1/proc/sys/net/ipv4/* Variables: 2 3ip_forward - BOOLEAN 4 0 - disabled (default) 5 not 0 - enabled 6 7 Forward Packets between interfaces. 8 9 This variable is special, its change resets all configuration 10 parameters to their default state (RFC1122 for hosts, RFC1812 11 for routers) 12 13ip_default_ttl - INTEGER 14 Default value of TTL field (Time To Live) for outgoing (but not 15 forwarded) IP packets. Should be between 1 and 255 inclusive. 16 Default: 64 (as recommended by RFC1700) 17 18ip_no_pmtu_disc - INTEGER 19 Disable Path MTU Discovery. If enabled in mode 1 and a 20 fragmentation-required ICMP is received, the PMTU to this 21 destination will be set to min_pmtu (see below). You will need 22 to raise min_pmtu to the smallest interface MTU on your system 23 manually if you want to avoid locally generated fragments. 24 25 In mode 2 incoming Path MTU Discovery messages will be 26 discarded. Outgoing frames are handled the same as in mode 1, 27 implicitly setting IP_PMTUDISC_DONT on every created socket. 28 29 Mode 3 is a hardend pmtu discover mode. The kernel will only 30 accept fragmentation-needed errors if the underlying protocol 31 can verify them besides a plain socket lookup. Current 32 protocols for which pmtu events will be honored are TCP, SCTP 33 and DCCP as they verify e.g. the sequence number or the 34 association. This mode should not be enabled globally but is 35 only intended to secure e.g. name servers in namespaces where 36 TCP path mtu must still work but path MTU information of other 37 protocols should be discarded. If enabled globally this mode 38 could break other protocols. 39 40 Possible values: 0-3 41 Default: FALSE 42 43min_pmtu - INTEGER 44 default 552 - minimum discovered Path MTU 45 46ip_forward_use_pmtu - BOOLEAN 47 By default we don't trust protocol path MTUs while forwarding 48 because they could be easily forged and can lead to unwanted 49 fragmentation by the router. 50 You only need to enable this if you have user-space software 51 which tries to discover path mtus by itself and depends on the 52 kernel honoring this information. This is normally not the 53 case. 54 Default: 0 (disabled) 55 Possible values: 56 0 - disabled 57 1 - enabled 58 59route/max_size - INTEGER 60 Maximum number of routes allowed in the kernel. Increase 61 this when using large numbers of interfaces and/or routes. 62 63neigh/default/gc_thresh1 - INTEGER 64 Minimum number of entries to keep. Garbage collector will not 65 purge entries if there are fewer than this number. 66 Default: 128 67 68neigh/default/gc_thresh3 - INTEGER 69 Maximum number of neighbor entries allowed. Increase this 70 when using large numbers of interfaces and when communicating 71 with large numbers of directly-connected peers. 72 Default: 1024 73 74neigh/default/unres_qlen_bytes - INTEGER 75 The maximum number of bytes which may be used by packets 76 queued for each unresolved address by other network layers. 77 (added in linux 3.3) 78 Setting negative value is meaningless and will return error. 79 Default: 65536 Bytes(64KB) 80 81neigh/default/unres_qlen - INTEGER 82 The maximum number of packets which may be queued for each 83 unresolved address by other network layers. 84 (deprecated in linux 3.3) : use unres_qlen_bytes instead. 85 Prior to linux 3.3, the default value is 3 which may cause 86 unexpected packet loss. The current default value is calculated 87 according to default value of unres_qlen_bytes and true size of 88 packet. 89 Default: 31 90 91mtu_expires - INTEGER 92 Time, in seconds, that cached PMTU information is kept. 93 94min_adv_mss - INTEGER 95 The advertised MSS depends on the first hop route MTU, but will 96 never be lower than this setting. 97 98IP Fragmentation: 99 100ipfrag_high_thresh - INTEGER 101 Maximum memory used to reassemble IP fragments. When 102 ipfrag_high_thresh bytes of memory is allocated for this purpose, 103 the fragment handler will toss packets until ipfrag_low_thresh 104 is reached. 105 106ipfrag_low_thresh - INTEGER 107 See ipfrag_high_thresh 108 109ipfrag_time - INTEGER 110 Time in seconds to keep an IP fragment in memory. 111 112ipfrag_secret_interval - INTEGER 113 Regeneration interval (in seconds) of the hash secret (or lifetime 114 for the hash secret) for IP fragments. 115 Default: 600 116 117ipfrag_max_dist - INTEGER 118 ipfrag_max_dist is a non-negative integer value which defines the 119 maximum "disorder" which is allowed among fragments which share a 120 common IP source address. Note that reordering of packets is 121 not unusual, but if a large number of fragments arrive from a source 122 IP address while a particular fragment queue remains incomplete, it 123 probably indicates that one or more fragments belonging to that queue 124 have been lost. When ipfrag_max_dist is positive, an additional check 125 is done on fragments before they are added to a reassembly queue - if 126 ipfrag_max_dist (or more) fragments have arrived from a particular IP 127 address between additions to any IP fragment queue using that source 128 address, it's presumed that one or more fragments in the queue are 129 lost. The existing fragment queue will be dropped, and a new one 130 started. An ipfrag_max_dist value of zero disables this check. 131 132 Using a very small value, e.g. 1 or 2, for ipfrag_max_dist can 133 result in unnecessarily dropping fragment queues when normal 134 reordering of packets occurs, which could lead to poor application 135 performance. Using a very large value, e.g. 50000, increases the 136 likelihood of incorrectly reassembling IP fragments that originate 137 from different IP datagrams, which could result in data corruption. 138 Default: 64 139 140INET peer storage: 141 142inet_peer_threshold - INTEGER 143 The approximate size of the storage. Starting from this threshold 144 entries will be thrown aggressively. This threshold also determines 145 entries' time-to-live and time intervals between garbage collection 146 passes. More entries, less time-to-live, less GC interval. 147 148inet_peer_minttl - INTEGER 149 Minimum time-to-live of entries. Should be enough to cover fragment 150 time-to-live on the reassembling side. This minimum time-to-live is 151 guaranteed if the pool size is less than inet_peer_threshold. 152 Measured in seconds. 153 154inet_peer_maxttl - INTEGER 155 Maximum time-to-live of entries. Unused entries will expire after 156 this period of time if there is no memory pressure on the pool (i.e. 157 when the number of entries in the pool is very small). 158 Measured in seconds. 159 160TCP variables: 161 162somaxconn - INTEGER 163 Limit of socket listen() backlog, known in userspace as SOMAXCONN. 164 Defaults to 128. See also tcp_max_syn_backlog for additional tuning 165 for TCP sockets. 