Server Setup Guide

Quick start

Grab the Linux binary from the downloads section (or wget it directly as below) and drop it in /opt/litmus:

mkdir -p /opt/litmus && cd /opt/litmus
# download the Linux binary from bobpopcorn.com/tools/litmus, then:
wget https://bobpopcorn.com/tools/litmus-x64 -O litmus
chmod +x litmus
./litmus -s                 # interactive 3-pane TUI (server info / connections / chat)
./litmus -s --no-tui        # plain text output (for logging pipelines / no TTY)
./litmus -v                 # verify version

Useful server flags

Firewall

Each test uses the control port plus one data connection per stream on a separate port. Without --port-range, data ports are random ephemerals and inbound rules can't be written for them — so on firewalled hosts always run with a range and open it:

sudo ufw allow 7201/tcp
sudo ufw allow 7201/udp
sudo ufw allow 10000:10100/tcp    # match your --port-range
sudo ufw allow 10000:10100/udp

Kernel tuning (strongly recommended)

Stock Linux uses CUBIC congestion control and 4 MB buffer ceilings. On high-latency or lossy paths (satellite, intercontinental, congested peering) this caps each TCP stream far below the line rate — a 75 ms path with light loss can sit at 30–40 Mbps while the link carries 10× that. BBR + bigger autotuning ceilings fix it:

# BBR is built into kernels >= 4.9
sudo modprobe tcp_bbr
echo tcp_bbr | sudo tee /etc/modules-load.d/bbr.conf

sudo tee /etc/sysctl.d/90-litmus-tcp.conf <<'EOF'
# BBR: rate-based congestion control - tolerant of loss bursts that collapse CUBIC
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr

# Autotuning ceilings: high-bandwidth/high-RTT paths need windows beyond the 4MB stock max
# (300 Mbps @ 200 ms bufferbloated RTT needs ~8 MB in flight)
net.ipv4.tcp_rmem = 4096 131072 67108864
net.ipv4.tcp_wmem = 4096 16384 67108864

# Ceilings for explicitly pinned buffers (Litmus --buffer option); stock cap is ~208 KB
net.core.rmem_max = 67108864
net.core.wmem_max = 67108864
EOF
sudo sysctl --system

# verify
sysctl net.ipv4.tcp_congestion_control net.core.default_qdisc   # expect: bbr / fq

• Congestion control is assigned per-socket at creation — restart a running Litmus server after changing it. Existing SSH sessions keep their old algorithm; that's normal.
• BBR on the server governs download tests (server → client). Upload tests are governed by the client OS.
• Rollback: sudo rm /etc/sysctl.d/90-litmus-tcp.conf && sudo reboot.
• Leave Litmus's --buffer at 0 (OS auto-tuned). Pinning a size disables receive-window auto-tuning and caps each stream at roughly size ÷ RTT.

Run as a systemd service

# /etc/systemd/system/litmus.service
[Unit]
Description=Litmus network test server
After=network-online.target
Wants=network-online.target

[Service]
ExecStart=/opt/litmus/litmus -s --no-tui --port-range 10000-10100 --log /var/log/litmus.log
Restart=on-failure
RestartSec=5
User=litmus
NoNewPrivileges=true
StateDirectory=litmus
Environment=DOTNET_BUNDLE_EXTRACT_BASE_DIR=/var/lib/litmus

[Install]
WantedBy=multi-user.target

sudo useradd -r -s /usr/sbin/nologin litmus
sudo touch /var/log/litmus.log && sudo chown litmus:litmus /var/log/litmus.log
sudo systemctl daemon-reload
sudo systemctl enable --now litmus
systemctl status litmus

Security hardening for public servers

• Use SSH key auth only (PasswordAuthentication no in /etc/ssh/sshd_config) — public test servers attract constant brute-force scanners.
• Firewall UDP 45678 / TCP 45679 (chat/discovery) from the internet.
• Anyone who can reach port 7201 can run tests that saturate your uplink. Restrict source IPs at the firewall if the server isn't meant to be public.

Verifying server-side performance

While a download test runs, on the server:

watch -n1 "ss -ti dst <client-ip>"

Read three things per data connection:

• The congestion algorithm tag — expect bbr after kernel tuning.
• rwnd_limited — a high % means the client's receive window is the ceiling.
• rtt vs minrtt — a large gap under load = bufferbloat on the path.