Skip to content

L
linux
Commit 1cec2cac authored by Mauro Carvalho Chehab's avatar Mauro Carvalho Chehab Committed by David S. Miller
Browse files
Options

docs: networking: convert ip-sysctl.txt to ReST 

- add SPDX header;
- adjust titles and chapters, adding proper markups;
- mark code blocks and literals as such;
- mark lists as such;
- mark tables as such;
- use footnote markup;
- adjust identation, whitespaces and blank lines;
- add to networking/index.rst.
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 355e656e
Hide whitespace changes
Inline Side-by-side
Showing with 560 additions and 284 deletions
Documentation/admin-guide/kernel-parameters.txt
View file @ 1cec2cac
...@@ -4910,7 +4910,7 @@ ...@@ -4910,7 +4910,7 @@
Set the number of tcp_metrics_hash slots. Set the number of tcp_metrics_hash slots.
Default value is 8192 or 16384 depending on total Default value is 8192 or 16384 depending on total
ram pages. This is used to specify the TCP metrics ram pages. This is used to specify the TCP metrics
cache size. See Documentation/networking/ip-sysctl.txt cache size. See Documentation/networking/ip-sysctl.rst
"tcp_no_metrics_save" section for more details. "tcp_no_metrics_save" section for more details.
tdfx= [HW,DRM] tdfx= [HW,DRM]
......
Documentation/admin-guide/sysctl/net.rst
View file @ 1cec2cac
...@@ -353,7 +353,7 @@ socket's buffer. It will not take effect unless PF_UNIX flag is specified. ...@@ -353,7 +353,7 @@ socket's buffer. It will not take effect unless PF_UNIX flag is specified.
3. /proc/sys/net/ipv4 - IPV4 settings 3. /proc/sys/net/ipv4 - IPV4 settings
------------------------------------- -------------------------------------
Please see: Documentation/networking/ip-sysctl.txt and ipvs-sysctl.txt for Please see: Documentation/networking/ip-sysctl.rst and ipvs-sysctl.txt for
descriptions of these entries. descriptions of these entries.
......
Documentation/networking/index.rst
View file @ 1cec2cac
...@@ -69,6 +69,7 @@ Contents: ...@@ -69,6 +69,7 @@ Contents:
ip_dynaddr ip_dynaddr
iphase iphase
ipsec ipsec
ip-sysctl
.. only:: subproject and html .. only:: subproject and html
......
Documentation/networking/ip-sysctl.txt → Documentation/networking/ip-sysctl.rst
View file @ 1cec2cac
/proc/sys/net/ipv4/* Variables: .. SPDX-License-Identifier: GPL-2.0
=========
IP Sysctl
=========
/proc/sys/net/ipv4/* Variables
==============================
ip_forward - BOOLEAN ip_forward - BOOLEAN
0 - disabled (default) - 0 - disabled (default)
not 0 - enabled - not 0 - enabled
Forward Packets between interfaces. Forward Packets between interfaces.
...@@ -38,6 +45,7 @@ ip_no_pmtu_disc - INTEGER ...@@ -38,6 +45,7 @@ ip_no_pmtu_disc - INTEGER
could break other protocols. could break other protocols.
Possible values: 0-3 Possible values: 0-3
Default: FALSE Default: FALSE
min_pmtu - INTEGER min_pmtu - INTEGER
...@@ -51,16 +59,20 @@ ip_forward_use_pmtu - BOOLEAN ...@@ -51,16 +59,20 @@ ip_forward_use_pmtu - BOOLEAN
which tries to discover path mtus by itself and depends on the which tries to discover path mtus by itself and depends on the
kernel honoring this information. This is normally not the kernel honoring this information. This is normally not the
case. case.
Default: 0 (disabled) Default: 0 (disabled)
Possible values: Possible values:
0 - disabled
1 - enabled - 0 - disabled
- 1 - enabled
fwmark_reflect - BOOLEAN fwmark_reflect - BOOLEAN
Controls the fwmark of kernel-generated IPv4 reply packets that are not Controls the fwmark of kernel-generated IPv4 reply packets that are not
associated with a socket for example, TCP RSTs or ICMP echo replies). associated with a socket for example, TCP RSTs or ICMP echo replies).
If unset, these packets have a fwmark of zero. If set, they have the If unset, these packets have a fwmark of zero. If set, they have the
fwmark of the packet they are replying to. fwmark of the packet they are replying to.
Default: 0 Default: 0
fib_multipath_use_neigh - BOOLEAN fib_multipath_use_neigh - BOOLEAN
...@@ -68,63 +80,80 @@ fib_multipath_use_neigh - BOOLEAN ...@@ -68,63 +80,80 @@ fib_multipath_use_neigh - BOOLEAN
multipath routes. If disabled, neighbor information is not used and multipath routes. If disabled, neighbor information is not used and
packets could be directed to a failed nexthop. Only valid for kernels packets could be directed to a failed nexthop. Only valid for kernels
built with CONFIG_IP_ROUTE_MULTIPATH enabled. built with CONFIG_IP_ROUTE_MULTIPATH enabled.
Default: 0 (disabled) Default: 0 (disabled)
Possible values: Possible values:
0 - disabled
1 - enabled - 0 - disabled
- 1 - enabled
fib_multipath_hash_policy - INTEGER fib_multipath_hash_policy - INTEGER
Controls which hash policy to use for multipath routes. Only valid Controls which hash policy to use for multipath routes. Only valid
for kernels built with CONFIG_IP_ROUTE_MULTIPATH enabled. for kernels built with CONFIG_IP_ROUTE_MULTIPATH enabled.
Default: 0 (Layer 3) Default: 0 (Layer 3)
Possible values: Possible values:
0 - Layer 3
1 - Layer 4 - 0 - Layer 3
2 - Layer 3 or inner Layer 3 if present - 1 - Layer 4
- 2 - Layer 3 or inner Layer 3 if present
fib_sync_mem - UNSIGNED INTEGER fib_sync_mem - UNSIGNED INTEGER
Amount of dirty memory from fib entries that can be backlogged before Amount of dirty memory from fib entries that can be backlogged before
synchronize_rcu is forced. synchronize_rcu is forced.
Default: 512kB Minimum: 64kB Maximum: 64MB
Default: 512kB Minimum: 64kB Maximum: 64MB
ip_forward_update_priority - INTEGER ip_forward_update_priority - INTEGER
Whether to update SKB priority from "TOS" field in IPv4 header after it Whether to update SKB priority from "TOS" field in IPv4 header after it
is forwarded. The new SKB priority is mapped from TOS field value is forwarded. The new SKB priority is mapped from TOS field value
according to an rt_tos2priority table (see e.g. man tc-prio). according to an rt_tos2priority table (see e.g. man tc-prio).
Default: 1 (Update priority.) Default: 1 (Update priority.)
Possible values: Possible values:
0 - Do not update priority.
1 - Update priority. - 0 - Do not update priority.
- 1 - Update priority.
route/max_size - INTEGER route/max_size - INTEGER
Maximum number of routes allowed in the kernel. Increase Maximum number of routes allowed in the kernel. Increase
this when using large numbers of interfaces and/or routes. this when using large numbers of interfaces and/or routes.
From linux kernel 3.6 onwards, this is deprecated for ipv4 From linux kernel 3.6 onwards, this is deprecated for ipv4
as route cache is no longer used. as route cache is no longer used.
neigh/default/gc_thresh1 - INTEGER neigh/default/gc_thresh1 - INTEGER
Minimum number of entries to keep. Garbage collector will not Minimum number of entries to keep. Garbage collector will not
purge entries if there are fewer than this number. purge entries if there are fewer than this number.
Default: 128 Default: 128
neigh/default/gc_thresh2 - INTEGER neigh/default/gc_thresh2 - INTEGER
Threshold when garbage collector becomes more aggressive about Threshold when garbage collector becomes more aggressive about
purging entries. Entries older than 5 seconds will be cleared purging entries. Entries older than 5 seconds will be cleared
when over this number. when over this number.
Default: 512 Default: 512
neigh/default/gc_thresh3 - INTEGER neigh/default/gc_thresh3 - INTEGER
Maximum number of non-PERMANENT neighbor entries allowed. Increase Maximum number of non-PERMANENT neighbor entries allowed. Increase
this when using large numbers of interfaces and when communicating this when using large numbers of interfaces and when communicating
with large numbers of directly-connected peers. with large numbers of directly-connected peers.
Default: 1024 Default: 1024
neigh/default/unres_qlen_bytes - INTEGER neigh/default/unres_qlen_bytes - INTEGER
The maximum number of bytes which may be used by packets The maximum number of bytes which may be used by packets
queued for each unresolved address by other network layers. queued for each unresolved address by other network layers.
(added in linux 3.3) (added in linux 3.3)
Setting negative value is meaningless and will return error. Setting negative value is meaningless and will return error.
Default: SK_WMEM_MAX, (same as net.core.wmem_default). Default: SK_WMEM_MAX, (same as net.core.wmem_default).
Exact value depends on architecture and kernel options, Exact value depends on architecture and kernel options,
but should be enough to allow queuing 256 packets but should be enough to allow queuing 256 packets
of medium size. of medium size.
...@@ -132,11 +161,14 @@ neigh/default/unres_qlen_bytes - INTEGER ...@@ -132,11 +161,14 @@ neigh/default/unres_qlen_bytes - INTEGER
neigh/default/unres_qlen - INTEGER neigh/default/unres_qlen - INTEGER
The maximum number of packets which may be queued for each The maximum number of packets which may be queued for each
unresolved address by other network layers. unresolved address by other network layers.
(deprecated in linux 3.3) : use unres_qlen_bytes instead. (deprecated in linux 3.3) : use unres_qlen_bytes instead.
Prior to linux 3.3, the default value is 3 which may cause Prior to linux 3.3, the default value is 3 which may cause
unexpected packet loss. The current default value is calculated unexpected packet loss. The current default value is calculated
according to default value of unres_qlen_bytes and true size of according to default value of unres_qlen_bytes and true size of
packet. packet.
Default: 101 Default: 101
mtu_expires - INTEGER mtu_expires - INTEGER
...@@ -183,7 +215,8 @@ ipfrag_max_dist - INTEGER ...@@ -183,7 +215,8 @@ ipfrag_max_dist - INTEGER
from different IP datagrams, which could result in data corruption. from different IP datagrams, which could result in data corruption.
Default: 64 Default: 64
INET peer storage: INET peer storage
=================
inet_peer_threshold - INTEGER inet_peer_threshold - INTEGER
The approximate size of the storage. Starting from this threshold The approximate size of the storage. Starting from this threshold
...@@ -203,7 +236,8 @@ inet_peer_maxttl - INTEGER ...@@ -203,7 +236,8 @@ inet_peer_maxttl - INTEGER
when the number of entries in the pool is very small). when the number of entries in the pool is very small).
Measured in seconds. Measured in seconds.
TCP variables: TCP variables
=============
somaxconn - INTEGER somaxconn - INTEGER
Limit of socket listen() backlog, known in userspace as SOMAXCONN. Limit of socket listen() backlog, known in userspace as SOMAXCONN.
...@@ -222,18 +256,22 @@ tcp_adv_win_scale - INTEGER ...@@ -222,18 +256,22 @@ tcp_adv_win_scale - INTEGER
Count buffering overhead as bytes/2^tcp_adv_win_scale Count buffering overhead as bytes/2^tcp_adv_win_scale
(if tcp_adv_win_scale > 0) or bytes-bytes/2^(-tcp_adv_win_scale), (if tcp_adv_win_scale > 0) or bytes-bytes/2^(-tcp_adv_win_scale),
if it is <= 0. if it is <= 0.
Possible values are [-31, 31], inclusive. Possible values are [-31, 31], inclusive.
Default: 1 Default: 1
tcp_allowed_congestion_control - STRING tcp_allowed_congestion_control - STRING
Show/set the congestion control choices available to non-privileged Show/set the congestion control choices available to non-privileged
processes. The list is a subset of those listed in processes. The list is a subset of those listed in
tcp_available_congestion_control. tcp_available_congestion_control.
Default is "reno" and the default setting (tcp_congestion_control). Default is "reno" and the default setting (tcp_congestion_control).
tcp_app_win - INTEGER tcp_app_win - INTEGER
Reserve max(window/2^tcp_app_win, mss) of window for application Reserve max(window/2^tcp_app_win, mss) of window for application
buffer. Value 0 is special, it means that nothing is reserved. buffer. Value 0 is special, it means that nothing is reserved.
Default: 31 Default: 31
tcp_autocorking - BOOLEAN tcp_autocorking - BOOLEAN
...@@ -244,6 +282,7 @@ tcp_autocorking - BOOLEAN ...@@ -244,6 +282,7 @@ tcp_autocorking - BOOLEAN
packet for the flow is waiting in Qdisc queues or device transmit packet for the flow is waiting in Qdisc queues or device transmit
queue. Applications can still use TCP_CORK for optimal behavior queue. Applications can still use TCP_CORK for optimal behavior
when they know how/when to uncork their sockets. when they know how/when to uncork their sockets.
Default : 1 Default : 1
tcp_available_congestion_control - STRING tcp_available_congestion_control - STRING
...@@ -265,6 +304,7 @@ tcp_mtu_probe_floor - INTEGER ...@@ -265,6 +304,7 @@ tcp_mtu_probe_floor - INTEGER
tcp_min_snd_mss - INTEGER tcp_min_snd_mss - INTEGER
TCP SYN and SYNACK messages usually advertise an ADVMSS option, TCP SYN and SYNACK messages usually advertise an ADVMSS option,
as described in RFC 1122 and RFC 6691. as described in RFC 1122 and RFC 6691.
If this ADVMSS option is smaller than tcp_min_snd_mss, If this ADVMSS option is smaller than tcp_min_snd_mss,
it is silently capped to tcp_min_snd_mss. it is silently capped to tcp_min_snd_mss.
