TCP parameters worth tuning, and ones to leave alone

For services with many short connections, a few knobs matter.

net.core.somaxconn caps the accept queue (4096 on recent kernels); the application's listen backlog cannot exceed it, so nginx's listen 80 backlog=4096 should match.

net.ipv4.tcp_max_syn_backlog sizes the SYN queue and helps against small SYN floods.

net.ipv4.tcp_tw_reuse=1 lets outbound connections reuse TIME_WAIT ports, safely.

net.ipv4.tcp_fin_timeout smaller speeds reclamation but may send RSTs to peers.

Leave alone: tcp_rmem and tcp_wmem defaults — the kernel's autotuning beats hand-picked numbers; tcp_tw_recycle, which no longer exists; and tcp_syncookies, which should stay on.

Check with ss -s rather than reading /proc/net/sockstat alone.