166 167tcp_abort_on_overflow - BOOLEAN 168 If listening service is too slow to accept new connections, 169 reset them. Default state is FALSE. It means that if overflow 170 occurred due to a burst, connection will recover. Enable this 171 option _only_ if you are really sure that listening daemon 172 cannot be tuned to accept connections faster. Enabling this 173 option can harm clients of your server. 174 175tcp_adv_win_scale - INTEGER 176 Count buffering overhead as bytes/2^tcp_adv_win_scale 177 (if tcp_adv_win_scale > 0) or bytes-bytes/2^(-tcp_adv_win_scale), 178 if it is <= 0. 179 Possible values are [-31, 31], inclusive. 180 Default: 1 181 182tcp_allowed_congestion_control - STRING 183 Show/set the congestion control choices available to non-privileged 184 processes. The list is a subset of those listed in 185 tcp_available_congestion_control. 186 Default is "reno" and the default setting (tcp_congestion_control). 187 188tcp_app_win - INTEGER 189 Reserve max(window/2^tcp_app_win, mss) of window for application 190 buffer. Value 0 is special, it means that nothing is reserved. 191 Default: 31 192 193tcp_autocorking - BOOLEAN 194 Enable TCP auto corking : 195 When applications do consecutive small write()/sendmsg() system calls, 196 we try to coalesce these small writes as much as possible, to lower 197 total amount of sent packets. This is done if at least one prior 198 packet for the flow is waiting in Qdisc queues or device transmit 199 queue. Applications can still use TCP_CORK for optimal behavior 200 when they know how/when to uncork their sockets. 201 Default : 1 202 203tcp_available_congestion_control - STRING 204 Shows the available congestion control choices that are registered. 205 More congestion control algorithms may be available as modules, 206 but not loaded. 207 208tcp_base_mss - INTEGER 209 The initial value of search_low to be used by the packetization layer 210 Path MTU discovery (MTU probing). If MTU probing is enabled, 211 this is the initial MSS used by the connection. 212 213tcp_congestion_control - STRING 214 Set the congestion control algorithm to be used for new 215 connections. The algorithm "reno" is always available, but 216 additional choices may be available based on kernel configuration. 217 Default is set as part of kernel configuration. 218 For passive connections, the listener congestion control choice 219 is inherited. 220 [see setsockopt(listenfd, SOL_TCP, TCP_CONGESTION, "name" ...) ] 221 222tcp_dsack - BOOLEAN 223 Allows TCP to send "duplicate" SACKs. 224 225tcp_early_retrans - INTEGER 226 Enable Early Retransmit (ER), per RFC 5827. ER lowers the threshold 227 for triggering fast retransmit when the amount of outstanding data is 228 small and when no previously unsent data can be transmitted (such 229 that limited transmit could be used). Also controls the use of 230 Tail loss probe (TLP) that converts RTOs occurring due to tail 231 losses into fast recovery (draft-dukkipati-tcpm-tcp-loss-probe-01). 232 Possible values: 233 0 disables ER 234 1 enables ER 235 2 enables ER but delays fast recovery and fast retransmit 236 by a fourth of RTT. This mitigates connection falsely 237 recovers when network has a small degree of reordering 238 (less than 3 packets). 239 3 enables delayed ER and TLP. 240 4 enables TLP only. 241 Default: 3 242 243tcp_ecn - INTEGER 244 Control use of Explicit Congestion Notification (ECN) by TCP. 245 ECN is used only when both ends of the TCP connection indicate 246 support for it. This feature is useful in avoiding losses due 247 to congestion by allowing supporting routers to signal 248 congestion before having to drop packets. 249 Possible values are: 250 0 Disable ECN. Neither initiate nor accept ECN. 251 1 Enable ECN when requested by incoming connections and 252 also request ECN on outgoing connection attempts. 253 2 Enable ECN when requested by incoming connections 254 but do not request ECN on outgoing connections. 255 Default: 2 256 257tcp_fack - BOOLEAN 258 Enable FACK congestion avoidance and fast retransmission. 259 The value is not used, if tcp_sack is not enabled. 260 261tcp_fin_timeout - INTEGER 262 The length of time an orphaned (no longer referenced by any 263 application) connection will remain in the FIN_WAIT_2 state 264 before it is aborted at the local end. While a perfectly 265 valid "receive only" state for an un-orphaned connection, an 266 orphaned connection in FIN_WAIT_2 state could otherwise wait 267 forever for the remote to close its end of the connection. 268 Cf. tcp_max_orphans 269 Default: 60 seconds 270 271tcp_frto - INTEGER 272 Enables Forward RTO-Recovery (F-RTO) defined in RFC5682. 273 F-RTO is an enhanced recovery algorithm for TCP retransmission 274 timeouts. It is particularly beneficial in networks where the 275 RTT fluctuates (e.g., wireless). F-RTO is sender-side only 276 modification. It does not require any support from the peer. 277 278 By default it's enabled with a non-zero value. 0 disables F-RTO. 279 280tcp_keepalive_time - INTEGER 281 How often TCP sends out keepalive messages when keepalive is enabled. 282 Default: 2hours. 283 284tcp_keepalive_probes - INTEGER 285 How many keepalive probes TCP sends out, until it decides that the 286 connection is broken. Default value: 9. 287 288tcp_keepalive_intvl - INTEGER 289 How frequently the probes are send out. Multiplied by 290 tcp_keepalive_probes it is time to kill not responding connection, 291 after probes started. Default value: 75sec i.e. connection 292 will be aborted after ~11 minutes of retries. 293 294tcp_low_latency - BOOLEAN 295 If set, the TCP stack makes decisions that prefer lower 296 latency as opposed to higher throughput. By default, this 297 option is not set meaning that higher throughput is preferred. 298 An example of an application where this default should be 299 changed would be a Beowulf compute cluster. 300 Default: 0 301 302tcp_max_orphans - INTEGER 303 Maximal number of TCP sockets not attached to any user file handle, 304 held by system. If this number is exceeded orphaned connections are 305 reset immediately and warning is printed. This limit exists 306 only to prevent simple DoS attacks, you _must_ not rely on this 307 or lower the limit artificially, but rather increase it 308 (probably, after increasing installed memory), 309 if network conditions require more than default value, 310 and tune network services to linger and kill such states 311 more aggressively. Let me to remind again: each orphan eats 312 up to ~64K of unswappable memory. 313 314tcp_max_syn_backlog - INTEGER 315 Maximal number of remembered connection requests, which have not 316 received an acknowledgment from connecting client. 317 The minimal value is 128 for low memory machines, and it will 318 increase in proportion to the memory of machine. 319 If server suffers from overload, try increasing this number. 320 321tcp_max_tw_buckets - INTEGER 322 Maximal number of timewait sockets held by system simultaneously. 