM attacks)
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
# _or_
# Accept ICMP redirects only for gateways listed in our default
# gateway list (enabled by default)
# net.ipv4.conf.all.secure_redirects = 1
#
# Do not send ICMP redirects (we are not a router)
#net.ipv4.conf.all.send_redirects = 0
#
# Do not accept IP source route packets (we are not a router)
#net.ipv4.conf.all.accept_source_route = 0
#net.ipv6.conf.all.accept_source_route = 0
#
# Log Martian Packets
#net.ipv4.conf.all.log_martians = 1
#

vm.swappiness=10
  • 3 Contributors
  • 3 Replies
  • 464 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by shwick

Dani AI

Generated

Short answer: enabling typical network-oriented sysctl security options rarely reduces raw throughput on modern systems. Most of those knobs only add lightweight checks in the kernel and won’t change line-rate speed. Exceptions are things that force per-packet expensive work or that actively drop otherwise valid packets — for example, strict source-address verification on multi-homed boxes or heavy connection tracking on high-connection-rate servers can cause retransmits or CPU pressure that looks like a slowdown. This echoes ’s point that only a few settings are likely to move the performance needle, and also addresses ’s original concern about spoofing/MITM hardening.

Practical verification steps to make any change safe and measurable:

# throughput test (iperf3)
iperf3 -s                 # on server
iperf3 -c SERVER_IP -P 4  # on client; -P runs parallel streams

# latency / path
ping -c 50 TARGET
mtr -r TARGET

# simple HTTP timing
curl -o /dev/null -s -w "%{time_total}\n" http://example.com/file

Also watch for retransmits and drops with ss -s or netstat -s, and tail kernel logs (dmesg or journalctl) after changes.

Safe rollout checklist: back up the current config, apply one change at a time (use the runtime sysctl tool to test live), validate for at least a day under representative load, then persist. If anything breaks (VPNs, asymmetric routes, services failing), revert the single change you last made rather than reverting everything at once.

Regarding the IPv6 suggestion from : disabling IPv6 rarely yields measurable speed gains and can cause name-resolution or service problems when AAAA records exist. Prefer targeted fixes and measurement over a global disable. Use address-family tests (IPv4-only vs IPv6-only) to prove any benefit before making persistent changes.

Recommended Answers

All 3 Replies

Member Avatar for rubberman

Non of these settings, excepting possibly vm.swappiness or the actual filters used when your rp_filter settings are enabled, should impact network performance, and I'm uncertain about the vm.swappiness setting.

Member Avatar for Member #545322

: Thanks for the help, now playing with the .conf settings to tune up my internet connection.

Member Avatar for shwick

disable ipv6 to improve performance

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.