{"id":1210,"date":"2026-09-23T22:35:17","date_gmt":"2026-09-23T22:35:17","guid":{"rendered":"https:\/\/virtualserversvps.com\/blog\/?p=1210"},"modified":"2026-09-23T22:35:17","modified_gmt":"2026-09-23T22:35:17","slug":"ephemeral-port-exhaustion-so-reuseport-tuning-linux-vps","status":"publish","type":"post","link":"https:\/\/virtualserversvps.com\/blog\/ephemeral-port-exhaustion-so-reuseport-tuning-linux-vps\/","title":{"rendered":"Ephemeral Port Exhaustion and SO_REUSEPORT Tuning on Linux Servers"},"content":{"rendered":"\n

When a busy server starts refusing new connections but traffic and CPU look normal, the cause is often a quiet resource limit: the ephemeral port range, or the loading of SO_REUSEPORT across worker processes. Both show up as connection errors under load and disappear the moment load drops, which makes them easy to misdiagnose as network faults. This guide walks through measuring both, confirming the cause, and widening the limits without opening your box to abuse.<\/p>\n\n\n\n

Confirm ephemeral port exhaustion<\/h2>\n\n\n\n

A server handling many outbound connections \u2014 reverse proxies, scrapers, API clients \u2014 consumes ports from the local range. If that range is small, or sockets linger in TIME_WAIT, new outbound connections fail with Cannot assign requested address<\/code>. Check the range and current usage.<\/p>\n\n\n\n

sysctl net.ipv4.ip_local_port_range\nss -s\nss -tan state time-wait | wc -l<\/code><\/pre>\n\n\n\n
A default range of 32768 60999<\/code> gives roughly 28,000 ports. Each connection to a remote host must use a unique local port, so a process opening thousands of short-lived connections per minute can exhaust it. Raise the range and enable socket reuse.<\/p>\n\n\n\n
Widen the range and reduce TIME_WAIT pressure<\/h2>\n\n\n\n
# \/etc\/sysctl.d\/99-ports.conf\nnet.ipv4.ip_local_port_range = 10000 65535\nnet.ipv4.tcp_tw_reuse = 1\nnet.ipv4.tcp_fin_timeout = 15\nnet.ipv4.tcp_max_tw_buckets = 262144<\/code><\/pre>\n\n\n\n
Apply and verify.<\/p>\n\n\n\n
sysctl --system\nsysctl net.ipv4.ip_local_port_range net.ipv4.tcp_tw_reuse<\/code><\/pre>\n\n\n\n
tcp_tw_reuse=1<\/code> lets the kernel recycle TIME_WAIT sockets for new outbound connections when it is safe to do so. Since Linux 4.12 it only applies to outbound connections, so it will not disturb state tracking for inbound traffic.<\/p>\n\n\n\n
Match the listen backlog to your concurrency<\/h2>\n\n\n\n
Kernel restart, overflow behaviour, and the application’s own accept queue all need to line up. If the accept queue overflows at any level, clients see connection resets under burst load.<\/p>\n\n\n\n
# \/etc\/sysctl.d\/99-ports.conf\nnet.core.somaxconn = 4096\nnet.ipv4.tcp_max_syn_backlog = 8192\nnet.ipv4.tcp_abort_on_overflow = 0<\/code><\/pre>\n\n\n\n
Then set the application’s listen backlog to the same order of magnitude. In Nginx that is the backlog<\/code> parameter on the listen<\/code> directive; in systemd services, ListenStream<\/code> carries its own backlog.<\/p>\n\n\n\n
Symptom<\/th>Likely cause<\/th>Fix<\/th><\/tr><\/thead>
“Cannot assign requested address”<\/td>Ephemeral port exhaustion<\/td>Widen ip_local_port_range, enable tw_reuse<\/td><\/tr>
Connections reset under bursts<\/td>Backlog overflow<\/td>Raise somaxconn + app backlog<\/td><\/tr>
Slow new connections, CPU fine<\/td>SYN queue drops<\/td>Raise tcp_max_syn_backlog<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Reproduce the failure before changing anything<\/h2>\n\n\n\n
A generator that opens outbound connections in a tight loop reproduces port exhaustion on demand and lets you confirm the fix. Run it, watch the error appear, apply the sysctl change, and run it again.<\/p>\n\n\n\n
# crude port exhaustion test: open many short-lived connections\nfor i in $(seq 1 40000); do\n  (exec 3<>\/dev\/tcp\/127.0.0.1\/80 2>\/dev\/null && exec 3>&- 3<&-) 2>\/dev\/null\ndone\necho \"exit $?\"<\/code><\/pre>\n\n\n\n
Errors such as Cannot assign requested address<\/code> during the run mean the local range or TIME_WAIT handling is the constraint. After widening ip_local_port_range<\/code> and enabling tcp_tw_reuse<\/code>, the same loop completes cleanly.<\/p>\n\n\n\n
Second-order effects to check<\/h2>\n\n\n\n