...@@ -277,6 +317,7 @@ tcp_congestion_control - STRING ...@@ -277,6 +317,7 @@ tcp_congestion_control - STRING
Default is set as part of kernel configuration. Default is set as part of kernel configuration.
For passive connections, the listener congestion control choice For passive connections, the listener congestion control choice
is inherited. is inherited.
[see setsockopt(listenfd, SOL_TCP, TCP_CONGESTION, "name" ...) ] [see setsockopt(listenfd, SOL_TCP, TCP_CONGESTION, "name" ...) ]
tcp_dsack - BOOLEAN tcp_dsack - BOOLEAN
...@@ -286,9 +327,12 @@ tcp_early_retrans - INTEGER ...@@ -286,9 +327,12 @@ tcp_early_retrans - INTEGER
Tail loss probe (TLP) converts RTOs occurring due to tail Tail loss probe (TLP) converts RTOs occurring due to tail
losses into fast recovery (draft-ietf-tcpm-rack). Note that losses into fast recovery (draft-ietf-tcpm-rack). Note that
TLP requires RACK to function properly (see tcp_recovery below) TLP requires RACK to function properly (see tcp_recovery below)
Possible values: Possible values:
0 disables TLP
3 or 4 enables TLP - 0 disables TLP
- 3 or 4 enables TLP
Default: 3 Default: 3
tcp_ecn - INTEGER tcp_ecn - INTEGER
...@@ -297,12 +341,17 @@ tcp_ecn - INTEGER ...@@ -297,12 +341,17 @@ tcp_ecn - INTEGER
support for it. This feature is useful in avoiding losses due support for it. This feature is useful in avoiding losses due
to congestion by allowing supporting routers to signal to congestion by allowing supporting routers to signal
congestion before having to drop packets. congestion before having to drop packets.
Possible values are: Possible values are:
0 Disable ECN. Neither initiate nor accept ECN.
1 Enable ECN when requested by incoming connections and = =====================================================
also request ECN on outgoing connection attempts. 0 Disable ECN. Neither initiate nor accept ECN.
2 Enable ECN when requested by incoming connections 1 Enable ECN when requested by incoming connections and
but do not request ECN on outgoing connections. also request ECN on outgoing connection attempts.
2 Enable ECN when requested by incoming connections
but do not request ECN on outgoing connections.
= =====================================================
Default: 2 Default: 2
tcp_ecn_fallback - BOOLEAN tcp_ecn_fallback - BOOLEAN
...@@ -312,6 +361,7 @@ tcp_ecn_fallback - BOOLEAN ...@@ -312,6 +361,7 @@ tcp_ecn_fallback - BOOLEAN
additional detection mechanisms could be implemented under this additional detection mechanisms could be implemented under this
knob. The value is not used, if tcp_ecn or per route (or congestion knob. The value is not used, if tcp_ecn or per route (or congestion
control) ECN settings are disabled. control) ECN settings are disabled.
Default: 1 (fallback enabled) Default: 1 (fallback enabled)
tcp_fack - BOOLEAN tcp_fack - BOOLEAN
...@@ -324,7 +374,9 @@ tcp_fin_timeout - INTEGER ...@@ -324,7 +374,9 @@ tcp_fin_timeout - INTEGER
valid "receive only" state for an un-orphaned connection, an valid "receive only" state for an un-orphaned connection, an
orphaned connection in FIN_WAIT_2 state could otherwise wait orphaned connection in FIN_WAIT_2 state could otherwise wait
forever for the remote to close its end of the connection. forever for the remote to close its end of the connection.
Cf. tcp_max_orphans Cf. tcp_max_orphans
Default: 60 seconds Default: 60 seconds
tcp_frto - INTEGER tcp_frto - INTEGER
...@@ -390,7 +442,8 @@ tcp_l3mdev_accept - BOOLEAN ...@@ -390,7 +442,8 @@ tcp_l3mdev_accept - BOOLEAN
derived from the listen socket to be bound to the L3 domain in derived from the listen socket to be bound to the L3 domain in
which the packets originated. Only valid when the kernel was which the packets originated. Only valid when the kernel was
compiled with CONFIG_NET_L3_MASTER_DEV. compiled with CONFIG_NET_L3_MASTER_DEV.
Default: 0 (disabled)
Default: 0 (disabled)
tcp_low_latency - BOOLEAN tcp_low_latency - BOOLEAN
This is a legacy option, it has no effect anymore. This is a legacy option, it has no effect anymore.
...@@ -410,10 +463,14 @@ tcp_max_orphans - INTEGER ...@@ -410,10 +463,14 @@ tcp_max_orphans - INTEGER
tcp_max_syn_backlog - INTEGER tcp_max_syn_backlog - INTEGER
Maximal number of remembered connection requests (SYN_RECV), Maximal number of remembered connection requests (SYN_RECV),
which have not received an acknowledgment from connecting client. which have not received an acknowledgment from connecting client.
This is a per-listener limit. This is a per-listener limit.
The minimal value is 128 for low memory machines, and it will The minimal value is 128 for low memory machines, and it will
increase in proportion to the memory of machine. increase in proportion to the memory of machine.
If server suffers from overload, try increasing this number. If server suffers from overload, try increasing this number.
Remember to also check /proc/sys/net/core/somaxconn Remember to also check /proc/sys/net/core/somaxconn
A SYN_RECV request socket consumes about 304 bytes of memory. A SYN_RECV request socket consumes about 304 bytes of memory.
...@@ -445,7 +502,9 @@ tcp_min_rtt_wlen - INTEGER ...@@ -445,7 +502,9 @@ tcp_min_rtt_wlen - INTEGER
minimum RTT when it is moved to a longer path (e.g., due to traffic minimum RTT when it is moved to a longer path (e.g., due to traffic
engineering). A longer window makes the filter more resistant to RTT engineering). A longer window makes the filter more resistant to RTT
inflations such as transient congestion. The unit is seconds. inflations such as transient congestion. The unit is seconds.
Possible values: 0 - 86400 (1 day) Possible values: 0 - 86400 (1 day)
Default: 300 Default: 300
tcp_moderate_rcvbuf - BOOLEAN tcp_moderate_rcvbuf - BOOLEAN
...@@ -457,9 +516,10 @@ tcp_moderate_rcvbuf - BOOLEAN ...@@ -457,9 +516,10 @@ tcp_moderate_rcvbuf - BOOLEAN
tcp_mtu_probing - INTEGER tcp_mtu_probing - INTEGER
Controls TCP Packetization-Layer Path MTU Discovery. Takes three Controls TCP Packetization-Layer Path MTU Discovery. Takes three
values: values:
0 - Disabled
1 - Disabled by default, enabled when an ICMP black hole detected - 0 - Disabled
2 - Always enabled, use initial MSS of tcp_base_mss. - 1 - Disabled by default, enabled when an ICMP black hole detected
- 2 - Always enabled, use initial MSS of tcp_base_mss.
tcp_probe_interval - UNSIGNED INTEGER tcp_probe_interval - UNSIGNED INTEGER
Controls how often to start TCP Packetization-Layer Path MTU Controls how often to start TCP Packetization-Layer Path MTU
...@@ -481,6 +541,7 @@ tcp_no_metrics_save - BOOLEAN ...@@ -481,6 +541,7 @@ tcp_no_metrics_save - BOOLEAN
tcp_no_ssthresh_metrics_save - BOOLEAN tcp_no_ssthresh_metrics_save - BOOLEAN
Controls whether TCP saves ssthresh metrics in the route cache. Controls whether TCP saves ssthresh metrics in the route cache.
Default is 1, which disables ssthresh metrics. Default is 1, which disables ssthresh metrics.
tcp_orphan_retries - INTEGER tcp_orphan_retries - INTEGER
...@@ -489,6 +550,7 @@ tcp_orphan_retries - INTEGER ...@@ -489,6 +550,7 @@ tcp_orphan_retries - INTEGER
See tcp_retries2 for more details. See tcp_retries2 for more details.
The default value is 8. The default value is 8.
If your machine is a loaded WEB server, If your machine is a loaded WEB server,
you should think about lowering this value, such sockets you should think about lowering this value, such sockets
may consume significant resources. Cf. tcp_max_orphans. may consume significant resources. Cf. tcp_max_orphans.
...@@ -497,11 +559,15 @@ tcp_recovery - INTEGER ...@@ -497,11 +559,15 @@ tcp_recovery - INTEGER
This value is a bitmap to enable various experimental loss recovery This value is a bitmap to enable various experimental loss recovery
features. features.
RACK: 0x1 enables the RACK loss detection for fast detection of lost ========= =============================================================
retransmissions and tail drops. It also subsumes and disables RACK: 0x1 enables the RACK loss detection for fast detection of lost
RFC6675 recovery for SACK connections. retransmissions and tail drops. It also subsumes and disables
RACK: 0x2 makes RACK's reordering window static (min_rtt/4). RFC6675 recovery for SACK connections.
RACK: 0x4 disables RACK's DUPACK threshold heuristic
RACK: 0x2 makes RACK's reordering window static (min_rtt/4).
RACK: 0x4 disables RACK's DUPACK threshold heuristic
========= =============================================================
Default: 0x1 Default: 0x1
...@@ -509,12 +575,14 @@ tcp_reordering - INTEGER ...@@ -509,12 +575,14 @@ tcp_reordering - INTEGER
Initial reordering level of packets in a TCP stream. Initial reordering level of packets in a TCP stream.
TCP stack can then dynamically adjust flow reordering level TCP stack can then dynamically adjust flow reordering level
between this initial value and tcp_max_reordering between this initial value and tcp_max_reordering
Default: 3 Default: 3
tcp_max_reordering - INTEGER tcp_max_reordering - INTEGER
Maximal reordering level of packets in a TCP stream. Maximal reordering level of packets in a TCP stream.
300 is a fairly conservative value, but you might increase it 300 is a fairly conservative value, but you might increase it
if paths are using per packet load balancing (like bonding rr mode) if paths are using per packet load balancing (like bonding rr mode)
Default: 300 Default: 300
tcp_retrans_collapse - BOOLEAN tcp_retrans_collapse - BOOLEAN
...@@ -550,12 +618,14 @@ tcp_rfc1337 - BOOLEAN ...@@ -550,12 +618,14 @@ tcp_rfc1337 - BOOLEAN
If set, the TCP stack behaves conforming to RFC1337. If unset, If set, the TCP stack behaves conforming to RFC1337. If unset,
we are not conforming to RFC, but prevent TCP TIME_WAIT we are not conforming to RFC, but prevent TCP TIME_WAIT
assassination. assassination.
Default: 0 Default: 0
tcp_rmem - vector of 3 INTEGERs: min, default, max tcp_rmem - vector of 3 INTEGERs: min, default, max
min: Minimal size of receive buffer used by TCP sockets. min: Minimal size of receive buffer used by TCP sockets.
It is guaranteed to each TCP socket, even under moderate memory It is guaranteed to each TCP socket, even under moderate memory
pressure. pressure.
Default: 4K Default: 4K
default: initial size of receive buffer used by TCP sockets. default: initial size of receive buffer used by TCP sockets.
...@@ -592,12 +662,14 @@ tcp_slow_start_after_idle - BOOLEAN ...@@ -592,12 +662,14 @@ tcp_slow_start_after_idle - BOOLEAN
window after an idle period. An idle period is defined at window after an idle period. An idle period is defined at
the current RTO. If unset, the congestion window will not the current RTO. If unset, the congestion window will not
be timed out after an idle period. be timed out after an idle period.
Default: 1 Default: 1
tcp_stdurg - BOOLEAN tcp_stdurg - BOOLEAN
Use the Host requirements interpretation of the TCP urgent pointer field. Use the Host requirements interpretation of the TCP urgent pointer field.
Most hosts use the older BSD interpretation, so if you turn this on Most hosts use the older BSD interpretation, so if you turn this on
Linux might not communicate correctly with them. Linux might not communicate correctly with them.
Default: FALSE Default: FALSE
tcp_synack_retries - INTEGER tcp_synack_retries - INTEGER
...@@ -646,15 +718,18 @@ tcp_fastopen - INTEGER ...@@ -646,15 +718,18 @@ tcp_fastopen - INTEGER
the option value being the length of the syn-data backlog. the option value being the length of the syn-data backlog.
The values (bitmap) are The values (bitmap) are
0x1: (client) enables sending data in the opening SYN on the client.
0x2: (server) enables the server support, i.e., allowing data in ===== ======== ======================================================
0x1 (client) enables sending data in the opening SYN on the client.
0x2 (server) enables the server support, i.e., allowing data in
a SYN packet to be accepted and passed to the a SYN packet to be accepted and passed to the
application before 3-way handshake finishes. application before 3-way handshake finishes.
0x4: (client) send data in the opening SYN regardless of cookie 0x4 (client) send data in the opening SYN regardless of cookie
availability and without a cookie option. availability and without a cookie option.
0x200: (server) accept data-in-SYN w/o any cookie option present. 0x200 (server) accept data-in-SYN w/o any cookie option present.
0x400: (server) enable all listeners to support Fast Open by 0x400 (server) enable all listeners to support Fast Open by
default without explicit TCP_FASTOPEN socket option. default without explicit TCP_FASTOPEN socket option.
===== ======== ======================================================
Default: 0x1 Default: 0x1
...@@ -668,6 +743,7 @@ tcp_fastopen_blackhole_timeout_sec - INTEGER ...@@ -668,6 +743,7 @@ tcp_fastopen_blackhole_timeout_sec - INTEGER
get detected right after Fastopen is re-enabled and will reset to get detected right after Fastopen is re-enabled and will reset to
initial value when the blackhole issue goes away. initial value when the blackhole issue goes away.
0 to disable the blackhole detection. 0 to disable the blackhole detection.