323 If this number is exceeded time-wait socket is immediately destroyed 324 and warning is printed. This limit exists only to prevent 325 simple DoS attacks, you _must_ not lower the limit artificially, 326 but rather increase it (probably, after increasing installed memory), 327 if network conditions require more than default value. 328 329tcp_mem - vector of 3 INTEGERs: min, pressure, max 330 min: below this number of pages TCP is not bothered about its 331 memory appetite. 332 333 pressure: when amount of memory allocated by TCP exceeds this number 334 of pages, TCP moderates its memory consumption and enters memory 335 pressure mode, which is exited when memory consumption falls 336 under "min". 337 338 max: number of pages allowed for queueing by all TCP sockets. 339 340 Defaults are calculated at boot time from amount of available 341 memory. 342 343tcp_moderate_rcvbuf - BOOLEAN 344 If set, TCP performs receive buffer auto-tuning, attempting to 345 automatically size the buffer (no greater than tcp_rmem[2]) to 346 match the size required by the path for full throughput. Enabled by 347 default. 348 349tcp_mtu_probing - INTEGER 350 Controls TCP Packetization-Layer Path MTU Discovery. Takes three 351 values: 352 0 - Disabled 353 1 - Disabled by default, enabled when an ICMP black hole detected 354 2 - Always enabled, use initial MSS of tcp_base_mss. 355 356tcp_no_metrics_save - BOOLEAN 357 By default, TCP saves various connection metrics in the route cache 358 when the connection closes, so that connections established in the 359 near future can use these to set initial conditions. Usually, this 360 increases overall performance, but may sometimes cause performance 361 degradation. If set, TCP will not cache metrics on closing 362 connections. 363 364tcp_orphan_retries - INTEGER 365 This value influences the timeout of a locally closed TCP connection, 366 when RTO retransmissions remain unacknowledged. 367 See tcp_retries2 for more details. 368 369 The default value is 8. 370 If your machine is a loaded WEB server, 371 you should think about lowering this value, such sockets 372 may consume significant resources. Cf. tcp_max_orphans. 373 374tcp_reordering - INTEGER 375 Maximal reordering of packets in a TCP stream. 376 Default: 3 377 378tcp_retrans_collapse - BOOLEAN 379 Bug-to-bug compatibility with some broken printers. 380 On retransmit try to send bigger packets to work around bugs in 381 certain TCP stacks. 382 383tcp_retries1 - INTEGER 384 This value influences the time, after which TCP decides, that 385 something is wrong due to unacknowledged RTO retransmissions, 386 and reports this suspicion to the network layer. 387 See tcp_retries2 for more details. 388 389 RFC 1122 recommends at least 3 retransmissions, which is the 390 default. 391 392tcp_retries2 - INTEGER 393 This value influences the timeout of an alive TCP connection, 394 when RTO retransmissions remain unacknowledged. 395 Given a value of N, a hypothetical TCP connection following 396 exponential backoff with an initial RTO of TCP_RTO_MIN would 397 retransmit N times before killing the connection at the (N+1)th RTO. 398 399 The default value of 15 yields a hypothetical timeout of 924.6 400 seconds and is a lower bound for the effective timeout. 401 TCP will effectively time out at the first RTO which exceeds the 402 hypothetical timeout. 403 404 RFC 1122 recommends at least 100 seconds for the timeout, 405 which corresponds to a value of at least 8. 406 407tcp_rfc1337 - BOOLEAN 408 If set, the TCP stack behaves conforming to RFC1337. If unset, 409 we are not conforming to RFC, but prevent TCP TIME_WAIT 410 assassination. 411 Default: 0 412 413tcp_rmem - vector of 3 INTEGERs: min, default, max 414 min: Minimal size of receive buffer used by TCP sockets. 415 It is guaranteed to each TCP socket, even under moderate memory 416 pressure. 417 Default: 1 page 418 419 default: initial size of receive buffer used by TCP sockets. 420 This value overrides net.core.rmem_default used by other protocols. 421 Default: 87380 bytes. This value results in window of 65535 with 422 default setting of tcp_adv_win_scale and tcp_app_win:0 and a bit 423 less for default tcp_app_win. See below about these variables. 424 425 max: maximal size of receive buffer allowed for automatically 426 selected receiver buffers for TCP socket. This value does not override 427 net.core.rmem_max. Calling setsockopt() with SO_RCVBUF disables 428 automatic tuning of that socket's receive buffer size, in which 429 case this value is ignored. 430 Default: between 87380B and 6MB, depending on RAM size. 431 432tcp_sack - BOOLEAN 433 Enable select acknowledgments (SACKS). 434 435tcp_slow_start_after_idle - BOOLEAN 436 If set, provide RFC2861 behavior and time out the congestion 437 window after an idle period. An idle period is defined at 438 the current RTO. If unset, the congestion window will not 439 be timed out after an idle period. 440 Default: 1 441 442tcp_stdurg - BOOLEAN 443 Use the Host requirements interpretation of the TCP urgent pointer field. 444 Most hosts use the older BSD interpretation, so if you turn this on 445 Linux might not communicate correctly with them. 446 Default: FALSE 447 448tcp_synack_retries - INTEGER 449 Number of times SYNACKs for a passive TCP connection attempt will 450 be retransmitted. Should not be higher than 255. Default value 451 is 5, which corresponds to 31seconds till the last retransmission 452 with the current initial RTO of 1second. With this the final timeout 453 for a passive TCP connection will happen after 63seconds. 454 455tcp_syncookies - BOOLEAN 456 Only valid when the kernel was compiled with CONFIG_SYN_COOKIES 457 Send out syncookies when the syn backlog queue of a socket 458 overflows. This is to prevent against the common 'SYN flood attack' 459 Default: 1 460 461 Note, that syncookies is fallback facility. 462 It MUST NOT be used to help highly loaded servers to stand 463 against legal connection rate. If you see SYN flood warnings 464 in your logs, but investigation shows that they occur 465 because of overload with legal connections, you should tune 466 another parameters until this warning disappear. 467 See: tcp_max_syn_backlog, tcp_synack_retries, tcp_abort_on_overflow. 468 469 syncookies seriously violate TCP protocol, do not allow 470 to use TCP extensions, can result in serious degradation 471 of some services (f.e. SMTP relaying), visible not by you, 472 but your clients and relays, contacting you. While you see 473 SYN flood warnings in logs not being really flooded, your server 474 is seriously misconfigured. 475 476 If you want to test which effects syncookies have to your 477 network connections you can set this knob to 2 to enable 478 unconditionally generation of syncookies. 479 480tcp_fastopen - INTEGER 481 Enable TCP Fast Open feature (draft-ietf-tcpm-fastopen) to send data 482 in the opening SYN packet. To use this feature, the client application 483 must use sendmsg() or sendto() with MSG_FASTOPEN flag rather than 484 connect() to perform a TCP handshake automatically. 