Turn off selective acknowledgements

Why it matters

Selective acknowledgements let TCP report exactly which pieces arrived, so only the missing ones are resent. The code that handles them has had serious bugs, and in 2019 a flaw known as SACK Panic let a remote attacker crash a Linux machine with specially crafted packets. Turning SACK off removes this type of target.

How it works

Sets net.ipv4.tcp_sack to 0. TCP connections then fall back to a simpler way of recovering lost packets, without selective acknowledgements.

Who should use it

A defense in depth choice for servers that face untrusted traffic. Known flaws are already fixed in current kernels, so for a desktop the speed cost is often a worse deal. Leave it on if you use slow or lossy links.

What you may notice

Downloads and uploads can be slower on Wi-Fi, mobile or long-distance connections that lose packets. On clean wired networks you may notice nothing.

Check it on your computer

Read the current value:

sysctl net.ipv4.tcp_sack

Apply it by hand

Set it now (until the next restart):

sudo sysctl -w net.ipv4.tcp_sack=0

Keep it after restarts, in a file you own:

sudo tee /etc/sysctl.d/90-net-tcp-sack.conf <<'EOF'
net.ipv4.tcp_sack = 0
EOF
sudo sysctl --system

Undo it

Remove the file and restart, or set the old value back with sysctl -w.

Related settings

• Survive connection floods
• Ignore resets of closing connections

Sources

Linux Hardening Guide (madaidans)

2.2.2