By default, it is set to 1hr. By default, it is set to 1hr.
tcp_fastopen_key - list of comma separated 32-digit hexadecimal INTEGERs tcp_fastopen_key - list of comma separated 32-digit hexadecimal INTEGERs
...@@ -698,20 +774,24 @@ tcp_syn_retries - INTEGER ...@@ -698,20 +774,24 @@ tcp_syn_retries - INTEGER
for an active TCP connection attempt will happen after 127seconds. for an active TCP connection attempt will happen after 127seconds.
tcp_timestamps - INTEGER tcp_timestamps - INTEGER
Enable timestamps as defined in RFC1323. Enable timestamps as defined in RFC1323.
0: Disabled.
1: Enable timestamps as defined in RFC1323 and use random offset for - 0: Disabled.
each connection rather than only using the current time. - 1: Enable timestamps as defined in RFC1323 and use random offset for
2: Like 1, but without random offsets. each connection rather than only using the current time.
- 2: Like 1, but without random offsets.
Default: 1 Default: 1
tcp_min_tso_segs - INTEGER tcp_min_tso_segs - INTEGER
Minimal number of segments per TSO frame. Minimal number of segments per TSO frame.
Since linux-3.12, TCP does an automatic sizing of TSO frames, Since linux-3.12, TCP does an automatic sizing of TSO frames,
depending on flow rate, instead of filling 64Kbytes packets. depending on flow rate, instead of filling 64Kbytes packets.
For specific usages, it's possible to force TCP to build big For specific usages, it's possible to force TCP to build big
TSO frames. Note that TCP stack might split too big TSO packets TSO frames. Note that TCP stack might split too big TSO packets
if available window is too small. if available window is too small.
Default: 2 Default: 2
tcp_pacing_ss_ratio - INTEGER tcp_pacing_ss_ratio - INTEGER
...@@ -720,6 +800,7 @@ tcp_pacing_ss_ratio - INTEGER ...@@ -720,6 +800,7 @@ tcp_pacing_ss_ratio - INTEGER
If TCP is in slow start, tcp_pacing_ss_ratio is applied If TCP is in slow start, tcp_pacing_ss_ratio is applied
to let TCP probe for bigger speeds, assuming cwnd can be to let TCP probe for bigger speeds, assuming cwnd can be
doubled every other RTT. doubled every other RTT.
Default: 200 Default: 200
tcp_pacing_ca_ratio - INTEGER tcp_pacing_ca_ratio - INTEGER
...@@ -727,6 +808,7 @@ tcp_pacing_ca_ratio - INTEGER ...@@ -727,6 +808,7 @@ tcp_pacing_ca_ratio - INTEGER
to current rate. (current_rate = cwnd * mss / srtt) to current rate. (current_rate = cwnd * mss / srtt)
If TCP is in congestion avoidance phase, tcp_pacing_ca_ratio If TCP is in congestion avoidance phase, tcp_pacing_ca_ratio
is applied to conservatively probe for bigger throughput. is applied to conservatively probe for bigger throughput.
Default: 120 Default: 120
tcp_tso_win_divisor - INTEGER tcp_tso_win_divisor - INTEGER
...@@ -734,16 +816,20 @@ tcp_tso_win_divisor - INTEGER ...@@ -734,16 +816,20 @@ tcp_tso_win_divisor - INTEGER
can be consumed by a single TSO frame. can be consumed by a single TSO frame.
The setting of this parameter is a choice between burstiness and The setting of this parameter is a choice between burstiness and
building larger TSO frames. building larger TSO frames.
Default: 3 Default: 3
tcp_tw_reuse - INTEGER tcp_tw_reuse - INTEGER
Enable reuse of TIME-WAIT sockets for new connections when it is Enable reuse of TIME-WAIT sockets for new connections when it is
safe from protocol viewpoint. safe from protocol viewpoint.
0 - disable
1 - global enable - 0 - disable
2 - enable for loopback traffic only - 1 - global enable
- 2 - enable for loopback traffic only
It should not be changed without advice/request of technical It should not be changed without advice/request of technical
experts. experts.
Default: 2 Default: 2
tcp_window_scaling - BOOLEAN tcp_window_scaling - BOOLEAN
...@@ -752,11 +838,14 @@ tcp_window_scaling - BOOLEAN ...@@ -752,11 +838,14 @@ tcp_window_scaling - BOOLEAN
tcp_wmem - vector of 3 INTEGERs: min, default, max tcp_wmem - vector of 3 INTEGERs: min, default, max
min: Amount of memory reserved for send buffers for TCP sockets. min: Amount of memory reserved for send buffers for TCP sockets.
Each TCP socket has rights to use it due to fact of its birth. Each TCP socket has rights to use it due to fact of its birth.
Default: 4K Default: 4K
default: initial size of send buffer used by TCP sockets. This default: initial size of send buffer used by TCP sockets. This
value overrides net.core.wmem_default used by other protocols. value overrides net.core.wmem_default used by other protocols.
It is usually lower than net.core.wmem_default. It is usually lower than net.core.wmem_default.
Default: 16K Default: 16K
max: Maximal amount of memory allowed for automatically tuned max: Maximal amount of memory allowed for automatically tuned
...@@ -764,6 +853,7 @@ tcp_wmem - vector of 3 INTEGERs: min, default, max ...@@ -764,6 +853,7 @@ tcp_wmem - vector of 3 INTEGERs: min, default, max
net.core.wmem_max. Calling setsockopt() with SO_SNDBUF disables net.core.wmem_max. Calling setsockopt() with SO_SNDBUF disables
automatic tuning of that socket's send buffer size, in which case automatic tuning of that socket's send buffer size, in which case
this value is ignored. this value is ignored.
Default: between 64K and 4MB, depending on RAM size. Default: between 64K and 4MB, depending on RAM size.
tcp_notsent_lowat - UNSIGNED INTEGER tcp_notsent_lowat - UNSIGNED INTEGER
...@@ -784,6 +874,7 @@ tcp_workaround_signed_windows - BOOLEAN ...@@ -784,6 +874,7 @@ tcp_workaround_signed_windows - BOOLEAN
remote TCP is broken and treats the window as a signed quantity. remote TCP is broken and treats the window as a signed quantity.
If unset, assume the remote TCP is not broken even if we do If unset, assume the remote TCP is not broken even if we do
not receive a window scaling option from them. not receive a window scaling option from them.
Default: 0 Default: 0
tcp_thin_linear_timeouts - BOOLEAN tcp_thin_linear_timeouts - BOOLEAN
...@@ -796,6 +887,7 @@ tcp_thin_linear_timeouts - BOOLEAN ...@@ -796,6 +887,7 @@ tcp_thin_linear_timeouts - BOOLEAN
non-aggressive thin streams, often found to be time-dependent. non-aggressive thin streams, often found to be time-dependent.
For more information on thin streams, see For more information on thin streams, see
Documentation/networking/tcp-thin.txt Documentation/networking/tcp-thin.txt
Default: 0 Default: 0
tcp_limit_output_bytes - INTEGER tcp_limit_output_bytes - INTEGER
...@@ -807,6 +899,7 @@ tcp_limit_output_bytes - INTEGER ...@@ -807,6 +899,7 @@ tcp_limit_output_bytes - INTEGER
flows, for typical pfifo_fast qdiscs. tcp_limit_output_bytes flows, for typical pfifo_fast qdiscs. tcp_limit_output_bytes
limits the number of bytes on qdisc or device to reduce artificial limits the number of bytes on qdisc or device to reduce artificial
RTT/cwnd and reduce bufferbloat. RTT/cwnd and reduce bufferbloat.
Default: 1048576 (16 * 65536) Default: 1048576 (16 * 65536)
tcp_challenge_ack_limit - INTEGER tcp_challenge_ack_limit - INTEGER
...@@ -822,7 +915,8 @@ tcp_rx_skb_cache - BOOLEAN ...@@ -822,7 +915,8 @@ tcp_rx_skb_cache - BOOLEAN
Default: 0 (disabled) Default: 0 (disabled)
UDP variables: UDP variables
=============
udp_l3mdev_accept - BOOLEAN udp_l3mdev_accept - BOOLEAN
Enabling this option allows a "global" bound socket to work Enabling this option allows a "global" bound socket to work
...@@ -830,7 +924,8 @@ udp_l3mdev_accept - BOOLEAN ...@@ -830,7 +924,8 @@ udp_l3mdev_accept - BOOLEAN
being received regardless of the L3 domain in which they being received regardless of the L3 domain in which they
originated. Only valid when the kernel was compiled with originated. Only valid when the kernel was compiled with
CONFIG_NET_L3_MASTER_DEV. CONFIG_NET_L3_MASTER_DEV.
Default: 0 (disabled)
Default: 0 (disabled)
udp_mem - vector of 3 INTEGERs: min, pressure, max udp_mem - vector of 3 INTEGERs: min, pressure, max
Number of pages allowed for queueing by all UDP sockets. Number of pages allowed for queueing by all UDP sockets.
...@@ -849,15 +944,18 @@ udp_rmem_min - INTEGER ...@@ -849,15 +944,18 @@ udp_rmem_min - INTEGER
Minimal size of receive buffer used by UDP sockets in moderation. Minimal size of receive buffer used by UDP sockets in moderation.
Each UDP socket is able to use the size for receiving data, even if Each UDP socket is able to use the size for receiving data, even if
total pages of UDP sockets exceed udp_mem pressure. The unit is byte. total pages of UDP sockets exceed udp_mem pressure. The unit is byte.
Default: 4K Default: 4K
udp_wmem_min - INTEGER udp_wmem_min - INTEGER
Minimal size of send buffer used by UDP sockets in moderation. Minimal size of send buffer used by UDP sockets in moderation.
Each UDP socket is able to use the size for sending data, even if Each UDP socket is able to use the size for sending data, even if
total pages of UDP sockets exceed udp_mem pressure. The unit is byte. total pages of UDP sockets exceed udp_mem pressure. The unit is byte.
Default: 4K Default: 4K
RAW variables: RAW variables
=============
raw_l3mdev_accept - BOOLEAN raw_l3mdev_accept - BOOLEAN
Enabling this option allows a "global" bound socket to work Enabling this option allows a "global" bound socket to work
...@@ -865,9 +963,11 @@ raw_l3mdev_accept - BOOLEAN ...@@ -865,9 +963,11 @@ raw_l3mdev_accept - BOOLEAN
being received regardless of the L3 domain in which they being received regardless of the L3 domain in which they
originated. Only valid when the kernel was compiled with originated. Only valid when the kernel was compiled with
CONFIG_NET_L3_MASTER_DEV. CONFIG_NET_L3_MASTER_DEV.
Default: 1 (enabled) Default: 1 (enabled)
CIPSOv4 Variables: CIPSOv4 Variables
=================
cipso_cache_enable - BOOLEAN cipso_cache_enable - BOOLEAN
If set, enable additions to and lookups from the CIPSO label mapping If set, enable additions to and lookups from the CIPSO label mapping
...@@ -875,6 +975,7 @@ cipso_cache_enable - BOOLEAN ...@@ -875,6 +975,7 @@ cipso_cache_enable - BOOLEAN
miss. However, regardless of the setting the cache is still miss. However, regardless of the setting the cache is still
invalidated when required when means you can safely toggle this on and invalidated when required when means you can safely toggle this on and
off and the cache will always be "safe". off and the cache will always be "safe".
Default: 1 Default: 1
cipso_cache_bucket_size - INTEGER cipso_cache_bucket_size - INTEGER
...@@ -884,6 +985,7 @@ cipso_cache_bucket_size - INTEGER ...@@ -884,6 +985,7 @@ cipso_cache_bucket_size - INTEGER
more CIPSO label mappings that can be cached. When the number of more CIPSO label mappings that can be cached. When the number of
entries in a given hash bucket reaches this limit adding new entries entries in a given hash bucket reaches this limit adding new entries
causes the oldest entry in the bucket to be removed to make room. causes the oldest entry in the bucket to be removed to make room.
Default: 10 Default: 10
cipso_rbm_optfmt - BOOLEAN cipso_rbm_optfmt - BOOLEAN
...@@ -891,6 +993,7 @@ cipso_rbm_optfmt - BOOLEAN ...@@ -891,6 +993,7 @@ cipso_rbm_optfmt - BOOLEAN
the CIPSO draft specification (see Documentation/netlabel for details). the CIPSO draft specification (see Documentation/netlabel for details).
This means that when set the CIPSO tag will be padded with empty This means that when set the CIPSO tag will be padded with empty
categories in order to make the packet data 32-bit aligned. categories in order to make the packet data 32-bit aligned.
Default: 0 Default: 0
cipso_rbm_structvalid - BOOLEAN cipso_rbm_structvalid - BOOLEAN
...@@ -900,9 +1003,11 @@ cipso_rbm_structvalid - BOOLEAN ...@@ -900,9 +1003,11 @@ cipso_rbm_structvalid - BOOLEAN
where in the CIPSO processing code but setting this to 0 (False) should where in the CIPSO processing code but setting this to 0 (False) should
result in less work (i.e. it should be faster) but could cause problems result in less work (i.e. it should be faster) but could cause problems
with other implementations that require strict checking. with other implementations that require strict checking.
Default: 0 Default: 0
IP Variables: IP Variables
============
ip_local_port_range - 2 INTEGERS ip_local_port_range - 2 INTEGERS
Defines the local port range that is used by TCP and UDP to Defines the local port range that is used by TCP and UDP to
...@@ -931,12 +1036,12 @@ ip_local_reserved_ports - list of comma separated ranges ...@@ -931,12 +1036,12 @@ ip_local_reserved_ports - list of comma separated ranges
assignments. assignments.