485 486 The values (bitmap) are 487 1: Enables sending data in the opening SYN on the client w/ MSG_FASTOPEN. 488 2: Enables TCP Fast Open on the server side, i.e., allowing data in 489 a SYN packet to be accepted and passed to the application before 490 3-way hand shake finishes. 491 4: Send data in the opening SYN regardless of cookie availability and 492 without a cookie option. 493 0x100: Accept SYN data w/o validating the cookie. 494 0x200: Accept data-in-SYN w/o any cookie option present. 495 0x400/0x800: Enable Fast Open on all listeners regardless of the 496 TCP_FASTOPEN socket option. The two different flags designate two 497 different ways of setting max_qlen without the TCP_FASTOPEN socket 498 option. 499 500 Default: 1 501 502 Note that the client & server side Fast Open flags (1 and 2 503 respectively) must be also enabled before the rest of flags can take 504 effect. 505 506 See include/net/tcp.h and the code for more details. 507 508tcp_syn_retries - INTEGER 509 Number of times initial SYNs for an active TCP connection attempt 510 will be retransmitted. Should not be higher than 255. Default value 511 is 6, which corresponds to 63seconds till the last retransmission 512 with the current initial RTO of 1second. With this the final timeout 513 for an active TCP connection attempt will happen after 127seconds. 514 515tcp_timestamps - BOOLEAN 516 Enable timestamps as defined in RFC1323. 517 518tcp_min_tso_segs - INTEGER 519 Minimal number of segments per TSO frame. 520 Since linux-3.12, TCP does an automatic sizing of TSO frames, 521 depending on flow rate, instead of filling 64Kbytes packets. 522 For specific usages, it's possible to force TCP to build big 523 TSO frames. Note that TCP stack might split too big TSO packets 524 if available window is too small. 525 Default: 2 526 527tcp_tso_win_divisor - INTEGER 528 This allows control over what percentage of the congestion window 529 can be consumed by a single TSO frame. 530 The setting of this parameter is a choice between burstiness and 531 building larger TSO frames. 532 Default: 3 533 534tcp_tw_recycle - BOOLEAN 535 Enable fast recycling TIME-WAIT sockets. Default value is 0. 536 It should not be changed without advice/request of technical 537 experts. 538 539tcp_tw_reuse - BOOLEAN 540 Allow to reuse TIME-WAIT sockets for new connections when it is 541 safe from protocol viewpoint. Default value is 0. 542 It should not be changed without advice/request of technical 543 experts. 544 545tcp_window_scaling - BOOLEAN 546 Enable window scaling as defined in RFC1323. 547 548tcp_wmem - vector of 3 INTEGERs: min, default, max 549 min: Amount of memory reserved for send buffers for TCP sockets. 550 Each TCP socket has rights to use it due to fact of its birth. 551 Default: 1 page 552 553 default: initial size of send buffer used by TCP sockets. This 554 value overrides net.core.wmem_default used by other protocols. 555 It is usually lower than net.core.wmem_default. 556 Default: 16K 557 558 max: Maximal amount of memory allowed for automatically tuned 559 send buffers for TCP sockets. This value does not override 560 net.core.wmem_max. Calling setsockopt() with SO_SNDBUF disables 561 automatic tuning of that socket's send buffer size, in which case 562 this value is ignored. 563 Default: between 64K and 4MB, depending on RAM size. 564 565tcp_notsent_lowat - UNSIGNED INTEGER 566 A TCP socket can control the amount of unsent bytes in its write queue, 567 thanks to TCP_NOTSENT_LOWAT socket option. poll()/select()/epoll() 568 reports POLLOUT events if the amount of unsent bytes is below a per 569 socket value, and if the write queue is not full. sendmsg() will 570 also not add new buffers if the limit is hit. 571 572 This global variable controls the amount of unsent data for 573 sockets not using TCP_NOTSENT_LOWAT. For these sockets, a change 574 to the global variable has immediate effect. 575 576 Default: UINT_MAX (0xFFFFFFFF) 577 578tcp_workaround_signed_windows - BOOLEAN 579 If set, assume no receipt of a window scaling option means the 580 remote TCP is broken and treats the window as a signed quantity. 581 If unset, assume the remote TCP is not broken even if we do 582 not receive a window scaling option from them. 583 Default: 0 584 585tcp_dma_copybreak - INTEGER 586 Lower limit, in bytes, of the size of socket reads that will be 587 offloaded to a DMA copy engine, if one is present in the system 588 and CONFIG_NET_DMA is enabled. 589 Default: 4096 590 591tcp_thin_linear_timeouts - BOOLEAN 592 Enable dynamic triggering of linear timeouts for thin streams. 593 If set, a check is performed upon retransmission by timeout to 594 determine if the stream is thin (less than 4 packets in flight). 595 As long as the stream is found to be thin, up to 6 linear 596 timeouts may be performed before exponential backoff mode is 597 initiated. This improves retransmission latency for 598 non-aggressive thin streams, often found to be time-dependent. 599 For more information on thin streams, see 600 Documentation/networking/tcp-thin.txt 601 Default: 0 602 603tcp_thin_dupack - BOOLEAN 604 Enable dynamic triggering of retransmissions after one dupACK 605 for thin streams. If set, a check is performed upon reception 606 of a dupACK to determine if the stream is thin (less than 4 607 packets in flight). As long as the stream is found to be thin, 608 data is retransmitted on the first received dupACK. This 609 improves retransmission latency for non-aggressive thin 610 streams, often found to be time-dependent. 611 For more information on thin streams, see 612 Documentation/networking/tcp-thin.txt 613 Default: 0 614 615tcp_limit_output_bytes - INTEGER 616 Controls TCP Small Queue limit per tcp socket. 617 TCP bulk sender tends to increase packets in flight until it 618 gets losses notifications. With SNDBUF autotuning, this can 619 result in a large amount of packets queued in qdisc/device 620 on the local machine, hurting latency of other flows, for 621 typical pfifo_fast qdiscs. 622 tcp_limit_output_bytes limits the number of bytes on qdisc 623 or device to reduce artificial RTT/cwnd and reduce bufferbloat. 624 Default: 131072 625 626tcp_challenge_ack_limit - INTEGER 627 Limits number of Challenge ACK sent per second, as recommended 628 in RFC 5961 (Improving TCP's Robustness to Blind In-Window Attacks) 629 Default: 100 630 631UDP variables: 632 633udp_mem - vector of 3 INTEGERs: min, pressure, max 634 Number of pages allowed for queueing by all UDP sockets. 635 636 min: Below this number of pages UDP is not bothered about its 637 memory appetite. When amount of memory allocated by UDP exceeds 638 this number, UDP starts to moderate memory usage. 639 640 pressure: This value was introduced to follow format of tcp_mem. 641 642 max: Number of pages allowed for queueing by all UDP sockets. 643 644 Default is calculated at boot time from amount of available memory. 