Community Tips
Blockshard
I'm usually tuning networking, memory, and file descriptors. This is a
sysctl.conf
file I'm using to tune and harden a blockchain node, collected and fine-tuned over the years.- Marc Bonenberger, Founder of Blockshard
Edit the /etc/sysctl.conf
file.
sudo nano /etc/sysctl.conf
Add the following contents to the bottom of the file. Note: Delete any uncommented lines that were previously added.
# =======================================
# FILE DESCRIPTORS
# =======================================
fs.file-max = 500000 # Max number of open files system-wide (also set ulimit for processes)
# =======================================
# NETWORK PERFORMANCE TUNING (TCP/IP)
# =======================================
# Congestion control and queuing discipline
net.ipv4.tcp_congestion_control = bbr # Use BBR for better congestion handling
net.core.default_qdisc = fq # Fair Queuing (fq) pairs well with BBR
# TCP buffer sizes (min, default, max in bytes)
net.ipv4.tcp_rmem = 4096 1048576 2097152 # Receive buffer
net.ipv4.tcp_wmem = 4096 65536 16777216 # Send buffer
# Default buffer limits for all sockets
net.core.rmem_default = 1048576
net.core.wmem_default = 1048576
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.optmem_max = 65536
# TCP settings for better throughput and resilience
net.ipv4.tcp_window_scaling = 1 # Allow larger TCP window sizes
net.ipv4.tcp_sack = 1 # Selective acknowledgements
net.ipv4.tcp_timestamps = 1 # Timestamps for round-trip time measurement
net.ipv4.tcp_syncookies = 1 # Protect against SYN flood attacks
net.ipv4.tcp_slow_start_after_idle = 0 # Don't restart slow start after idle
net.ipv4.tcp_no_metrics_save = 1 # Don't retain metrics from past connections
net.ipv4.tcp_low_latency = 1 # Prioritize latency
# Increase the connection backlog
net.core.somaxconn = 8192 # Max incoming connection queue length
# =======================================
# SECURITY HARDENING
# =======================================
net.ipv4.icmp_echo_ignore_broadcasts = 1 # Ignore ICMP broadcasts (smurf protection)
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.all.accept_redirects = 0 # Don't accept ICMP redirects
net.ipv4.conf.all.log_martians = 0 # Disable logging of packets with impossible addresses
# =======================================
# SHARED MEMORY
# =======================================
kernel.shmmax = 1073741824 # Max size of a shared memory segment (1GB)
# =======================================
# VIRTUAL MEMORY TUNING
# =======================================
vm.swappiness = 10 # Prefer RAM over swap. Set value to 1 for even better performance if you have 32GB RAM or more
vm.vfs_cache_pressure = 50 # Retain inode/dentry cache longer (useful for I/O-heavy apps)
info
Set vm.swappiness = 1 instead if you have 32GB RAM or more for even better performance.
CTRL+O
, ENTER
, CTRL+X
to save and exit.
Then load the new values and verify that the new settings are applied
sudo sysctl -p # load new values
sudo sysctl --system # verify settings are applied