You can reserve ports which are not in the current You can reserve ports which are not in the current
ip_local_port_range, e.g.: ip_local_port_range, e.g.::
$ cat /proc/sys/net/ipv4/ip_local_port_range $ cat /proc/sys/net/ipv4/ip_local_port_range
32000 60999 32000 60999
$ cat /proc/sys/net/ipv4/ip_local_reserved_ports $ cat /proc/sys/net/ipv4/ip_local_reserved_ports
8080,9148 8080,9148
although this is redundant. However such a setting is useful although this is redundant. However such a setting is useful
if later the port range is changed to a value that will if later the port range is changed to a value that will
...@@ -956,6 +1061,7 @@ ip_unprivileged_port_start - INTEGER ...@@ -956,6 +1061,7 @@ ip_unprivileged_port_start - INTEGER
ip_nonlocal_bind - BOOLEAN ip_nonlocal_bind - BOOLEAN
If set, allows processes to bind() to non-local IP addresses, If set, allows processes to bind() to non-local IP addresses,
which can be quite useful - but may break some applications. which can be quite useful - but may break some applications.
Default: 0 Default: 0
ip_autobind_reuse - BOOLEAN ip_autobind_reuse - BOOLEAN
...@@ -972,6 +1078,7 @@ ip_dynaddr - BOOLEAN ...@@ -972,6 +1078,7 @@ ip_dynaddr - BOOLEAN
If set to a non-zero value larger than 1, a kernel log If set to a non-zero value larger than 1, a kernel log
message will be printed when dynamic address rewriting message will be printed when dynamic address rewriting
occurs. occurs.
Default: 0 Default: 0
ip_early_demux - BOOLEAN ip_early_demux - BOOLEAN
...@@ -981,6 +1088,7 @@ ip_early_demux - BOOLEAN ...@@ -981,6 +1088,7 @@ ip_early_demux - BOOLEAN
It may add an additional cost for pure routing workloads that It may add an additional cost for pure routing workloads that
reduces overall throughput, in such case you should disable it. reduces overall throughput, in such case you should disable it.
Default: 1 Default: 1
ping_group_range - 2 INTEGERS ping_group_range - 2 INTEGERS
...@@ -992,21 +1100,25 @@ ping_group_range - 2 INTEGERS ...@@ -992,21 +1100,25 @@ ping_group_range - 2 INTEGERS
tcp_early_demux - BOOLEAN tcp_early_demux - BOOLEAN
Enable early demux for established TCP sockets. Enable early demux for established TCP sockets.
Default: 1 Default: 1
udp_early_demux - BOOLEAN udp_early_demux - BOOLEAN
Enable early demux for connected UDP sockets. Disable this if Enable early demux for connected UDP sockets. Disable this if
your system could experience more unconnected load. your system could experience more unconnected load.
Default: 1 Default: 1
icmp_echo_ignore_all - BOOLEAN icmp_echo_ignore_all - BOOLEAN
If set non-zero, then the kernel will ignore all ICMP ECHO If set non-zero, then the kernel will ignore all ICMP ECHO
requests sent to it. requests sent to it.
Default: 0 Default: 0
icmp_echo_ignore_broadcasts - BOOLEAN icmp_echo_ignore_broadcasts - BOOLEAN
If set non-zero, then the kernel will ignore all ICMP ECHO and If set non-zero, then the kernel will ignore all ICMP ECHO and
TIMESTAMP requests sent to it via broadcast/multicast. TIMESTAMP requests sent to it via broadcast/multicast.
Default: 1 Default: 1
icmp_ratelimit - INTEGER icmp_ratelimit - INTEGER
...@@ -1016,46 +1128,55 @@ icmp_ratelimit - INTEGER ...@@ -1016,46 +1128,55 @@ icmp_ratelimit - INTEGER
otherwise the minimal space between responses in milliseconds. otherwise the minimal space between responses in milliseconds.
Note that another sysctl, icmp_msgs_per_sec limits the number Note that another sysctl, icmp_msgs_per_sec limits the number
of ICMP packets sent on all targets. of ICMP packets sent on all targets.
Default: 1000 Default: 1000
icmp_msgs_per_sec - INTEGER icmp_msgs_per_sec - INTEGER
Limit maximal number of ICMP packets sent per second from this host. Limit maximal number of ICMP packets sent per second from this host.
Only messages whose type matches icmp_ratemask (see below) are Only messages whose type matches icmp_ratemask (see below) are
controlled by this limit. controlled by this limit.
Default: 1000 Default: 1000
icmp_msgs_burst - INTEGER icmp_msgs_burst - INTEGER
icmp_msgs_per_sec controls number of ICMP packets sent per second, icmp_msgs_per_sec controls number of ICMP packets sent per second,
while icmp_msgs_burst controls the burst size of these packets. while icmp_msgs_burst controls the burst size of these packets.
Default: 50 Default: 50
icmp_ratemask - INTEGER icmp_ratemask - INTEGER
Mask made of ICMP types for which rates are being limited. Mask made of ICMP types for which rates are being limited.
Significant bits: IHGFEDCBA9876543210 Significant bits: IHGFEDCBA9876543210
Default mask: 0000001100000011000 (6168) Default mask: 0000001100000011000 (6168)
Bit definitions (see include/linux/icmp.h): Bit definitions (see include/linux/icmp.h):
= =========================
0 Echo Reply 0 Echo Reply
3 Destination Unreachable * 3 Destination Unreachable [1]_
4 Source Quench * 4 Source Quench [1]_
5 Redirect 5 Redirect
8 Echo Request 8 Echo Request
B Time Exceeded * B Time Exceeded [1]_
C Parameter Problem * C Parameter Problem [1]_
D Timestamp Request D Timestamp Request
E Timestamp Reply E Timestamp Reply
F Info Request F Info Request
G Info Reply G Info Reply
H Address Mask Request H Address Mask Request
I Address Mask Reply I Address Mask Reply
= =========================
* These are rate limited by default (see default mask above) .. [1] These are rate limited by default (see default mask above)
icmp_ignore_bogus_error_responses - BOOLEAN icmp_ignore_bogus_error_responses - BOOLEAN
Some routers violate RFC1122 by sending bogus responses to broadcast Some routers violate RFC1122 by sending bogus responses to broadcast
frames. Such violations are normally logged via a kernel warning. frames. Such violations are normally logged via a kernel warning.
If this is set to TRUE, the kernel will not give such warnings, which If this is set to TRUE, the kernel will not give such warnings, which
will avoid log file clutter. will avoid log file clutter.
Default: 1 Default: 1
icmp_errors_use_inbound_ifaddr - BOOLEAN icmp_errors_use_inbound_ifaddr - BOOLEAN
...@@ -1100,32 +1221,39 @@ igmp_max_memberships - INTEGER ...@@ -1100,32 +1221,39 @@ igmp_max_memberships - INTEGER
igmp_max_msf - INTEGER igmp_max_msf - INTEGER
Maximum number of addresses allowed in the source filter list for a Maximum number of addresses allowed in the source filter list for a
multicast group. multicast group.
Default: 10 Default: 10
igmp_qrv - INTEGER igmp_qrv - INTEGER
Controls the IGMP query robustness variable (see RFC2236 8.1). Controls the IGMP query robustness variable (see RFC2236 8.1).
Default: 2 (as specified by RFC2236 8.1) Default: 2 (as specified by RFC2236 8.1)
Minimum: 1 (as specified by RFC6636 4.5) Minimum: 1 (as specified by RFC6636 4.5)
force_igmp_version - INTEGER force_igmp_version - INTEGER
0 - (default) No enforcement of a IGMP version, IGMPv1/v2 fallback - 0 - (default) No enforcement of a IGMP version, IGMPv1/v2 fallback
allowed. Will back to IGMPv3 mode again if all IGMPv1/v2 Querier allowed. Will back to IGMPv3 mode again if all IGMPv1/v2 Querier
Present timer expires. Present timer expires.
1 - Enforce to use IGMP version 1. Will also reply IGMPv1 report if - 1 - Enforce to use IGMP version 1. Will also reply IGMPv1 report if
receive IGMPv2/v3 query. receive IGMPv2/v3 query.
2 - Enforce to use IGMP version 2. Will fallback to IGMPv1 if receive - 2 - Enforce to use IGMP version 2. Will fallback to IGMPv1 if receive
IGMPv1 query message. Will reply report if receive IGMPv3 query. IGMPv1 query message. Will reply report if receive IGMPv3 query.
3 - Enforce to use IGMP version 3. The same react with default 0. - 3 - Enforce to use IGMP version 3. The same react with default 0.
.. note::
Note: this is not the same with force_mld_version because IGMPv3 RFC3376 this is not the same with force_mld_version because IGMPv3 RFC3376
Security Considerations does not have clear description that we could Security Considerations does not have clear description that we could
ignore other version messages completely as MLDv2 RFC3810. So make ignore other version messages completely as MLDv2 RFC3810. So make
this value as default 0 is recommended. this value as default 0 is recommended.
conf/interface/* changes special settings per interface (where ``conf/interface/*``
"interface" is the name of your network interface) changes special settings per interface (where
interface" is the name of your network interface)
conf/all/* is special, changes the settings for all interfaces ``conf/all/*``
is special, changes the settings for all interfaces
log_martians - BOOLEAN log_martians - BOOLEAN
Log packets with impossible addresses to kernel log. Log packets with impossible addresses to kernel log.
...@@ -1136,14 +1264,21 @@ log_martians - BOOLEAN ...@@ -1136,14 +1264,21 @@ log_martians - BOOLEAN
accept_redirects - BOOLEAN accept_redirects - BOOLEAN
Accept ICMP redirect messages. Accept ICMP redirect messages.
accept_redirects for the interface will be enabled if: accept_redirects for the interface will be enabled if:
- both conf/{all,interface}/accept_redirects are TRUE in the case - both conf/{all,interface}/accept_redirects are TRUE in the case
forwarding for the interface is enabled forwarding for the interface is enabled
or or
- at least one of conf/{all,interface}/accept_redirects is TRUE in the - at least one of conf/{all,interface}/accept_redirects is TRUE in the
case forwarding for the interface is disabled case forwarding for the interface is disabled
accept_redirects for the interface will be disabled otherwise accept_redirects for the interface will be disabled otherwise
default TRUE (host)
FALSE (router) default:
- TRUE (host)
- FALSE (router)
forwarding - BOOLEAN forwarding - BOOLEAN
Enable IP forwarding on this interface. This controls whether packets Enable IP forwarding on this interface. This controls whether packets
...@@ -1168,12 +1303,14 @@ medium_id - INTEGER ...@@ -1168,12 +1303,14 @@ medium_id - INTEGER
proxy_arp - BOOLEAN proxy_arp - BOOLEAN
Do proxy arp. Do proxy arp.
proxy_arp for the interface will be enabled if at least one of proxy_arp for the interface will be enabled if at least one of
conf/{all,interface}/proxy_arp is set to TRUE, conf/{all,interface}/proxy_arp is set to TRUE,
it will be disabled otherwise it will be disabled otherwise
proxy_arp_pvlan - BOOLEAN proxy_arp_pvlan - BOOLEAN
Private VLAN proxy arp. Private VLAN proxy arp.
Basically allow proxy arp replies back to the same interface Basically allow proxy arp replies back to the same interface
(from which the ARP request/solicitation was received). (from which the ARP request/solicitation was received).
...@@ -1186,6 +1323,7 @@ proxy_arp_pvlan - BOOLEAN ...@@ -1186,6 +1323,7 @@ proxy_arp_pvlan - BOOLEAN
proxy_arp. proxy_arp.
This technology is known by different names: This technology is known by different names:
In RFC 3069 it is called VLAN Aggregation. In RFC 3069 it is called VLAN Aggregation.
Cisco and Allied Telesyn call it Private VLAN. Cisco and Allied Telesyn call it Private VLAN.
Hewlett-Packard call it Source-Port filtering or port-isolation. Hewlett-Packard call it Source-Port filtering or port-isolation.
...@@ -1194,26 +1332,33 @@ proxy_arp_pvlan - BOOLEAN ...@@ -1194,26 +1332,33 @@ proxy_arp_pvlan - BOOLEAN
shared_media - BOOLEAN shared_media - BOOLEAN
Send(router) or accept(host) RFC1620 shared media redirects. Send(router) or accept(host) RFC1620 shared media redirects.
Overrides secure_redirects. Overrides secure_redirects.
shared_media for the interface will be enabled if at least one of shared_media for the interface will be enabled if at least one of
conf/{all,interface}/shared_media is set to TRUE, conf/{all,interface}/shared_media is set to TRUE,
it will be disabled otherwise it will be disabled otherwise
default TRUE default TRUE
secure_redirects - BOOLEAN secure_redirects - BOOLEAN
Accept ICMP redirect messages only to gateways listed in the Accept ICMP redirect messages only to gateways listed in the
interface's current gateway list. Even if disabled, RFC1122 redirect interface's current gateway list. Even if disabled, RFC1122 redirect
rules still apply. rules still apply.
