Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER ADMINISTRATION, Руководство по развертыванию

Страница: 73 / 848

/proc/sys/
47
•
version
— Displays the date and time the kernel was last compiled. The first field in this file, such
as
#3
, relates to the number of times a kernel was built from the source base.
3.3.9.4.
/proc/sys/net/
This directory contains subdirectories concerning various networking topics. Various configurations at
the time of kernel compilation make different directories available here, such as
ethernet/
,
ipv4/
,
ipx/
, and
ipv6/
. By altering the files within these directories, system administrators are able to
adjust the network configuration on a running system.
Given the wide variety of possible networking options available with Linux, only the most common
/
proc/sys/net/
directories are discussed.
The
/proc/sys/net/core/
directory contains a variety of settings that control the interaction
between the kernel and networking layers. The most important of these files are:
•
message_burst
— Sets the amount of time in tenths of a second required to write a new warning
message. This setting is used to mitigate
Denial of Service
(
DoS
) attacks. The default setting is
50
.
•
message_cost
— Sets a cost on every warning message. The higher the value of this file (default
of
5
), the more likely the warning message is ignored. This setting is used to mitigate DoS attacks.
The idea of a DoS attack is to bombard the targeted system with requests that generate errors and
fill up disk partitions with log files or require all of the system's resources to handle the error logging.
The settings in
message_burst
and
message_cost
are designed to be modified based on the
system's acceptable risk versus the need for comprehensive logging.
•
netdev_max_backlog
— Sets the maximum number of packets allowed to queue when a
particular interface receives packets faster than the kernel can process them. The default value for
this file is
300
.
•
optmem_max
— Configures the maximum ancillary buffer size allowed per socket.
•
rmem_default
— Sets the receive socket buffer default size in bytes.
•
rmem_max
— Sets the receive socket buffer maximum size in bytes.
•
wmem_default
— Sets the send socket buffer default size in bytes.
•
wmem_max
— Sets the send socket buffer maximum size in bytes.
The
/proc/sys/net/ipv4/
directory contains additional networking settings. Many of these
settings, used in conjunction with one another, are useful in preventing attacks on the system or when
using the system to act as a router.
Caution
An erroneous change to these files may affect remote connectivity to the system.
The following is a list of some of the more important files within the
/proc/sys/net/ipv4/
directory: