In-Depth Guide to Modern Linux Distribution Selection and BBR Network Stack Performance Tuning

选择 Cloud servers 的底层 Operating system 不仅关系到软件包的新旧程度，更直接决定了系统的基础 Memory 开销、底层内核特性支持以及长期维护成本。在 BandwagonHost（ BandwagonHost ）与 DMIT 这类主打高 Specification 硬件（如 AMD EPYC / Zen 4 架构处理器）与优质跨国高速 Bandwidth （如 CN2 GIA、CMIN2、AS9929、AS4837 等高速路由）的 VPS 环境下， Operating system 的选型与 Linux 内核 Networking 栈的调优尤为关键。

This article examines the architectural differences and selection criteria of modern mainstream Linux distributions. Combining the deployment features and security mechanisms of major providers' control panels, it presents a production-tested approach to Linux kernel BBR congestion control and high-throughput network stack tuning.

One. Production Selection Matrix for Modern Mainstream Linux Distributions#

When initializing or reinstalling a system in the provider's panel, carefully evaluate options such as Debian, Ubuntu, AlmaLinux, and Rocky Linux based on the host's memory, workload, and maintenance lifecycle.

1. Comparison of Core Distribution Features and Technology Stacks#

2. 深度选型场景剖析#

Debian 12 (Bookworm): A Lightweight and Highly Stable Foundation#

Debian 12 removes most unnecessary persistent background daemons and starts very few services at boot. On small instances with 1GB or even 512MB of memory, it can leave more than 85% of physical memory available for applications such as Nginx, PostgreSQL, and Go/Rust microservices, avoiding OOM Killer events caused by system-level memory bloat. Debian 12 also ships with the Linux 6.1 LTS kernel, providing native support for the full BBR module, eBPF, io_uring, and other key performance features. It is an ideal foundation for cross-border network proxies, static web reverse proxies, and lightweight Docker hosts.

Ubuntu 24.04 LTS: Balancing Rapid Development and Ecosystem Compatibility#

Ubuntu 24.04 LTS ships with the newer Linux 6.8+ kernel, offering official out-of-the-box support for hardware drivers, cutting-edge container technologies such as Docker CE and Podman, and modern runtimes such as Node.js, Python 3.12+, and Rust. The trade-off is that the system includes snapd、multipathd 以及较复杂的 netplan network abstraction layer, with idle memory usage after boot typically around 200MB. When deploying complex microservices, CI/CD build nodes, or modern full-stack applications on DMIT instances with high-performance AMD EPYC processors and more than 2GB of memory, Ubuntu 24.04 LTS can significantly reduce time spent manually compiling dependencies.

AlmaLinux 9 / Rocky Linux 9: RHEL Alternatives for Demanding Enterprise Environments#

After Red Hat changed its CentOS strategy, AlmaLinux and Rocky Linux filled the niche for 1:1 binary compatibility with RHEL 9. Although the 5.14 kernel version may look old, the Red Hat team continuously Backports networking fixes and security patches from modern kernels to this branch. If your business must run enterprise management systems, licensed cPanel panels, or commercial software based on the RPM ecosystem, AlmaLinux 9 is a highly secure choice.

Why Must You Stop Using CentOS 7?#

CentOS 7 officially reached end of life (EOL) in mid-2024. Its official YUM repositories are no longer maintained and have been moved to historical archives. Its default Linux 3.10 kernel lacks modern TCP fast-recovery algorithms, native WireGuard networking drivers, and modern BBR congestion-control support. Continuing to use CentOS 7 in modern cloud networking environments exposes you to unpatchable critical security vulnerabilities and severely reduces bandwidth utilization because of its outdated network stack.

二、 Providers 控制面板重装与首登安全机制#

在 Cloud servers 生命周期管理中，重装系统是首要环节。不同的 cloud services 商在控制面板交互、密码分级以及鉴权机制上存在明确差异。

1. BandwagonHost KiwiVM Operations Guidelines#

BandwagonHost's management system uses a multilayer permission-separation architecture:

• Password and Permission Isolation: The Billing Client Area login password, KiwiVM management panel password, and the instance's internal system root passwords are three separate credentials. After running “Install new OS” in KiwiVM, the panel generates a new random temporary root password and displays it on screen. Reinstallation does not change KiwiVM's own management password.
• Emergency Console Access: If, while later tuning kernel parameters such as sysctl), configure firewall rules (nftables / ufw）或加固 SSH 时因配置错误导致 public network SSH 阻断，无需重建系统。直接登录 KiwiVM 面板，利用内置的 Interactive Console or Root shell - interactive, allowing you to bypass the public network stack through an underlying VNC/serial connection, reach the host console, and roll back configurations or troubleshoot.
• Troubleshooting Lost Network Connectivity: if the control panel shows an instance as Running but it is unreachable over the public internet, first check its network and IP status in KiwiVM. Note that when an IP is on certain blacklists or routing is restricted, system policies generally directly limit the panel's “Migrate to another DC” feature.

2. DMIT Instance Panel and Credential Management Guidelines#

DMIT's instance lifecycle management emphasizes key compliance and modern cloud-native interactions:

• 默认禁用密码登录: For security, DMIT's mainstream official system images disable remote SSH root password login after initialization and require SSH Key-pair authentication. Before purchasing or reinstalling an instance, add your public key to the control panel's key repository.
• Access Panel and Rules for Applying Key Changes: To replace an instance's SSH key or reset its root password when necessary, use the DMIT instance console's Access (Access Control) page to submit changes. Be sure to note:After updating the SSH key in the Access panel, you must trigger a hardware-level instance reboot (Reboot) through the control panel before the underlying cloud-init and configuration injection agent will write the new public key into the system's ~/.ssh/authorized_keys in. Simply executing the following inside the operating system reboot commands generally cannot properly trigger a panel-level credential refresh.
• Emergency Console: If incorrect network settings inside the instance prevent external SSH handshakes, open the following directly in the DMIT instance panel: Console。该终端 Passed 独立通道挂载，可在不依赖 public network IP 可达性的前提下，登录系统进行修复 Details 。

Three. Cross-Border Long Fat Networks (BDP) and BBR Congestion Control Principles#

When a server is deployed in locations such as Los Angeles, San Jose, Tokyo, or Hong Kong, China, while its core users are thousands of kilometers away, network communication takes place in a typical **Long Fat Network (LFN)** environment.

1. The Physical BDP Model and Throughput Bottlenecks#

The Bandwidth-Delay Product (BDP) is calculated as:

$\text{BDP} = \text{Physical Bandwidth (Bytes/s)} \times \text{Physical Round-Trip Latency (RTT, seconds)}$

以一条自 BandwagonHost Los Angeles DC6 机房（具备 2.5Gbps Bandwidth 通道）或 DMIT Los Angeles Pro 节点连接国内骨干网的典型链路为例：

• Physical One-Way Bandwidth: $1,\text{Gbps} = 125,\text{MB/s}$
• Average Round-Trip Time (RTT): $150,\text{ms} = 0.15,\text{s}$
• The physical single-flow BDP capacity of this connection is: $125,\text{MB/s} \times 0.15,\text{s} \approx 18.75,\text{MB}$

这意味着，在发送端发出数据后、收到第一个确认 ACK 之前，整个跨太平洋光缆和沿途路由器缓冲区中最多需要“飞行” 18.75MB 的在途数据包，才能将整根 1Gbps 的管道彻底填满。

2. Limitations of Traditional Cubic and the Breakthrough of Google BBR#

【传统基于丢包的算法 (Cubic)】
沿途路由器缓冲区满溢产生丢包 (或偶发跨海传输抖动丢包)
       │
       ▼
立即判定发生网络严重拥塞，将拥塞窗口 (cwnd) 减半 (下降 30%~50%)
       │
       ▼
导致高带宽高延迟长肥管道常年无法被填满，实测单线程传输速率经常锁死在低速区间

【基于物理建模的算法 (Google BBR)】
实时交替探测两个物理极值：最大可用带宽 (BtlBw) 与最小传输延迟 (RTprop)
       │
       ▼
基于真实的物理容量模型调节发包速率 (Pacing Rate)，不再将随机偶发丢包视作拥塞信号
       │
       ▼
即使跨洋链路存在 1%~3% 的轻微背景损耗，仍能以极高吞吐跑满分配带宽

Modern distributions such as Debian 12 and Ubuntu 24.04 include the BBR kernel module natively. There is no need to compile an untrusted third-party kernel; BBR can be safely enabled in production through native configuration.

Four. Enable Native Linux BBR and FQ Queuing#

Following modern Linux configuration standards, manage system-level parameters centrally in /etc/sysctl.d/ separate configuration files, rather than directly modifying the monolithic /etc/sysctl.conf file to support future automated deployments and smooth system-version upgrades.