Overridden by shared_media. Overridden by shared_media.
secure_redirects for the interface will be enabled if at least one of secure_redirects for the interface will be enabled if at least one of
conf/{all,interface}/secure_redirects is set to TRUE, conf/{all,interface}/secure_redirects is set to TRUE,
it will be disabled otherwise it will be disabled otherwise
default TRUE default TRUE
send_redirects - BOOLEAN send_redirects - BOOLEAN
Send redirects, if router. Send redirects, if router.
send_redirects for the interface will be enabled if at least one of send_redirects for the interface will be enabled if at least one of
conf/{all,interface}/send_redirects is set to TRUE, conf/{all,interface}/send_redirects is set to TRUE,
it will be disabled otherwise it will be disabled otherwise
Default: TRUE Default: TRUE
bootp_relay - BOOLEAN bootp_relay - BOOLEAN
...@@ -1222,15 +1367,20 @@ bootp_relay - BOOLEAN ...@@ -1222,15 +1367,20 @@ bootp_relay - BOOLEAN
BOOTP relay daemon will catch and forward such packets. BOOTP relay daemon will catch and forward such packets.
conf/all/bootp_relay must also be set to TRUE to enable BOOTP relay conf/all/bootp_relay must also be set to TRUE to enable BOOTP relay
for the interface for the interface
default FALSE default FALSE
Not Implemented Yet. Not Implemented Yet.
accept_source_route - BOOLEAN accept_source_route - BOOLEAN
Accept packets with SRR option. Accept packets with SRR option.
conf/all/accept_source_route must also be set to TRUE to accept packets conf/all/accept_source_route must also be set to TRUE to accept packets
with SRR option on the interface with SRR option on the interface
default TRUE (router)
FALSE (host) default
- TRUE (router)
- FALSE (host)
accept_local - BOOLEAN accept_local - BOOLEAN
Accept packets with local source addresses. In combination with Accept packets with local source addresses. In combination with
...@@ -1241,18 +1391,19 @@ accept_local - BOOLEAN ...@@ -1241,18 +1391,19 @@ accept_local - BOOLEAN
route_localnet - BOOLEAN route_localnet - BOOLEAN
Do not consider loopback addresses as martian source or destination Do not consider loopback addresses as martian source or destination
while routing. This enables the use of 127/8 for local routing purposes. while routing. This enables the use of 127/8 for local routing purposes.
default FALSE default FALSE
rp_filter - INTEGER rp_filter - INTEGER
0 - No source validation. - 0 - No source validation.
1 - Strict mode as defined in RFC3704 Strict Reverse Path - 1 - Strict mode as defined in RFC3704 Strict Reverse Path
Each incoming packet is tested against the FIB and if the interface Each incoming packet is tested against the FIB and if the interface
is not the best reverse path the packet check will fail. is not the best reverse path the packet check will fail.
By default failed packets are discarded. By default failed packets are discarded.
2 - Loose mode as defined in RFC3704 Loose Reverse Path - 2 - Loose mode as defined in RFC3704 Loose Reverse Path
Each incoming packet's source address is also tested against the FIB Each incoming packet's source address is also tested against the FIB
and if the source address is not reachable via any interface and if the source address is not reachable via any interface
the packet check will fail. the packet check will fail.
Current recommended practice in RFC3704 is to enable strict mode Current recommended practice in RFC3704 is to enable strict mode
to prevent IP spoofing from DDos attacks. If using asymmetric routing to prevent IP spoofing from DDos attacks. If using asymmetric routing
...@@ -1265,19 +1416,19 @@ rp_filter - INTEGER ...@@ -1265,19 +1416,19 @@ rp_filter - INTEGER
in startup scripts. in startup scripts.
arp_filter - BOOLEAN arp_filter - BOOLEAN
1 - Allows you to have multiple network interfaces on the same - 1 - Allows you to have multiple network interfaces on the same
subnet, and have the ARPs for each interface be answered subnet, and have the ARPs for each interface be answered
based on whether or not the kernel would route a packet from based on whether or not the kernel would route a packet from
the ARP'd IP out that interface (therefore you must use source the ARP'd IP out that interface (therefore you must use source
based routing for this to work). In other words it allows control based routing for this to work). In other words it allows control
of which cards (usually 1) will respond to an arp request. of which cards (usually 1) will respond to an arp request.
0 - (default) The kernel can respond to arp requests with addresses - 0 - (default) The kernel can respond to arp requests with addresses
from other interfaces. This may seem wrong but it usually makes from other interfaces. This may seem wrong but it usually makes
sense, because it increases the chance of successful communication. sense, because it increases the chance of successful communication.
IP addresses are owned by the complete host on Linux, not by IP addresses are owned by the complete host on Linux, not by
particular interfaces. Only for more complex setups like load- particular interfaces. Only for more complex setups like load-
balancing, does this behaviour cause problems. balancing, does this behaviour cause problems.
arp_filter for the interface will be enabled if at least one of arp_filter for the interface will be enabled if at least one of
conf/{all,interface}/arp_filter is set to TRUE, conf/{all,interface}/arp_filter is set to TRUE,
...@@ -1287,26 +1438,27 @@ arp_announce - INTEGER ...@@ -1287,26 +1438,27 @@ arp_announce - INTEGER
Define different restriction levels for announcing the local Define different restriction levels for announcing the local
source IP address from IP packets in ARP requests sent on source IP address from IP packets in ARP requests sent on
interface: interface:
0 - (default) Use any local address, configured on any interface
1 - Try to avoid local addresses that are not in the target's - 0 - (default) Use any local address, configured on any interface
subnet for this interface. This mode is useful when target - 1 - Try to avoid local addresses that are not in the target's
hosts reachable via this interface require the source IP subnet for this interface. This mode is useful when target
address in ARP requests to be part of their logical network hosts reachable via this interface require the source IP
configured on the receiving interface. When we generate the address in ARP requests to be part of their logical network
request we will check all our subnets that include the configured on the receiving interface. When we generate the
target IP and will preserve the source address if it is from request we will check all our subnets that include the
such subnet. If there is no such subnet we select source target IP and will preserve the source address if it is from
address according to the rules for level 2. such subnet. If there is no such subnet we select source
2 - Always use the best local address for this target. address according to the rules for level 2.
In this mode we ignore the source address in the IP packet - 2 - Always use the best local address for this target.
and try to select local address that we prefer for talks with In this mode we ignore the source address in the IP packet
the target host. Such local address is selected by looking and try to select local address that we prefer for talks with
for primary IP addresses on all our subnets on the outgoing the target host. Such local address is selected by looking
interface that include the target IP address. If no suitable for primary IP addresses on all our subnets on the outgoing
local address is found we select the first local address interface that include the target IP address. If no suitable
we have on the outgoing interface or on all other interfaces, local address is found we select the first local address
with the hope we will receive reply for our request and we have on the outgoing interface or on all other interfaces,
even sometimes no matter the source IP address we announce. with the hope we will receive reply for our request and
even sometimes no matter the source IP address we announce.
The max value from conf/{all,interface}/arp_announce is used. The max value from conf/{all,interface}/arp_announce is used.
...@@ -1317,32 +1469,37 @@ arp_announce - INTEGER ...@@ -1317,32 +1469,37 @@ arp_announce - INTEGER
arp_ignore - INTEGER arp_ignore - INTEGER
Define different modes for sending replies in response to Define different modes for sending replies in response to
received ARP requests that resolve local target IP addresses: received ARP requests that resolve local target IP addresses:
0 - (default): reply for any local target IP address, configured
on any interface - 0 - (default): reply for any local target IP address, configured
1 - reply only if the target IP address is local address on any interface
configured on the incoming interface - 1 - reply only if the target IP address is local address
2 - reply only if the target IP address is local address configured on the incoming interface
configured on the incoming interface and both with the - 2 - reply only if the target IP address is local address
sender's IP address are part from same subnet on this interface configured on the incoming interface and both with the
3 - do not reply for local addresses configured with scope host, sender's IP address are part from same subnet on this interface
only resolutions for global and link addresses are replied - 3 - do not reply for local addresses configured with scope host,
4-7 - reserved only resolutions for global and link addresses are replied
8 - do not reply for all local addresses - 4-7 - reserved
- 8 - do not reply for all local addresses
The max value from conf/{all,interface}/arp_ignore is used The max value from conf/{all,interface}/arp_ignore is used
when ARP request is received on the {interface} when ARP request is received on the {interface}
arp_notify - BOOLEAN arp_notify - BOOLEAN
Define mode for notification of address and device changes. Define mode for notification of address and device changes.
0 - (default): do nothing
1 - Generate gratuitous arp requests when device is brought up == ==========================================================
or hardware address changes. 0 (default): do nothing
1 Generate gratuitous arp requests when device is brought up
or hardware address changes.
== ==========================================================
arp_accept - BOOLEAN arp_accept - BOOLEAN
Define behavior for gratuitous ARP frames who's IP is not Define behavior for gratuitous ARP frames who's IP is not
already present in the ARP table: already present in the ARP table:
0 - don't create new entries in the ARP table
1 - create new entries in the ARP table - 0 - don't create new entries in the ARP table
- 1 - create new entries in the ARP table
Both replies and requests type gratuitous arp will trigger the Both replies and requests type gratuitous arp will trigger the
ARP table to be updated, if this setting is on. ARP table to be updated, if this setting is on.
...@@ -1378,11 +1535,13 @@ disable_xfrm - BOOLEAN ...@@ -1378,11 +1535,13 @@ disable_xfrm - BOOLEAN
igmpv2_unsolicited_report_interval - INTEGER igmpv2_unsolicited_report_interval - INTEGER
The interval in milliseconds in which the next unsolicited The interval in milliseconds in which the next unsolicited
IGMPv1 or IGMPv2 report retransmit will take place. IGMPv1 or IGMPv2 report retransmit will take place.
Default: 10000 (10 seconds) Default: 10000 (10 seconds)
igmpv3_unsolicited_report_interval - INTEGER igmpv3_unsolicited_report_interval - INTEGER
The interval in milliseconds in which the next unsolicited The interval in milliseconds in which the next unsolicited
IGMPv3 report retransmit will take place. IGMPv3 report retransmit will take place.
Default: 1000 (1 seconds) Default: 1000 (1 seconds)
promote_secondaries - BOOLEAN promote_secondaries - BOOLEAN
...@@ -1393,19 +1552,23 @@ promote_secondaries - BOOLEAN ...@@ -1393,19 +1552,23 @@ promote_secondaries - BOOLEAN
drop_unicast_in_l2_multicast - BOOLEAN drop_unicast_in_l2_multicast - BOOLEAN
Drop any unicast IP packets that are received in link-layer Drop any unicast IP packets that are received in link-layer
multicast (or broadcast) frames. multicast (or broadcast) frames.
This behavior (for multicast) is actually a SHOULD in RFC This behavior (for multicast) is actually a SHOULD in RFC
1122, but is disabled by default for compatibility reasons. 1122, but is disabled by default for compatibility reasons.
Default: off (0) Default: off (0)
drop_gratuitous_arp - BOOLEAN drop_gratuitous_arp - BOOLEAN
Drop all gratuitous ARP frames, for example if there's a known Drop all gratuitous ARP frames, for example if there's a known
good ARP proxy on the network and such frames need not be used good ARP proxy on the network and such frames need not be used
(or in the case of 802.11, must not be used to prevent attacks.) (or in the case of 802.11, must not be used to prevent attacks.)
Default: off (0) Default: off (0)
tag - INTEGER tag - INTEGER
Allows you to write a number, which can be used as required. Allows you to write a number, which can be used as required.
Default value is 0. Default value is 0.
xfrm4_gc_thresh - INTEGER xfrm4_gc_thresh - INTEGER
...@@ -1417,21 +1580,24 @@ xfrm4_gc_thresh - INTEGER ...@@ -1417,21 +1580,24 @@ xfrm4_gc_thresh - INTEGER
igmp_link_local_mcast_reports - BOOLEAN igmp_link_local_mcast_reports - BOOLEAN
Enable IGMP reports for link local multicast groups in the Enable IGMP reports for link local multicast groups in the
224.0.0.X range. 224.0.0.X range.
Default TRUE Default TRUE
Alexey Kuznetsov. Alexey Kuznetsov.
kuznet@ms2.inr.ac.ru kuznet@ms2.inr.ac.ru
Updated by: Updated by:
Andi Kleen
ak@muc.de
Nicolas Delon
delon.nicolas@wanadoo.fr
- Andi Kleen
ak@muc.de
- Nicolas Delon
delon.nicolas@wanadoo.fr
/proc/sys/net/ipv6/* Variables:
/proc/sys/net/ipv6/* Variables
==============================
IPv6 has no global variables such as tcp_*. tcp_* settings under ipv4/ also IPv6 has no global variables such as tcp_*. tcp_* settings under ipv4/ also
apply to IPv6 [XXX?]. apply to IPv6 [XXX?].
...@@ -1440,8 +1606,9 @@ bindv6only - BOOLEAN ...@@ -1440,8 +1606,9 @@ bindv6only - BOOLEAN
Default value for IPV6_V6ONLY socket option, Default value for IPV6_V6ONLY socket option,
which restricts use of the IPv6 socket to IPv6 communication which restricts use of the IPv6 socket to IPv6 communication
only. only.
TRUE: disable IPv4-mapped address feature
FALSE: enable IPv4-mapped address feature - TRUE: disable IPv4-mapped address feature
- FALSE: enable IPv4-mapped address feature
Default: FALSE (as specified in RFC3493) Default: FALSE (as specified in RFC3493)
...@@ -1449,8 +1616,10 @@ flowlabel_consistency - BOOLEAN ...@@ -1449,8 +1616,10 @@ flowlabel_consistency - BOOLEAN
Protect the consistency (and unicity) of flow label. Protect the consistency (and unicity) of flow label.
You have to disable it to use IPV6_FL_F_REFLECT flag on the You have to disable it to use IPV6_FL_F_REFLECT flag on the
flow label manager. flow label manager.
TRUE: enabled
FALSE: disabled - TRUE: enabled
- FALSE: disabled
Default: TRUE Default: TRUE
auto_flowlabels - INTEGER auto_flowlabels - INTEGER
...@@ -1458,22 +1627,28 @@ auto_flowlabels - INTEGER ...@@ -1458,22 +1627,28 @@ auto_flowlabels - INTEGER
packet. This allows intermediate devices, such as routers, to packet. This allows intermediate devices, such as routers, to
identify packet flows for mechanisms like Equal Cost Multipath identify packet flows for mechanisms like Equal Cost Multipath
Routing (see RFC 6438). Routing (see RFC 6438).
0: automatic flow labels are completely disabled
1: automatic flow labels are enabled by default, they can be = ===========================================================
0 automatic flow labels are completely disabled
1 automatic flow labels are enabled by default, they can be
disabled on a per socket basis using the IPV6_AUTOFLOWLABEL disabled on a per socket basis using the IPV6_AUTOFLOWLABEL
socket option socket option
2: automatic flow labels are allowed, they may be enabled on a 2 automatic flow labels are allowed, they may be enabled on a
per socket basis using the IPV6_AUTOFLOWLABEL socket option per socket basis using the IPV6_AUTOFLOWLABEL socket option
3: automatic flow labels are enabled and enforced, they cannot 3 automatic flow labels are enabled and enforced, they cannot
be disabled by the socket option be disabled by the socket option
= ===========================================================
Default: 1 Default: 1
flowlabel_state_ranges - BOOLEAN flowlabel_state_ranges - BOOLEAN
Split the flow label number space into two ranges. 0-0x7FFFF is Split the flow label number space into two ranges. 0-0x7FFFF is
reserved for the IPv6 flow manager facility, 0x80000-0xFFFFF reserved for the IPv6 flow manager facility, 0x80000-0xFFFFF
is reserved for stateless flow labels as described in RFC6437. is reserved for stateless flow labels as described in RFC6437.
TRUE: enabled
FALSE: disabled - TRUE: enabled
- FALSE: disabled
Default: true Default: true
flowlabel_reflect - INTEGER flowlabel_reflect - INTEGER
...@@ -1483,49 +1658,59 @@ flowlabel_reflect - INTEGER ...@@ -1483,49 +1658,59 @@ flowlabel_reflect - INTEGER
https://tools.ietf.org/html/draft-wang-6man-flow-label-reflection-01 https://tools.ietf.org/html/draft-wang-6man-flow-label-reflection-01
This is a bitmask. This is a bitmask.
1: enabled for established flows
Note that this prevents automatic flowlabel changes, as done - 1: enabled for established flows
in "tcp: change IPv6 flow-label upon receiving spurious retransmission"
and "tcp: Change txhash on every SYN and RTO retransmit" Note that this prevents automatic flowlabel changes, as done
in "tcp: change IPv6 flow-label upon receiving spurious retransmission"
and "tcp: Change txhash on every SYN and RTO retransmit"
2: enabled for TCP RESET packets (no active listener) - 2: enabled for TCP RESET packets (no active listener)
If set, a RST packet sent in response to a SYN packet on a closed If set, a RST packet sent in response to a SYN packet on a closed
port will reflect the incoming flow label. port will reflect the incoming flow label.
4: enabled for ICMPv6 echo reply messages. - 4: enabled for ICMPv6 echo reply messages.
Default: 0 Default: 0
fib_multipath_hash_policy - INTEGER fib_multipath_hash_policy - INTEGER
Controls which hash policy to use for multipath routes. Controls which hash policy to use for multipath routes.
Default: 0 (Layer 3) Default: 0 (Layer 3)
Possible values: Possible values:
0 - Layer 3 (source and destination addresses plus flow label)
1 - Layer 4 (standard 5-tuple) - 0 - Layer 3 (source and destination addresses plus flow label)
2 - Layer 3 or inner Layer 3 if present - 1 - Layer 4 (standard 5-tuple)
- 2 - Layer 3 or inner Layer 3 if present
anycast_src_echo_reply - BOOLEAN anycast_src_echo_reply - BOOLEAN
Controls the use of anycast addresses as source addresses for ICMPv6 Controls the use of anycast addresses as source addresses for ICMPv6
echo reply echo reply
TRUE: enabled
FALSE: disabled - TRUE: enabled
- FALSE: disabled
Default: FALSE Default: FALSE
idgen_delay - INTEGER idgen_delay - INTEGER
Controls the delay in seconds after which time to retry Controls the delay in seconds after which time to retry
privacy stable address generation if a DAD conflict is privacy stable address generation if a DAD conflict is
detected. detected.
Default: 1 (as specified in RFC7217) Default: 1 (as specified in RFC7217)
idgen_retries - INTEGER idgen_retries - INTEGER
Controls the number of retries to generate a stable privacy Controls the number of retries to generate a stable privacy
address if a DAD conflict is detected. address if a DAD conflict is detected.
Default: 3 (as specified in RFC7217) Default: 3 (as specified in RFC7217)
mld_qrv - INTEGER mld_qrv - INTEGER
Controls the MLD query robustness variable (see RFC3810 9.1). Controls the MLD query robustness variable (see RFC3810 9.1).
Default: 2 (as specified by RFC3810 9.1) Default: 2 (as specified by RFC3810 9.1)
Minimum: 1 (as specified by RFC6636 4.5) Minimum: 1 (as specified by RFC6636 4.5)
max_dst_opts_number - INTEGER max_dst_opts_number - INTEGER
...@@ -1533,6 +1718,7 @@ max_dst_opts_number - INTEGER ...@@ -1533,6 +1718,7 @@ max_dst_opts_number - INTEGER
options extension header. If this value is less than zero options extension header. If this value is less than zero
then unknown options are disallowed and the number of known then unknown options are disallowed and the number of known
TLVs allowed is the absolute value of this number. TLVs allowed is the absolute value of this number.
Default: 8 Default: 8
max_hbh_opts_number - INTEGER max_hbh_opts_number - INTEGER
...@@ -1540,16 +1726,19 @@ max_hbh_opts_number - INTEGER ...@@ -1540,16 +1726,19 @@ max_hbh_opts_number - INTEGER
options extension header. If this value is less than zero options extension header. If this value is less than zero
then unknown options are disallowed and the number of known then unknown options are disallowed and the number of known
TLVs allowed is the absolute value of this number. TLVs allowed is the absolute value of this number.
Default: 8 Default: 8
max_dst_opts_length - INTEGER max_dst_opts_length - INTEGER
Maximum length allowed for a Destination options extension Maximum length allowed for a Destination options extension
header. header.
Default: INT_MAX (unlimited) Default: INT_MAX (unlimited)
max_hbh_length - INTEGER max_hbh_length - INTEGER
Maximum length allowed for a Hop-by-Hop options extension Maximum length allowed for a Hop-by-Hop options extension
header. header.
Default: INT_MAX (unlimited) Default: INT_MAX (unlimited)
skip_notify_on_dev_down - BOOLEAN skip_notify_on_dev_down - BOOLEAN
...@@ -1558,6 +1747,7 @@ skip_notify_on_dev_down - BOOLEAN ...@@ -1558,6 +1747,7 @@ skip_notify_on_dev_down - BOOLEAN
generate this message; IPv6 does by default. Setting this sysctl generate this message; IPv6 does by default. Setting this sysctl
to true skips the message, making IPv4 and IPv6 on par in relying to true skips the message, making IPv4 and IPv6 on par in relying
on userspace caches to track link events and evict routes. on userspace caches to track link events and evict routes.
Default: false (generate message) Default: false (generate message)
nexthop_compat_mode - BOOLEAN nexthop_compat_mode - BOOLEAN
...@@ -1592,18 +1782,20 @@ seg6_flowlabel - INTEGER ...@@ -1592,18 +1782,20 @@ seg6_flowlabel - INTEGER
Controls the behaviour of computing the flowlabel of outer Controls the behaviour of computing the flowlabel of outer
IPv6 header in case of SR T.encaps IPv6 header in case of SR T.encaps
-1 set flowlabel to zero. == =======================================================
0 copy flowlabel from Inner packet in case of Inner IPv6 -1 set flowlabel to zero.
(Set flowlabel to 0 in case IPv4/L2) 0 copy flowlabel from Inner packet in case of Inner IPv6
1 Compute the flowlabel using seg6_make_flowlabel() (Set flowlabel to 0 in case IPv4/L2)
1 Compute the flowlabel using seg6_make_flowlabel()
== =======================================================
Default is 0. Default is 0.
conf/default/*: ``conf/default/*``:
Change the interface-specific default settings. Change the interface-specific default settings.
conf/all/*: ``conf/all/*``:
Change all the interface-specific settings. Change all the interface-specific settings.
[XXX: Other special features than forwarding?] [XXX: Other special features than forwarding?]
...@@ -1627,9 +1819,10 @@ fwmark_reflect - BOOLEAN ...@@ -1627,9 +1819,10 @@ fwmark_reflect - BOOLEAN
associated with a socket for example, TCP RSTs or ICMPv6 echo replies). associated with a socket for example, TCP RSTs or ICMPv6 echo replies).
If unset, these packets have a fwmark of zero. If set, they have the If unset, these packets have a fwmark of zero. If set, they have the
fwmark of the packet they are replying to. fwmark of the packet they are replying to.
Default: 0 Default: 0
conf/interface/*: ``conf/interface/*``:
Change special settings per interface. Change special settings per interface.
The functional behaviour for certain settings is different The functional behaviour for certain settings is different
...@@ -1644,31 +1837,40 @@ accept_ra - INTEGER ...@@ -1644,31 +1837,40 @@ accept_ra - INTEGER
transmitted. transmitted.
Possible values are: Possible values are:
0 Do not accept Router Advertisements.
1 Accept Router Advertisements if forwarding is disabled.
2 Overrule forwarding behaviour. Accept Router Advertisements
even if forwarding is enabled.
Functional default: enabled if local forwarding is disabled. == ===========================================================
disabled if local forwarding is enabled. 0 Do not accept Router Advertisements.
1 Accept Router Advertisements if forwarding is disabled.
2 Overrule forwarding behaviour. Accept Router Advertisements
even if forwarding is enabled.
== ===========================================================
Functional default:
- enabled if local forwarding is disabled.
- disabled if local forwarding is enabled.
accept_ra_defrtr - BOOLEAN accept_ra_defrtr - BOOLEAN
Learn default router in Router Advertisement. Learn default router in Router Advertisement.
Functional default: enabled if accept_ra is enabled. Functional default:
disabled if accept_ra is disabled.
- enabled if accept_ra is enabled.
- disabled if accept_ra is disabled.
accept_ra_from_local - BOOLEAN accept_ra_from_local - BOOLEAN
Accept RA with source-address that is found on local machine Accept RA with source-address that is found on local machine
if the RA is otherwise proper and able to be accepted. if the RA is otherwise proper and able to be accepted.
Default is to NOT accept these as it may be an un-intended
network loop. Default is to NOT accept these as it may be an un-intended
network loop.
Functional default: Functional default:
enabled if accept_ra_from_local is enabled
on a specific interface. - enabled if accept_ra_from_local is enabled
disabled if accept_ra_from_local is disabled on a specific interface.
on a specific interface. - disabled if accept_ra_from_local is disabled
on a specific interface.
accept_ra_min_hop_limit - INTEGER accept_ra_min_hop_limit - INTEGER
Minimum hop limit Information in Router Advertisement. Minimum hop limit Information in Router Advertisement.
...@@ -1681,8 +1883,10 @@ accept_ra_min_hop_limit - INTEGER ...@@ -1681,8 +1883,10 @@ accept_ra_min_hop_limit - INTEGER
accept_ra_pinfo - BOOLEAN accept_ra_pinfo - BOOLEAN
Learn Prefix Information in Router Advertisement. Learn Prefix Information in Router Advertisement.
Functional default: enabled if accept_ra is enabled. Functional default:
disabled if accept_ra is disabled.
- enabled if accept_ra is enabled.
- disabled if accept_ra is disabled.
accept_ra_rt_info_min_plen - INTEGER accept_ra_rt_info_min_plen - INTEGER
Minimum prefix length of Route Information in RA. Minimum prefix length of Route Information in RA.
...@@ -1690,8 +1894,10 @@ accept_ra_rt_info_min_plen - INTEGER ...@@ -1690,8 +1894,10 @@ accept_ra_rt_info_min_plen - INTEGER
Route Information w/ prefix smaller than this variable shall Route Information w/ prefix smaller than this variable shall
be ignored. be ignored.
Functional default: 0 if accept_ra_rtr_pref is enabled. Functional default:
-1 if accept_ra_rtr_pref is disabled.
* 0 if accept_ra_rtr_pref is enabled.
* -1 if accept_ra_rtr_pref is disabled.
accept_ra_rt_info_max_plen - INTEGER accept_ra_rt_info_max_plen - INTEGER
Maximum prefix length of Route Information in RA. Maximum prefix length of Route Information in RA.
...@@ -1699,33 +1905,41 @@ accept_ra_rt_info_max_plen - INTEGER ...@@ -1699,33 +1905,41 @@ accept_ra_rt_info_max_plen - INTEGER
Route Information w/ prefix larger than this variable shall Route Information w/ prefix larger than this variable shall
be ignored. be ignored.
Functional default: 0 if accept_ra_rtr_pref is enabled. Functional default:
-1 if accept_ra_rtr_pref is disabled.
* 0 if accept_ra_rtr_pref is enabled.
* -1 if accept_ra_rtr_pref is disabled.
accept_ra_rtr_pref - BOOLEAN accept_ra_rtr_pref - BOOLEAN
Accept Router Preference in RA. Accept Router Preference in RA.
Functional default: enabled if accept_ra is enabled. Functional default:
disabled if accept_ra is disabled.
- enabled if accept_ra is enabled.
- disabled if accept_ra is disabled.
accept_ra_mtu - BOOLEAN accept_ra_mtu - BOOLEAN
Apply the MTU value specified in RA option 5 (RFC4861). If Apply the MTU value specified in RA option 5 (RFC4861). If
disabled, the MTU specified in the RA will be ignored. disabled, the MTU specified in the RA will be ignored.
Functional default: enabled if accept_ra is enabled. Functional default:
disabled if accept_ra is disabled.
- enabled if accept_ra is enabled.
- disabled if accept_ra is disabled.
accept_redirects - BOOLEAN accept_redirects - BOOLEAN
Accept Redirects. Accept Redirects.
Functional default: enabled if local forwarding is disabled. Functional default:
disabled if local forwarding is enabled.
- enabled if local forwarding is disabled.
- disabled if local forwarding is enabled.
accept_source_route - INTEGER accept_source_route - INTEGER
Accept source routing (routing extension header). Accept source routing (routing extension header).