645 646udp_rmem_min - INTEGER 647 Minimal size of receive buffer used by UDP sockets in moderation. 648 Each UDP socket is able to use the size for receiving data, even if 649 total pages of UDP sockets exceed udp_mem pressure. The unit is byte. 650 Default: 1 page 651 652udp_wmem_min - INTEGER 653 Minimal size of send buffer used by UDP sockets in moderation. 654 Each UDP socket is able to use the size for sending data, even if 655 total pages of UDP sockets exceed udp_mem pressure. The unit is byte. 656 Default: 1 page 657 658CIPSOv4 Variables: 659 660cipso_cache_enable - BOOLEAN 661 If set, enable additions to and lookups from the CIPSO label mapping 662 cache. If unset, additions are ignored and lookups always result in a 663 miss. However, regardless of the setting the cache is still 664 invalidated when required when means you can safely toggle this on and 665 off and the cache will always be "safe". 666 Default: 1 667 668cipso_cache_bucket_size - INTEGER 669 The CIPSO label cache consists of a fixed size hash table with each 670 hash bucket containing a number of cache entries. This variable limits 671 the number of entries in each hash bucket; the larger the value the 672 more CIPSO label mappings that can be cached. When the number of 673 entries in a given hash bucket reaches this limit adding new entries 674 causes the oldest entry in the bucket to be removed to make room. 675 Default: 10 676 677cipso_rbm_optfmt - BOOLEAN 678 Enable the "Optimized Tag 1 Format" as defined in section 3.4.2.6 of 679 the CIPSO draft specification (see Documentation/netlabel for details). 680 This means that when set the CIPSO tag will be padded with empty 681 categories in order to make the packet data 32-bit aligned. 682 Default: 0 683 684cipso_rbm_structvalid - BOOLEAN 685 If set, do a very strict check of the CIPSO option when 686 ip_options_compile() is called. If unset, relax the checks done during 687 ip_options_compile(). Either way is "safe" as errors are caught else 688 where in the CIPSO processing code but setting this to 0 (False) should 689 result in less work (i.e. it should be faster) but could cause problems 690 with other implementations that require strict checking. 691 Default: 0 692 693IP Variables: 694 695ip_local_port_range - 2 INTEGERS 696 Defines the local port range that is used by TCP and UDP to 697 choose the local port. The first number is the first, the 698 second the last local port number. The default values are 699 32768 and 61000 respectively. 700 701ip_local_reserved_ports - list of comma separated ranges 702 Specify the ports which are reserved for known third-party 703 applications. These ports will not be used by automatic port 704 assignments (e.g. when calling connect() or bind() with port 705 number 0). Explicit port allocation behavior is unchanged. 706 707 The format used for both input and output is a comma separated 708 list of ranges (e.g. "1,2-4,10-10" for ports 1, 2, 3, 4 and 709 10). Writing to the file will clear all previously reserved 710 ports and update the current list with the one given in the 711 input. 712 713 Note that ip_local_port_range and ip_local_reserved_ports 714 settings are independent and both are considered by the kernel 715 when determining which ports are available for automatic port 716 assignments. 717 718 You can reserve ports which are not in the current 719 ip_local_port_range, e.g.: 720 721 $ cat /proc/sys/net/ipv4/ip_local_port_range 722 32000 61000 723 $ cat /proc/sys/net/ipv4/ip_local_reserved_ports 724 8080,9148 725 726 although this is redundant. However such a setting is useful 727 if later the port range is changed to a value that will 728 include the reserved ports. 729 730 Default: Empty 731 732ip_nonlocal_bind - BOOLEAN 733 If set, allows processes to bind() to non-local IP addresses, 734 which can be quite useful - but may break some applications. 735 Default: 0 736 737ip_dynaddr - BOOLEAN 738 If set non-zero, enables support for dynamic addresses. 739 If set to a non-zero value larger than 1, a kernel log 740 message will be printed when dynamic address rewriting 741 occurs. 742 Default: 0 743 744ip_early_demux - BOOLEAN 745 Optimize input packet processing down to one demux for 746 certain kinds of local sockets. Currently we only do this 747 for established TCP sockets. 748 749 It may add an additional cost for pure routing workloads that 750 reduces overall throughput, in such case you should disable it. 751 Default: 1 752 753icmp_echo_ignore_all - BOOLEAN 754 If set non-zero, then the kernel will ignore all ICMP ECHO 755 requests sent to it. 756 Default: 0 757 758icmp_echo_ignore_broadcasts - BOOLEAN 759 If set non-zero, then the kernel will ignore all ICMP ECHO and 760 TIMESTAMP requests sent to it via broadcast/multicast. 761 Default: 1 762 763icmp_ratelimit - INTEGER 764 Limit the maximal rates for sending ICMP packets whose type matches 765 icmp_ratemask (see below) to specific targets. 766 0 to disable any limiting, 767 otherwise the minimal space between responses in milliseconds. 768 Default: 1000 769 770icmp_ratemask - INTEGER 771 Mask made of ICMP types for which rates are being limited. 772 Significant bits: IHGFEDCBA9876543210 773 Default mask: 0000001100000011000 (6168) 774 775 Bit definitions (see include/linux/icmp.h): 776 0 Echo Reply 777 3 Destination Unreachable * 778 4 Source Quench * 779 5 Redirect 780 8 Echo Request 781 B Time Exceeded * 782 C Parameter Problem * 783 D Timestamp Request 784 E Timestamp Reply 785 F Info Request 786 G Info Reply 787 H Address Mask Request 788 I Address Mask Reply 789 790 * These are rate limited by default (see default mask above) 791 792icmp_ignore_bogus_error_responses - BOOLEAN 793 Some routers violate RFC1122 by sending bogus responses to broadcast 794 frames. Such violations are normally logged via a kernel warning. 795 If this is set to TRUE, the kernel will not give such warnings, which 796 will avoid log file clutter. 797 Default: 1 798 799icmp_errors_use_inbound_ifaddr - BOOLEAN 800 801 If zero, icmp error messages are sent with the primary address of 802 the exiting interface. 803 804 If non-zero, the message will be sent with the primary address of 805 the interface that received the packet that caused the icmp error. 806 This is the behaviour network many administrators will expect from 807 a router. And it can make debugging complicated network layouts 808 much easier. 809 810 Note that if no primary address exists for the interface selected, 811 then the primary address of the first non-loopback interface that 812 has one will be used regardless of this setting. 813 814 Default: 0 815 816igmp_max_memberships - INTEGER 817 Change the maximum number of multicast groups we can subscribe to. 818 Default: 20 819 820 Theoretical maximum value is bounded by having to send a membership 821 report in a single datagram (i.e. the report can't span multiple 822 datagrams, or risk confusing the switch and leaving groups you don't 823 intend to). 