1. Verify Kernel and Module Prerequisites#

First check the kernel version:

uname -r

As long as the kernel version is above 4.9 (Debian 12 defaults to 6.1, and Ubuntu 24.04 to 6.8+), the system already includes the BBR module.

Run the following command to confirm that BBR is compiled into the kernel as an available option:

modprobe tcp_bbr
lsmod | grep bbr

If the terminal output includes tcp_bbr relevant entries indicate that the module is ready.

2. Write a Separate BBR Tuning Configuration#

In /etc/sysctl.d/ create a dedicated network-tuning unit file in the directory 99-bbr.conf：

cat << 'EOF' | sudo tee /etc/sysctl.d/99-bbr.conf
# 启用针对现代流控的 Fair Queue (公平队列调度器)
net.core.default_qdisc = fq

# 启用 Google BBR 拥塞控制算法
net.ipv4.tcp_congestion_control = bbr
EOF

3. Apply and Verify the Status#

Reload the kernel parameter configuration to apply it immediately without rebooting the server:

sudo sysctl --system

Verify the queuing algorithm and congestion control engine currently active in the system:

sysctl net.ipv4.tcp_congestion_control
sysctl net.core.default_qdisc

When the returned results respectively show net.ipv4.tcp_congestion_control = bbr and net.core.default_qdisc = fq , this confirms that the BBR congestion-control algorithm is successfully running the system's TCP network stack.

Five. Advanced Production Tuning for High-Throughput Cross-Border Networking#

Enabling BBR alone is insufficient to maximize a high-bandwidth 1Gbps~10Gbps VPS. Linux's default TCP receive and send buffer limits are often conservatively set to 4MB or less, too small for the in-flight data needed by a cross-border long fat network with a BDP of 18MB+. The sliding-window limit therefore constrains usable physical bandwidth.

For international production environments with high bandwidth and long RTT, apply the following complete set of optimization parameters to the system.

1. Deploy the Production Network Stack Tuning File#

In /etc/sysctl.d/ create a new one under 99-network-throughput.conf file:

cat << 'EOF' | sudo tee /etc/sysctl.d/99-network-throughput.conf
# ====================================================================
# 现代 Linux 高吞吐跨国网络优化配置 (针对大带宽、高延迟 BDP 环境)
# ====================================================================

# 1. 系统底层文件描述符与并发连接池扩展
fs.file-max = 2097152
net.core.somaxconn = 65535
net.ipv4.tcp_max_syn_backlog = 16384
net.core.netdev_max_backlog = 16384

# 2. 扩大套接字默认与最大读写缓冲区
# 允许套接字在长肥管道中自适应扩展至最高 32MB / 64MB
net.core.rmem_default = 262144
net.core.wmem_default = 262144
net.core.rmem_max = 67108864
net.core.wmem_max = 67108864

# 3. 优化 TCP 内存滑动窗口范围 (min default max)
# 设定最大接收和发送缓冲区为 32MB (33554432 Bytes)
net.ipv4.tcp_rmem = 4096 87380 33554432
net.ipv4.tcp_wmem = 4096 65536 33554432

# 4. 强制开启 TCP 窗口缩放支持与选择性确认 (SACK)
# 必须开启窗口缩放才能突破 64KB 的传统窗口限制
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_sack = 1
net.ipv4.tcp_dsack = 1

# 5. 降低连接握手延迟与快速连接支持
net.ipv4.tcp_fastopen = 3

# 6. TIME_WAIT 状态优化与快速复用 (杜绝大量高并发短连接耗尽端口)
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 20
net.ipv4.tcp_max_tw_buckets = 262144

# 7. TCP 保活参数微调 (及时清理僵死连接，释放链路资源)
net.ipv4.tcp_keepalive_time = 300
net.ipv4.tcp_keepalive_intvl = 15
net.ipv4.tcp_keepalive_probes = 5