>= 0: Accept only routing header type 2. - >= 0: Accept only routing header type 2.
< 0: Do not accept routing header. - < 0: Do not accept routing header.
Default: 0 Default: 0
...@@ -1733,24 +1947,30 @@ autoconf - BOOLEAN ...@@ -1733,24 +1947,30 @@ autoconf - BOOLEAN
Autoconfigure addresses using Prefix Information in Router Autoconfigure addresses using Prefix Information in Router
Advertisements. Advertisements.
Functional default: enabled if accept_ra_pinfo is enabled. Functional default:
disabled if accept_ra_pinfo is disabled.
- enabled if accept_ra_pinfo is enabled.
- disabled if accept_ra_pinfo is disabled.
dad_transmits - INTEGER dad_transmits - INTEGER
The amount of Duplicate Address Detection probes to send. The amount of Duplicate Address Detection probes to send.
Default: 1 Default: 1
forwarding - INTEGER forwarding - INTEGER
Configure interface-specific Host/Router behaviour. Configure interface-specific Host/Router behaviour.
Note: It is recommended to have the same setting on all .. note::
interfaces; mixed router/host scenarios are rather uncommon.
It is recommended to have the same setting on all
interfaces; mixed router/host scenarios are rather uncommon.
Possible values are: Possible values are:
0 Forwarding disabled
1 Forwarding enabled
FALSE (0): - 0 Forwarding disabled
- 1 Forwarding enabled
**FALSE (0)**:
By default, Host behaviour is assumed. This means: By default, Host behaviour is assumed. This means:
...@@ -1761,7 +1981,7 @@ forwarding - INTEGER ...@@ -1761,7 +1981,7 @@ forwarding - INTEGER
Advertisements (and do autoconfiguration). Advertisements (and do autoconfiguration).
4. If accept_redirects is TRUE (default), accept Redirects. 4. If accept_redirects is TRUE (default), accept Redirects.
TRUE (1): **TRUE (1)**:
If local forwarding is enabled, Router behaviour is assumed. If local forwarding is enabled, Router behaviour is assumed.
This means exactly the reverse from the above: This means exactly the reverse from the above:
...@@ -1772,19 +1992,22 @@ forwarding - INTEGER ...@@ -1772,19 +1992,22 @@ forwarding - INTEGER
4. Redirects are ignored. 4. Redirects are ignored.
Default: 0 (disabled) if global forwarding is disabled (default), Default: 0 (disabled) if global forwarding is disabled (default),
otherwise 1 (enabled). otherwise 1 (enabled).
hop_limit - INTEGER hop_limit - INTEGER
Default Hop Limit to set. Default Hop Limit to set.
Default: 64 Default: 64
mtu - INTEGER mtu - INTEGER
Default Maximum Transfer Unit Default Maximum Transfer Unit
Default: 1280 (IPv6 required minimum) Default: 1280 (IPv6 required minimum)
ip_nonlocal_bind - BOOLEAN ip_nonlocal_bind - BOOLEAN
If set, allows processes to bind() to non-local IPv6 addresses, If set, allows processes to bind() to non-local IPv6 addresses,
which can be quite useful - but may break some applications. which can be quite useful - but may break some applications.
Default: 0 Default: 0
router_probe_interval - INTEGER router_probe_interval - INTEGER
...@@ -1796,15 +2019,18 @@ router_probe_interval - INTEGER ...@@ -1796,15 +2019,18 @@ router_probe_interval - INTEGER
router_solicitation_delay - INTEGER router_solicitation_delay - INTEGER
Number of seconds to wait after interface is brought up Number of seconds to wait after interface is brought up
before sending Router Solicitations. before sending Router Solicitations.
Default: 1 Default: 1
router_solicitation_interval - INTEGER router_solicitation_interval - INTEGER
Number of seconds to wait between Router Solicitations. Number of seconds to wait between Router Solicitations.
Default: 4 Default: 4
router_solicitations - INTEGER router_solicitations - INTEGER
Number of Router Solicitations to send until assuming no Number of Router Solicitations to send until assuming no
routers are present. routers are present.
Default: 3 Default: 3
use_oif_addrs_only - BOOLEAN use_oif_addrs_only - BOOLEAN
...@@ -1816,28 +2042,35 @@ use_oif_addrs_only - BOOLEAN ...@@ -1816,28 +2042,35 @@ use_oif_addrs_only - BOOLEAN
use_tempaddr - INTEGER use_tempaddr - INTEGER
Preference for Privacy Extensions (RFC3041). Preference for Privacy Extensions (RFC3041).
<= 0 : disable Privacy Extensions
== 1 : enable Privacy Extensions, but prefer public * <= 0 : disable Privacy Extensions
addresses over temporary addresses. * == 1 : enable Privacy Extensions, but prefer public
> 1 : enable Privacy Extensions and prefer temporary addresses over temporary addresses.
addresses over public addresses. * > 1 : enable Privacy Extensions and prefer temporary
Default: 0 (for most devices) addresses over public addresses.
-1 (for point-to-point devices and loopback devices)
Default:
* 0 (for most devices)
* -1 (for point-to-point devices and loopback devices)
temp_valid_lft - INTEGER temp_valid_lft - INTEGER
valid lifetime (in seconds) for temporary addresses. valid lifetime (in seconds) for temporary addresses.
Default: 604800 (7 days) Default: 604800 (7 days)
temp_prefered_lft - INTEGER temp_prefered_lft - INTEGER
Preferred lifetime (in seconds) for temporary addresses. Preferred lifetime (in seconds) for temporary addresses.
Default: 86400 (1 day) Default: 86400 (1 day)
keep_addr_on_down - INTEGER keep_addr_on_down - INTEGER
Keep all IPv6 addresses on an interface down event. If set static Keep all IPv6 addresses on an interface down event. If set static
global addresses with no expiration time are not flushed. global addresses with no expiration time are not flushed.
>0 : enabled
0 : system default * >0 : enabled
<0 : disabled * 0 : system default
* <0 : disabled
Default: 0 (addresses are removed) Default: 0 (addresses are removed)
...@@ -1846,11 +2079,13 @@ max_desync_factor - INTEGER ...@@ -1846,11 +2079,13 @@ max_desync_factor - INTEGER
that ensures that clients don't synchronize with each that ensures that clients don't synchronize with each
other and generate new addresses at exactly the same time. other and generate new addresses at exactly the same time.
value is in seconds. value is in seconds.
Default: 600 Default: 600
regen_max_retry - INTEGER regen_max_retry - INTEGER
Number of attempts before give up attempting to generate Number of attempts before give up attempting to generate
valid temporary addresses. valid temporary addresses.
Default: 5 Default: 5
max_addresses - INTEGER max_addresses - INTEGER
...@@ -1858,12 +2093,14 @@ max_addresses - INTEGER ...@@ -1858,12 +2093,14 @@ max_addresses - INTEGER
to zero disables the limitation. It is not recommended to set this to zero disables the limitation. It is not recommended to set this
value too large (or to zero) because it would be an easy way to value too large (or to zero) because it would be an easy way to
crash the kernel by allowing too many addresses to be created. crash the kernel by allowing too many addresses to be created.
Default: 16 Default: 16
disable_ipv6 - BOOLEAN disable_ipv6 - BOOLEAN
Disable IPv6 operation. If accept_dad is set to 2, this value Disable IPv6 operation. If accept_dad is set to 2, this value
will be dynamically set to TRUE if DAD fails for the link-local will be dynamically set to TRUE if DAD fails for the link-local
address. address.
Default: FALSE (enable IPv6 operation) Default: FALSE (enable IPv6 operation)
When this value is changed from 1 to 0 (IPv6 is being enabled), When this value is changed from 1 to 0 (IPv6 is being enabled),
...@@ -1877,10 +2114,13 @@ disable_ipv6 - BOOLEAN ...@@ -1877,10 +2114,13 @@ disable_ipv6 - BOOLEAN
accept_dad - INTEGER accept_dad - INTEGER
Whether to accept DAD (Duplicate Address Detection). Whether to accept DAD (Duplicate Address Detection).
0: Disable DAD
1: Enable DAD (default) == ==============================================================
2: Enable DAD, and disable IPv6 operation if MAC-based duplicate 0 Disable DAD
link-local address has been found. 1 Enable DAD (default)
2 Enable DAD, and disable IPv6 operation if MAC-based duplicate
link-local address has been found.
== ==============================================================
DAD operation and mode on a given interface will be selected according DAD operation and mode on a given interface will be selected according
to the maximum value of conf/{all,interface}/accept_dad. to the maximum value of conf/{all,interface}/accept_dad.
...@@ -1888,6 +2128,7 @@ accept_dad - INTEGER ...@@ -1888,6 +2128,7 @@ accept_dad - INTEGER
force_tllao - BOOLEAN force_tllao - BOOLEAN
Enable sending the target link-layer address option even when Enable sending the target link-layer address option even when
responding to a unicast neighbor solicitation. responding to a unicast neighbor solicitation.
Default: FALSE Default: FALSE
Quoting from RFC 2461, section 4.4, Target link-layer address: Quoting from RFC 2461, section 4.4, Target link-layer address:
...@@ -1905,9 +2146,10 @@ force_tllao - BOOLEAN ...@@ -1905,9 +2146,10 @@ force_tllao - BOOLEAN
ndisc_notify - BOOLEAN ndisc_notify - BOOLEAN
Define mode for notification of address and device changes. Define mode for notification of address and device changes.
0 - (default): do nothing
1 - Generate unsolicited neighbour advertisements when device is brought * 0 - (default): do nothing
up or hardware address changes. * 1 - Generate unsolicited neighbour advertisements when device is brought
up or hardware address changes.
ndisc_tclass - INTEGER ndisc_tclass - INTEGER
The IPv6 Traffic Class to use by default when sending IPv6 Neighbor The IPv6 Traffic Class to use by default when sending IPv6 Neighbor
...@@ -1916,33 +2158,38 @@ ndisc_tclass - INTEGER ...@@ -1916,33 +2158,38 @@ ndisc_tclass - INTEGER
These 8 bits can be interpreted as 6 high order bits holding the DSCP These 8 bits can be interpreted as 6 high order bits holding the DSCP
value and 2 low order bits representing ECN (which you probably want value and 2 low order bits representing ECN (which you probably want
to leave cleared). to leave cleared).
0 - (default)
* 0 - (default)
mldv1_unsolicited_report_interval - INTEGER mldv1_unsolicited_report_interval - INTEGER
The interval in milliseconds in which the next unsolicited The interval in milliseconds in which the next unsolicited
MLDv1 report retransmit will take place. MLDv1 report retransmit will take place.
Default: 10000 (10 seconds) Default: 10000 (10 seconds)
mldv2_unsolicited_report_interval - INTEGER mldv2_unsolicited_report_interval - INTEGER
The interval in milliseconds in which the next unsolicited The interval in milliseconds in which the next unsolicited
MLDv2 report retransmit will take place. MLDv2 report retransmit will take place.
Default: 1000 (1 second) Default: 1000 (1 second)
force_mld_version - INTEGER force_mld_version - INTEGER
0 - (default) No enforcement of a MLD version, MLDv1 fallback allowed * 0 - (default) No enforcement of a MLD version, MLDv1 fallback allowed
1 - Enforce to use MLD version 1 * 1 - Enforce to use MLD version 1
2 - Enforce to use MLD version 2 * 2 - Enforce to use MLD version 2
suppress_frag_ndisc - INTEGER suppress_frag_ndisc - INTEGER
Control RFC 6980 (Security Implications of IPv6 Fragmentation Control RFC 6980 (Security Implications of IPv6 Fragmentation
with IPv6 Neighbor Discovery) behavior: with IPv6 Neighbor Discovery) behavior:
1 - (default) discard fragmented neighbor discovery packets
0 - allow fragmented neighbor discovery packets * 1 - (default) discard fragmented neighbor discovery packets
* 0 - allow fragmented neighbor discovery packets
optimistic_dad - BOOLEAN optimistic_dad - BOOLEAN
Whether to perform Optimistic Duplicate Address Detection (RFC 4429). Whether to perform Optimistic Duplicate Address Detection (RFC 4429).
0: disabled (default)
1: enabled * 0: disabled (default)
* 1: enabled
Optimistic Duplicate Address Detection for the interface will be enabled Optimistic Duplicate Address Detection for the interface will be enabled
if at least one of conf/{all,interface}/optimistic_dad is set to 1, if at least one of conf/{all,interface}/optimistic_dad is set to 1,
...@@ -1953,8 +2200,9 @@ use_optimistic - BOOLEAN ...@@ -1953,8 +2200,9 @@ use_optimistic - BOOLEAN
source address selection. Preferred addresses will still be chosen source address selection. Preferred addresses will still be chosen
before optimistic addresses, subject to other ranking in the source before optimistic addresses, subject to other ranking in the source
address selection algorithm. address selection algorithm.
0: disabled (default)
1: enabled * 0: disabled (default)
* 1: enabled
This will be enabled if at least one of This will be enabled if at least one of
conf/{all,interface}/use_optimistic is set to 1, disabled otherwise. conf/{all,interface}/use_optimistic is set to 1, disabled otherwise.
...@@ -1976,12 +2224,14 @@ stable_secret - IPv6 address ...@@ -1976,12 +2224,14 @@ stable_secret - IPv6 address
addr_gen_mode - INTEGER addr_gen_mode - INTEGER
Defines how link-local and autoconf addresses are generated. Defines how link-local and autoconf addresses are generated.
