TB064 Linux TCP SACK Impact on Network Performance

Impact

To mitigate several recently published security vulnerabilities (CVE-2019-11477, CVE-2019-11478, CVE-2019-11479), some customers are disabling a performance feature of the TCP communication protocol known as Selective Acknowledgement (SACK).

Delphix environments using Linux source or target hosts may see degraded network performance if the TCP SACK feature is disabled. The severity of the performance impact will depend on the varying degrees of packet loss, duplicate packets, out of order packets present on the network (which TCP SACK specifically optimizes). Degraded network performance may in turn result in:

• Degraded read/write performance of Virtual Databases (VDBs)
• Degraded performance of Provision, Rewind, Refresh, SnapSync, and Replication jobs

Contributing Factors

This article applies to all versions of the Delphix Engine:

Note that TCP SACK is a standard TCP protocol feature, and is enabled by default on all main Linux distributions. Use of this functionality is not a Delphix-specific requirement but is a feature which affects network traffic and could therefore affect any Delphix release. 

Symptoms

There may be a significant drop in throughput compared to what was seen prior to disabling TCP SACK.

Resolution

Patches are available from major Linux vendors. Patches are the preferred mitigation of the security vulnerabilities as they do not risk performance degradation, unlike disabling the TCP SACK feature.

Additional Information

To determine if the TCP Sack option has been disabled on a particular Linux system, one may use the command:

sysctl net.ipv4.tcp_sack 

The command output will be similar to:

[root@mysystem ~]# sysctl net.ipv4.tcp_sack
net.ipv4.tcp_sack = 1
[root@mysystem ~]# 

If the value of net.ipv4.tcp_sack is 1, as in the above example, the TCP SACK feature is enabled.  If the value is 0, the feature has been disabled.