824 825 The number of supported groups 'M' is bounded by the number of group 826 report entries you can fit into a single datagram of 65535 bytes. 827 828 M = 65536-sizeof (ip header)/(sizeof(Group record)) 829 830 Group records are variable length, with a minimum of 12 bytes. 831 So net.ipv4.igmp_max_memberships should not be set higher than: 832 833 (65536-24) / 12 = 5459 834 835 The value 5459 assumes no IP header options, so in practice 836 this number may be lower. 837 838 conf/interface/* changes special settings per interface (where 839 "interface" is the name of your network interface) 840 841 conf/all/* is special, changes the settings for all interfaces 842 843log_martians - BOOLEAN 844 Log packets with impossible addresses to kernel log. 845 log_martians for the interface will be enabled if at least one of 846 conf/{all,interface}/log_martians is set to TRUE, 847 it will be disabled otherwise 848 849accept_redirects - BOOLEAN 850 Accept ICMP redirect messages. 851 accept_redirects for the interface will be enabled if: 852 - both conf/{all,interface}/accept_redirects are TRUE in the case 853 forwarding for the interface is enabled 854 or 855 - at least one of conf/{all,interface}/accept_redirects is TRUE in the 856 case forwarding for the interface is disabled 857 accept_redirects for the interface will be disabled otherwise 858 default TRUE (host) 859 FALSE (router) 860 861forwarding - BOOLEAN 862 Enable IP forwarding on this interface. 863 864mc_forwarding - BOOLEAN 865 Do multicast routing. The kernel needs to be compiled with CONFIG_MROUTE 866 and a multicast routing daemon is required. 867 conf/all/mc_forwarding must also be set to TRUE to enable multicast 868 routing for the interface 869 870medium_id - INTEGER 871 Integer value used to differentiate the devices by the medium they 872 are attached to. Two devices can have different id values when 873 the broadcast packets are received only on one of them. 874 The default value 0 means that the device is the only interface 875 to its medium, value of -1 means that medium is not known. 876 877 Currently, it is used to change the proxy_arp behavior: 878 the proxy_arp feature is enabled for packets forwarded between 879 two devices attached to different media. 880 881proxy_arp - BOOLEAN 882 Do proxy arp. 883 proxy_arp for the interface will be enabled if at least one of 884 conf/{all,interface}/proxy_arp is set to TRUE, 885 it will be disabled otherwise 886 887proxy_arp_pvlan - BOOLEAN 888 Private VLAN proxy arp. 889 Basically allow proxy arp replies back to the same interface 890 (from which the ARP request/solicitation was received). 891 892 This is done to support (ethernet) switch features, like RFC 893 3069, where the individual ports are NOT allowed to 894 communicate with each other, but they are allowed to talk to 895 the upstream router. As described in RFC 3069, it is possible 896 to allow these hosts to communicate through the upstream 897 router by proxy_arp'ing. Don't need to be used together with 898 proxy_arp. 899 900 This technology is known by different names: 901 In RFC 3069 it is called VLAN Aggregation. 902 Cisco and Allied Telesyn call it Private VLAN. 903 Hewlett-Packard call it Source-Port filtering or port-isolation. 904 Ericsson call it MAC-Forced Forwarding (RFC Draft). 905 906shared_media - BOOLEAN 907 Send(router) or accept(host) RFC1620 shared media redirects. 908 Overrides ip_secure_redirects. 909 shared_media for the interface will be enabled if at least one of 910 conf/{all,interface}/shared_media is set to TRUE, 911 it will be disabled otherwise 912 default TRUE 913 914secure_redirects - BOOLEAN 915 Accept ICMP redirect messages only for gateways, 916 listed in default gateway list. 917 secure_redirects for the interface will be enabled if at least one of 918 conf/{all,interface}/secure_redirects is set to TRUE, 919 it will be disabled otherwise 920 default TRUE 921 922send_redirects - BOOLEAN 923 Send redirects, if router. 924 send_redirects for the interface will be enabled if at least one of 925 conf/{all,interface}/send_redirects is set to TRUE, 926 it will be disabled otherwise 927 Default: TRUE 928 929bootp_relay - BOOLEAN 930 Accept packets with source address 0.b.c.d destined 931 not to this host as local ones. It is supposed, that 932 BOOTP relay daemon will catch and forward such packets. 933 conf/all/bootp_relay must also be set to TRUE to enable BOOTP relay 934 for the interface 935 default FALSE 936 Not Implemented Yet. 937 938accept_source_route - BOOLEAN 939 Accept packets with SRR option. 940 conf/all/accept_source_route must also be set to TRUE to accept packets 941 with SRR option on the interface 942 default TRUE (router) 943 FALSE (host) 944 945accept_local - BOOLEAN 946 Accept packets with local source addresses. In combination 947 with suitable routing, this can be used to direct packets 948 between two local interfaces over the wire and have them 949 accepted properly. 950 951 rp_filter must be set to a non-zero value in order for 952 accept_local to have an effect. 953 954 default FALSE 955 956route_localnet - BOOLEAN 957 Do not consider loopback addresses as martian source or destination 958 while routing. This enables the use of 127/8 for local routing purposes. 959 default FALSE 960 961rp_filter - INTEGER 962 0 - No source validation. 963 1 - Strict mode as defined in RFC3704 Strict Reverse Path 964 Each incoming packet is tested against the FIB and if the interface 965 is not the best reverse path the packet check will fail. 966 By default failed packets are discarded. 967 2 - Loose mode as defined in RFC3704 Loose Reverse Path 968 Each incoming packet's source address is also tested against the FIB 969 and if the source address is not reachable via any interface 970 the packet check will fail. 971 972 Current recommended practice in RFC3704 is to enable strict mode 973 to prevent IP spoofing from DDos attacks. If using asymmetric routing 974 or other complicated routing, then loose mode is recommended. 975 976 The max value from conf/{all,interface}/rp_filter is used 977 when doing source validation on the {interface}. 978 979 Default value is 0. Note that some distributions enable it 980 in startup scripts. 981 982arp_filter - BOOLEAN 983 1 - Allows you to have multiple network interfaces on the same 984 subnet, and have the ARPs for each interface be answered 985 based on whether or not the kernel would route a packet from 986 the ARP'd IP out that interface (therefore you must use source 987 based routing for this to work). In other words it allows control 988 of which cards (usually 1) will respond to an arp request. 989 990 0 - (default) The kernel can respond to arp requests with addresses 991 from other interfaces. This may seem wrong but it usually makes 992 sense, because it increases the chance of successful communication. 993 IP addresses are owned by the complete host on Linux, not by 994 particular interfaces. Only for more complex setups like load- 995 balancing, does this behaviour cause problems. 996 997 arp_filter for the interface will be enabled if at least one of 998 conf/{all,interface}/arp_filter is set to TRUE, 999 it will be disabled otherwise 1000