# 8. 路径 MTU 探测 (防范跨国链路中由黑洞路由器导致的连接卡死)
net.ipv4.tcp_mtu_probing = 1
EOF

2. Technical Explanation of Key Parameters#

1. net.ipv4.tcp_rmem and net.ipv4.tcp_wmem the third parameter of: This value sets the hard limit for TCP receive and send buffers. On long transoceanic links above 1Gbps, if it is smaller than the calculated BDP (such as the 18.75MB calculated earlier), the TCP Receive Window will fill too early and force the sender to pause transmission, causing a severe collapse in throughput. Set it to 32MB (33554432) gives the kernel ample room to adjust.
2. net.ipv4.tcp_tw_reuse = 1: Allows the kernel to take connections in TIME_WAIT sockets in that state are reassigned to new secure connections, which is especially effective for high-concurrency HTTP/HTTPS reverse proxies.Note: Do not blindly enable the following deprecated option in modern kernels: net.ipv4.tcp_tw_recycle, this parameter causes many legitimate users' SYN packets to be silently dropped in NAT environments.
3. net.ipv4.tcp_mtu_probing = 1: Cross-border connections traverse many heterogeneous backbone nodes. If some nodes suppress ICMP “Fragmentation Needed” responses, a PMTU blackhole can form: small packets, such as Ping or SSH connection traffic, pass normally, but large transfers such as webpages or file streams stall. With probing enabled, the Linux kernel can progressively reduce and test MTU sizes when fragmentation problems occur, greatly improving the resilience of long-distance data streams.

3. Apply Parameters and Verify Safe Memory Usage#

Apply the parameters:

sudo sysctl --system

[!WARNING] Memory Protection Rules for Low-Memory Instances: The 32MB maximum buffer above is an on-demand limit per socket for concurrent connections, not a fixed physical-memory allocation from startup. However, during highly concurrent attacks or sharp increases in connection counts, many sockets filling their buffers at once can quickly exhaust memory.

If your server has 512MB~1GB of memory, as some entry-level VPS plans do, consider setting tcp_rmem and tcp_wmem conservatively reduce the maximum limit to 16777216（16MB），同时可检查当前系统的 TCP Memory 全局硬限制：

bashCopy Code

sysctl net.ipv4.tcp_mem

This parameter is measured in memory Pages, typically 4KB. Its default is usually initialized automatically by the kernel according to total physical memory, so there is no need to manually fix it in production.

Six. Post-Tuning Validation and Emergency Console Troubleshooting#

After selecting the operating system, confirming credential standards, and tuning kernel network parameters, establishing a clear validation and emergency-access workflow is a basic operations requirement.

1. Quantitatively Validate End-to-End Performance Improvements#

可以 Passed 单线程与多线程的 iperf3 speed tests to see the substantial difference before and after tuning.

Start a listener on the remote test node, then run a transoceanic single-thread test from the configured VPS:

# 模拟单线程真实数据传输
iperf3 -c <远端测试节点IP> -p 5201 -R -t 30

Enabling BBR and increasing socket buffers can typically multiply single-thread bandwidth utilization in high-latency environments with minor packet loss. With unoptimized default Cubic and a conservative 4MB buffer, a single stream often struggles to sustain hundreds of megabits at 150ms transoceanic latency.

2. Console Recovery and Troubleshooting Checklist#

If public SSH access fails after kernel tuning, such as an incorrect critical network setting, or SSH port hardening, follow this recovery procedure carefully:

[故障发生: 外部 SSH 握手超时或拒绝]
           │
           ├─► 运行于 BandwagonHost 架构：
           │     1. 打开 KiwiVM 管理面板，确认主机状态为 Running
           │     2. 点击左侧 "Root shell - interactive" 或 "Interactive Console"
           │     3. 接入虚拟终端，输入 root 密码直接登录系统
           │     4. 审查 /var/log/syslog 或 dmesg，删除异常的 /etc/sysctl.d/ 配置文件
           │     5. 执行 sysctl --system 恢复默认设置
           │
           └─► 运行于 DMIT 架构：
                 1. 打开 DMIT 客户控制台进入该实例管理页
                 2. 点击顶栏 "Console" 建立实时带外终端会话
                 3. 若忘记 root 凭证且未注入有效 SSH Key，可在 "Access" 页面重设密码/更新密钥
                 4. 在面板中对实例执行 "Reboot"（硬重启），使 Access 凭据成功写入
                 5. 回到终端排查网络防火墙或内核报错，恢复系统网络可达性

Choosing an appropriate distribution creates a clean, lightweight server environment. Combined with proper KiwiVM or DMIT management channels, native kernel BBR, and high-BDP network stack tuning, this unlocks the hardware potential of premium network connections and high-performance compute nodes, providing a robust performance foundation for cross-border internet applications.