0: generate address based on EUI64 (default) = =================================================================
1: do no generate a link-local address, use EUI64 for addresses generated 0 generate address based on EUI64 (default)
from autoconf 1 do no generate a link-local address, use EUI64 for addresses
2: generate stable privacy addresses, using the secret from generated from autoconf
2 generate stable privacy addresses, using the secret from
stable_secret (RFC7217) stable_secret (RFC7217)
3: generate stable privacy addresses, using a random secret if unset 3 generate stable privacy addresses, using a random secret if unset
= =================================================================
drop_unicast_in_l2_multicast - BOOLEAN drop_unicast_in_l2_multicast - BOOLEAN
Drop any unicast IPv6 packets that are received in link-layer Drop any unicast IPv6 packets that are received in link-layer
...@@ -2003,13 +2253,18 @@ enhanced_dad - BOOLEAN ...@@ -2003,13 +2253,18 @@ enhanced_dad - BOOLEAN
detection of duplicates due to loopback of the NS messages that we send. detection of duplicates due to loopback of the NS messages that we send.
The nonce option will be sent on an interface unless both of The nonce option will be sent on an interface unless both of
conf/{all,interface}/enhanced_dad are set to FALSE. conf/{all,interface}/enhanced_dad are set to FALSE.
Default: TRUE Default: TRUE
icmp/*: ``icmp/*``:
===========
ratelimit - INTEGER ratelimit - INTEGER
Limit the maximal rates for sending ICMPv6 messages. Limit the maximal rates for sending ICMPv6 messages.
0 to disable any limiting, 0 to disable any limiting,
otherwise the minimal space between responses in milliseconds. otherwise the minimal space between responses in milliseconds.
Default: 1000 Default: 1000
ratemask - list of comma separated ranges ratemask - list of comma separated ranges
...@@ -2030,16 +2285,19 @@ ratemask - list of comma separated ranges ...@@ -2030,16 +2285,19 @@ ratemask - list of comma separated ranges
echo_ignore_all - BOOLEAN echo_ignore_all - BOOLEAN
If set non-zero, then the kernel will ignore all ICMP ECHO If set non-zero, then the kernel will ignore all ICMP ECHO
requests sent to it over the IPv6 protocol. requests sent to it over the IPv6 protocol.
Default: 0 Default: 0
echo_ignore_multicast - BOOLEAN echo_ignore_multicast - BOOLEAN
If set non-zero, then the kernel will ignore all ICMP ECHO If set non-zero, then the kernel will ignore all ICMP ECHO
requests sent to it over the IPv6 protocol via multicast. requests sent to it over the IPv6 protocol via multicast.
Default: 0 Default: 0
echo_ignore_anycast - BOOLEAN echo_ignore_anycast - BOOLEAN
If set non-zero, then the kernel will ignore all ICMP ECHO If set non-zero, then the kernel will ignore all ICMP ECHO
requests sent to it over the IPv6 protocol destined to anycast address. requests sent to it over the IPv6 protocol destined to anycast address.
Default: 0 Default: 0
xfrm6_gc_thresh - INTEGER xfrm6_gc_thresh - INTEGER
...@@ -2055,43 +2313,52 @@ YOSHIFUJI Hideaki / USAGI Project <yoshfuji@linux-ipv6.org> ...@@ -2055,43 +2313,52 @@ YOSHIFUJI Hideaki / USAGI Project <yoshfuji@linux-ipv6.org>
/proc/sys/net/bridge/* Variables: /proc/sys/net/bridge/* Variables:
=================================
bridge-nf-call-arptables - BOOLEAN bridge-nf-call-arptables - BOOLEAN
1 : pass bridged ARP traffic to arptables' FORWARD chain. - 1 : pass bridged ARP traffic to arptables' FORWARD chain.
0 : disable this. - 0 : disable this.
Default: 1 Default: 1
bridge-nf-call-iptables - BOOLEAN bridge-nf-call-iptables - BOOLEAN
1 : pass bridged IPv4 traffic to iptables' chains. - 1 : pass bridged IPv4 traffic to iptables' chains.
0 : disable this. - 0 : disable this.
Default: 1 Default: 1
bridge-nf-call-ip6tables - BOOLEAN bridge-nf-call-ip6tables - BOOLEAN
1 : pass bridged IPv6 traffic to ip6tables' chains. - 1 : pass bridged IPv6 traffic to ip6tables' chains.
0 : disable this. - 0 : disable this.
Default: 1 Default: 1
bridge-nf-filter-vlan-tagged - BOOLEAN bridge-nf-filter-vlan-tagged - BOOLEAN
1 : pass bridged vlan-tagged ARP/IP/IPv6 traffic to {arp,ip,ip6}tables. - 1 : pass bridged vlan-tagged ARP/IP/IPv6 traffic to {arp,ip,ip6}tables.
0 : disable this. - 0 : disable this.
Default: 0 Default: 0
bridge-nf-filter-pppoe-tagged - BOOLEAN bridge-nf-filter-pppoe-tagged - BOOLEAN
1 : pass bridged pppoe-tagged IP/IPv6 traffic to {ip,ip6}tables. - 1 : pass bridged pppoe-tagged IP/IPv6 traffic to {ip,ip6}tables.
0 : disable this. - 0 : disable this.
Default: 0 Default: 0
bridge-nf-pass-vlan-input-dev - BOOLEAN bridge-nf-pass-vlan-input-dev - BOOLEAN
1: if bridge-nf-filter-vlan-tagged is enabled, try to find a vlan - 1: if bridge-nf-filter-vlan-tagged is enabled, try to find a vlan
interface on the bridge and set the netfilter input device to the vlan. interface on the bridge and set the netfilter input device to the
This allows use of e.g. "iptables -i br0.1" and makes the REDIRECT vlan. This allows use of e.g. "iptables -i br0.1" and makes the
target work with vlan-on-top-of-bridge interfaces. When no matching REDIRECT target work with vlan-on-top-of-bridge interfaces. When no
vlan interface is found, or this switch is off, the input device is matching vlan interface is found, or this switch is off, the input
set to the bridge interface. device is set to the bridge interface.
0: disable bridge netfilter vlan interface lookup.
- 0: disable bridge netfilter vlan interface lookup.
Default: 0 Default: 0
proc/sys/net/sctp/* Variables: ``proc/sys/net/sctp/*`` Variables:
==================================
addip_enable - BOOLEAN addip_enable - BOOLEAN
Enable or disable extension of Dynamic Address Reconfiguration Enable or disable extension of Dynamic Address Reconfiguration
...@@ -2156,11 +2423,13 @@ addip_noauth_enable - BOOLEAN ...@@ -2156,11 +2423,13 @@ addip_noauth_enable - BOOLEAN
we provide this variable to control the enforcement of the we provide this variable to control the enforcement of the
authentication requirement. authentication requirement.
1: Allow ADD-IP extension to be used without authentication. This == ===============================================================
1 Allow ADD-IP extension to be used without authentication. This
should only be set in a closed environment for interoperability should only be set in a closed environment for interoperability
with older implementations. with older implementations.
0: Enforce the authentication requirement 0 Enforce the authentication requirement
== ===============================================================
Default: 0 Default: 0
...@@ -2170,8 +2439,8 @@ auth_enable - BOOLEAN ...@@ -2170,8 +2439,8 @@ auth_enable - BOOLEAN
required for secure operation of Dynamic Address Reconfiguration required for secure operation of Dynamic Address Reconfiguration
(ADD-IP) extension. (ADD-IP) extension.
1: Enable this extension. - 1: Enable this extension.
0: Disable this extension. - 0: Disable this extension.
Default: 0 Default: 0
...@@ -2179,8 +2448,8 @@ prsctp_enable - BOOLEAN ...@@ -2179,8 +2448,8 @@ prsctp_enable - BOOLEAN
Enable or disable the Partial Reliability extension (RFC3758) which Enable or disable the Partial Reliability extension (RFC3758) which
is used to notify peers that a given DATA should no longer be expected. is used to notify peers that a given DATA should no longer be expected.
1: Enable extension - 1: Enable extension
0: Disable - 0: Disable
Default: 1 Default: 1
...@@ -2282,8 +2551,8 @@ cookie_preserve_enable - BOOLEAN ...@@ -2282,8 +2551,8 @@ cookie_preserve_enable - BOOLEAN
Enable or disable the ability to extend the lifetime of the SCTP cookie Enable or disable the ability to extend the lifetime of the SCTP cookie
that is used during the establishment phase of SCTP association that is used during the establishment phase of SCTP association
1: Enable cookie lifetime extension. - 1: Enable cookie lifetime extension.
0: Disable - 0: Disable
Default: 1 Default: 1
...@@ -2291,9 +2560,11 @@ cookie_hmac_alg - STRING ...@@ -2291,9 +2560,11 @@ cookie_hmac_alg - STRING
Select the hmac algorithm used when generating the cookie value sent by Select the hmac algorithm used when generating the cookie value sent by
a listening sctp socket to a connecting client in the INIT-ACK chunk. a listening sctp socket to a connecting client in the INIT-ACK chunk.
Valid values are: Valid values are:
* md5 * md5
* sha1 * sha1
* none * none
Ability to assign md5 or sha1 as the selected alg is predicated on the Ability to assign md5 or sha1 as the selected alg is predicated on the
configuration of those algorithms at build time (CONFIG_CRYPTO_MD5 and configuration of those algorithms at build time (CONFIG_CRYPTO_MD5 and
CONFIG_CRYPTO_SHA1). CONFIG_CRYPTO_SHA1).
...@@ -2312,16 +2583,16 @@ rcvbuf_policy - INTEGER ...@@ -2312,16 +2583,16 @@ rcvbuf_policy - INTEGER
to each association instead of the socket. This prevents the described to each association instead of the socket. This prevents the described
blocking. blocking.
1: rcvbuf space is per association - 1: rcvbuf space is per association
0: rcvbuf space is per socket - 0: rcvbuf space is per socket
Default: 0 Default: 0
sndbuf_policy - INTEGER sndbuf_policy - INTEGER
Similar to rcvbuf_policy above, this applies to send buffer space. Similar to rcvbuf_policy above, this applies to send buffer space.
1: Send buffer is tracked per association - 1: Send buffer is tracked per association
0: Send buffer is tracked per socket. - 0: Send buffer is tracked per socket.
Default: 0 Default: 0
...@@ -2354,19 +2625,23 @@ sctp_wmem - vector of 3 INTEGERs: min, default, max ...@@ -2354,19 +2625,23 @@ sctp_wmem - vector of 3 INTEGERs: min, default, max
addr_scope_policy - INTEGER addr_scope_policy - INTEGER
Control IPv4 address scoping - draft-stewart-tsvwg-sctp-ipv4-00 Control IPv4 address scoping - draft-stewart-tsvwg-sctp-ipv4-00
0 - Disable IPv4 address scoping - 0 - Disable IPv4 address scoping
1 - Enable IPv4 address scoping - 1 - Enable IPv4 address scoping
2 - Follow draft but allow IPv4 private addresses - 2 - Follow draft but allow IPv4 private addresses
3 - Follow draft but allow IPv4 link local addresses - 3 - Follow draft but allow IPv4 link local addresses
Default: 1 Default: 1
/proc/sys/net/core/* ``/proc/sys/net/core/*``
========================
Please see: Documentation/admin-guide/sysctl/net.rst for descriptions of these entries. Please see: Documentation/admin-guide/sysctl/net.rst for descriptions of these entries.
/proc/sys/net/unix/* ``/proc/sys/net/unix/*``
========================
max_dgram_qlen - INTEGER max_dgram_qlen - INTEGER
The maximum length of dgram socket receive queue The maximum length of dgram socket receive queue
......
Documentation/networking/snmp_counter.rst
View file @ 1cec2cac
...@@ -792,7 +792,7 @@ counters to indicate the ACK is skipped in which scenario. The ACK ...@@ -792,7 +792,7 @@ counters to indicate the ACK is skipped in which scenario. The ACK
would only be skipped if the received packet is either a SYN packet or would only be skipped if the received packet is either a SYN packet or
it has no data. it has no data.
.. _sysctl document: https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt .. _sysctl document: https://www.kernel.org/doc/Documentation/networking/ip-sysctl.rst
* TcpExtTCPACKSkippedSynRecv * TcpExtTCPACKSkippedSynRecv
......
net/Kconfig
View file @ 1cec2cac
...@@ -86,7 +86,7 @@ config INET ...@@ -86,7 +86,7 @@ config INET
"Sysctl support" below, you can change various aspects of the "Sysctl support" below, you can change various aspects of the
behavior of the TCP/IP code by writing to the (virtual) files in behavior of the TCP/IP code by writing to the (virtual) files in
/proc/sys/net/ipv4/*; the options are explained in the file /proc/sys/net/ipv4/*; the options are explained in the file
<file:Documentation/networking/ip-sysctl.txt>. <file:Documentation/networking/ip-sysctl.rst>.
Short answer: say Y. Short answer: say Y.
......
net/ipv4/Kconfig
View file @ 1cec2cac
...@@ -49,7 +49,7 @@ config IP_ADVANCED_ROUTER ...@@ -49,7 +49,7 @@ config IP_ADVANCED_ROUTER
Note that some distributions enable it in startup scripts. Note that some distributions enable it in startup scripts.
For details about rp_filter strict and loose mode read For details about rp_filter strict and loose mode read
<file:Documentation/networking/ip-sysctl.txt>. <file:Documentation/networking/ip-sysctl.rst>.
If unsure, say N here. If unsure, say N here.
......
net/ipv4/icmp.c
View file @ 1cec2cac
...@@ -853,7 +853,7 @@ static bool icmp_unreach(struct sk_buff *skb) ...@@ -853,7 +853,7 @@ static bool icmp_unreach(struct sk_buff *skb)
case ICMP_FRAG_NEEDED: case ICMP_FRAG_NEEDED:
/* for documentation of the ip_no_pmtu_disc /* for documentation of the ip_no_pmtu_disc
* values please see * values please see
* Documentation/networking/ip-sysctl.txt * Documentation/networking/ip-sysctl.rst
*/ */
switch (net->ipv4.sysctl_ip_no_pmtu_disc) { switch (net->ipv4.sysctl_ip_no_pmtu_disc) {
default: default:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7