1001arp_announce - INTEGER 1002 Define different restriction levels for announcing the local 1003 source IP address from IP packets in ARP requests sent on 1004 interface: 1005 0 - (default) Use any local address, configured on any interface 1006 1 - Try to avoid local addresses that are not in the target's 1007 subnet for this interface. This mode is useful when target 1008 hosts reachable via this interface require the source IP 1009 address in ARP requests to be part of their logical network 1010 configured on the receiving interface. When we generate the 1011 request we will check all our subnets that include the 1012 target IP and will preserve the source address if it is from 1013 such subnet. If there is no such subnet we select source 1014 address according to the rules for level 2. 1015 2 - Always use the best local address for this target. 1016 In this mode we ignore the source address in the IP packet 1017 and try to select local address that we prefer for talks with 1018 the target host. Such local address is selected by looking 1019 for primary IP addresses on all our subnets on the outgoing 1020 interface that include the target IP address. If no suitable 1021 local address is found we select the first local address 1022 we have on the outgoing interface or on all other interfaces, 1023 with the hope we will receive reply for our request and 1024 even sometimes no matter the source IP address we announce. 1025 1026 The max value from conf/{all,interface}/arp_announce is used. 1027 1028 Increasing the restriction level gives more chance for 1029 receiving answer from the resolved target while decreasing 1030 the level announces more valid sender's information. 1031 1032arp_ignore - INTEGER 1033 Define different modes for sending replies in response to 1034 received ARP requests that resolve local target IP addresses: 1035 0 - (default): reply for any local target IP address, configured 1036 on any interface 1037 1 - reply only if the target IP address is local address 1038 configured on the incoming interface 1039 2 - reply only if the target IP address is local address 1040 configured on the incoming interface and both with the 1041 sender's IP address are part from same subnet on this interface 1042 3 - do not reply for local addresses configured with scope host, 1043 only resolutions for global and link addresses are replied 1044 4-7 - reserved 1045 8 - do not reply for all local addresses 1046 1047 The max value from conf/{all,interface}/arp_ignore is used 1048 when ARP request is received on the {interface} 1049 1050arp_notify - BOOLEAN 1051 Define mode for notification of address and device changes. 1052 0 - (default): do nothing 1053 1 - Generate gratuitous arp requests when device is brought up 1054 or hardware address changes. 1055 1056arp_accept - BOOLEAN 1057 Define behavior for gratuitous ARP frames who's IP is not 1058 already present in the ARP table: 1059 0 - don't create new entries in the ARP table 1060 1 - create new entries in the ARP table 1061 1062 Both replies and requests type gratuitous arp will trigger the 1063 ARP table to be updated, if this setting is on. 1064 1065 If the ARP table already contains the IP address of the 1066 gratuitous arp frame, the arp table will be updated regardless 1067 if this setting is on or off. 1068 1069 1070app_solicit - INTEGER 1071 The maximum number of probes to send to the user space ARP daemon 1072 via netlink before dropping back to multicast probes (see 1073 mcast_solicit). Defaults to 0. 1074 1075disable_policy - BOOLEAN 1076 Disable IPSEC policy (SPD) for this interface 1077 1078disable_xfrm - BOOLEAN 1079 Disable IPSEC encryption on this interface, whatever the policy 1080 1081igmpv2_unsolicited_report_interval - INTEGER 1082 The interval in milliseconds in which the next unsolicited 1083 IGMPv1 or IGMPv2 report retransmit will take place. 1084 Default: 10000 (10 seconds) 1085 1086igmpv3_unsolicited_report_interval - INTEGER 1087 The interval in milliseconds in which the next unsolicited 1088 IGMPv3 report retransmit will take place. 1089 Default: 1000 (1 seconds) 1090 1091promote_secondaries - BOOLEAN 1092 When a primary IP address is removed from this interface 1093 promote a corresponding secondary IP address instead of 1094 removing all the corresponding secondary IP addresses. 1095 1096 1097tag - INTEGER 1098 Allows you to write a number, which can be used as required. 1099 Default value is 0. 1100 1101Alexey Kuznetsov. 1102kuznet@ms2.inr.ac.ru 1103 1104Updated by: 1105Andi Kleen 1106ak@muc.de 1107Nicolas Delon 1108delon.nicolas@wanadoo.fr 1109 1110 1111 1112 1113/proc/sys/net/ipv6/* Variables: 1114 1115IPv6 has no global variables such as tcp_*. tcp_* settings under ipv4/ also 1116apply to IPv6 [XXX?]. 1117 1118bindv6only - BOOLEAN 1119 Default value for IPV6_V6ONLY socket option, 1120 which restricts use of the IPv6 socket to IPv6 communication 1121 only. 1122 TRUE: disable IPv4-mapped address feature 1123 FALSE: enable IPv4-mapped address feature 1124 1125 Default: FALSE (as specified in RFC3493) 1126 1127flowlabel_consistency - BOOLEAN 1128 Protect the consistency (and unicity) of flow label. 1129 You have to disable it to use IPV6_FL_F_REFLECT flag on the 1130 flow label manager. 1131 TRUE: enabled 1132 FALSE: disabled 1133 Default: TRUE 1134 1135anycast_src_echo_reply - BOOLEAN 1136 Controls the use of anycast addresses as source addresses for ICMPv6 1137 echo reply 1138 TRUE: enabled 1139 FALSE: disabled 1140 Default: FALSE 1141 1142IPv6 Fragmentation: 1143 1144ip6frag_high_thresh - INTEGER 1145 Maximum memory used to reassemble IPv6 fragments. When 1146 ip6frag_high_thresh bytes of memory is allocated for this purpose, 1147 the fragment handler will toss packets until ip6frag_low_thresh 1148 is reached. 1149 1150ip6frag_low_thresh - INTEGER 1151 See ip6frag_high_thresh 1152 1153ip6frag_time - INTEGER 1154 Time in seconds to keep an IPv6 fragment in memory. 1155 1156ip6frag_secret_interval - INTEGER 1157 Regeneration interval (in seconds) of the hash secret (or lifetime 1158 for the hash secret) for IPv6 fragments. 1159 Default: 600 1160 1161conf/default/*: 1162 Change the interface-specific default settings. 1163 1164 1165conf/all/*: 1166 Change all the interface-specific settings. 1167 1168 [XXX: Other special features than forwarding?] 1169 1170conf/all/forwarding - BOOLEAN 1171 Enable global IPv6 forwarding between all interfaces. 1172 1173 IPv4 and IPv6 work differently here; e.g. netfilter must be used 1174 to control which interfaces may forward packets and which not. 1175 1176 This also sets all interfaces' Host/Router setting 1177 'forwarding' to the specified value. See below for details. 1178 1179 This referred to as global forwarding. 1180 1181proxy_ndp - BOOLEAN 1182 Do proxy ndp. 1183 1184conf/interface/*: 1185 Change special settings per interface. 1186 1187 The functional behaviour for certain settings is different 1188 depending on whether local forwarding is enabled or not. 1189 1190accept_ra - INTEGER 1191 Accept Router Advertisements; autoconfigure using them. 1192 1193 It also determines whether or not to transmit Router 1194 Solicitations. If and only if the functional setting is to 1195 accept Router Advertisements, Router Solicitations will be 1196 transmitted. 1197 1198 Possible values are: 1199 0 Do not accept Router Advertisements. 1200 1 Accept Router Advertisements if forwarding is disabled. 1201 2 Overrule forwarding behaviour. Accept Router Advertisements 1202 even if forwarding is enabled. 1203 1204 Functional default: enabled if local forwarding is disabled. 1205 disabled if local forwarding is enabled. 1206 1207accept_ra_defrtr - BOOLEAN 1208 Learn default router in Router Advertisement. 1209 1210 Functional default: enabled if accept_ra is enabled. 1211 disabled if accept_ra is disabled. 1212 1213accept_ra_pinfo - BOOLEAN 1214 Learn Prefix Information in Router Advertisement. 1215 1216 Functional default: enabled if accept_ra is enabled. 1217 disabled if accept_ra is disabled. 1218 1219accept_ra_rt_info_max_plen - INTEGER 1220 Maximum prefix length of Route Information in RA. 1221 1222 Route Information w/ prefix larger than or equal to this 1223 variable shall be ignored. 1224 1225 Functional default: 0 if accept_ra_rtr_pref is enabled. 1226 -1 if accept_ra_rtr_pref is disabled. 1227 1228accept_ra_rtr_pref - BOOLEAN 1229 Accept Router Preference in RA. 1230 1231 Functional default: enabled if accept_ra is enabled. 1232 disabled if accept_ra is disabled. 1233 1234accept_redirects - BOOLEAN 1235 Accept Redirects. 1236 1237 Functional default: enabled if local forwarding is disabled. 1238 disabled if local forwarding is enabled. 1239 1240accept_source_route - INTEGER 1241 Accept source routing (routing extension header). 1242 1243 >= 0: Accept only routing header type 2. 1244 < 0: Do not accept routing header. 1245 1246 Default: 0 1247 1248autoconf - BOOLEAN 1249 Autoconfigure addresses using Prefix Information in Router 1250 Advertisements. 1251 1252 Functional default: enabled if accept_ra_pinfo is enabled. 1253 disabled if accept_ra_pinfo is disabled. 1254 1255dad_transmits - INTEGER 1256 The amount of Duplicate Address Detection probes to send. 1257 Default: 1 1258 1259forwarding - INTEGER 1260 Configure interface-specific Host/Router behaviour. 1261 1262 Note: It is recommended to have the same setting on all 1263 interfaces; mixed router/host scenarios are rather uncommon. 1264 1265 Possible values are: 1266 0 Forwarding disabled 1267 1 Forwarding enabled 1268 1269 FALSE (0): 1270 1271 By default, Host behaviour is assumed. This means: 1272 1273 1. IsRouter flag is not set in Neighbour Advertisements. 1274 2. If accept_ra is TRUE (default), transmit Router 1275 Solicitations. 1276 3. If accept_ra is TRUE (default), accept Router 1277 Advertisements (and do autoconfiguration). 1278 4. If accept_redirects is TRUE (default), accept Redirects. 1279 1280 TRUE (1): 1281 1282 If local forwarding is enabled, Router behaviour is assumed. 1283 This means exactly the reverse from the above: 1284 1285 1. IsRouter flag is set in Neighbour Advertisements. 1286 2. Router Solicitations are not sent unless accept_ra is 2. 1287 3. Router Advertisements are ignored unless accept_ra is 2. 1288 4. Redirects are ignored. 1289 1290 Default: 0 (disabled) if global forwarding is disabled (default), 1291 otherwise 1 (enabled). 1292 1293hop_limit - INTEGER 1294 Default Hop Limit to set. 1295 Default: 64 1296 1297mtu - INTEGER 1298 Default Maximum Transfer Unit 1299 Default: 1280 (IPv6 required minimum) 1300 1301router_probe_interval - INTEGER 1302 Minimum interval (in seconds) between Router Probing described 1303 in RFC4191. 1304 1305 Default: 60 1306 1307router_solicitation_delay - INTEGER 1308 Number of seconds to wait after interface is brought up 1309 before sending Router Solicitations. 1310 Default: 1 1311 1312router_solicitation_interval - INTEGER 1313 Number of seconds to wait between Router Solicitations. 1314 Default: 4 1315 1316router_solicitations - INTEGER 1317 Number of Router Solicitations to send until assuming no 1318 routers are present. 1319 Default: 3 1320 1321use_tempaddr - INTEGER 1322 Preference for Privacy Extensions (RFC3041). 1323 <= 0 : disable Privacy Extensions 1324 == 1 : enable Privacy Extensions, but prefer public 1325 addresses over temporary addresses. 1326 > 1 : enable Privacy Extensions and prefer temporary 1327 addresses over public addresses. 1328 Default: 0 (for most devices) 1329 -1 (for point-to-point devices and loopback devices) 1330 1331temp_valid_lft - INTEGER 1332 valid lifetime (in seconds) for temporary addresses. 1333 Default: 604800 (7 days) 1334 1335temp_prefered_lft - INTEGER 1336 Preferred lifetime (in seconds) for temporary addresses. 1337 Default: 86400 (1 day) 1338 1339max_desync_factor - INTEGER 1340 Maximum value for DESYNC_FACTOR, which is a random value 1341 that ensures that clients don't synchronize with each 1342 other and generate new addresses at exactly the same time. 1343 value is in seconds. 1344 Default: 600 1345 1346regen_max_retry - INTEGER 1347 Number of attempts before give up attempting to generate 1348 valid temporary addresses. 1349 Default: 5 1350 1351max_addresses - INTEGER 1352 Maximum number of autoconfigured addresses per interface. Setting 1353 to zero disables the limitation. It is not recommended to set this 1354 value too large (or to zero) because it would be an easy way to 1355 crash the kernel by allowing too many addresses to be created. 1356 Default: 16 1357 1358disable_ipv6 - BOOLEAN 1359 Disable IPv6 operation. If accept_dad is set to 2, this value 1360 will be dynamically set to TRUE if DAD fails for the link-local 1361 address. 1362 Default: FALSE (enable IPv6 operation) 1363 1364 When this value is changed from 1 to 0 (IPv6 is being enabled), 1365 it will dynamically create a link-local address on the given 1366 interface and start Duplicate Address Detection, if necessary. 1367 1368 When this value is changed from 0 to 1 (IPv6 is being disabled), 1369 it will dynamically delete all address on the given interface. 1370 1371accept_dad - INTEGER 1372 Whether to accept DAD (Duplicate Address Detection). 1373 0: Disable DAD 1374 1: Enable DAD (default) 1375 2: Enable DAD, and disable IPv6 operation if MAC-based duplicate 1376 link-local address has been found. 1377 1378force_tllao - BOOLEAN 1379 Enable sending the target link-layer address option even when 1380 responding to a unicast neighbor solicitation. 1381 Default: FALSE 1382 1383 Quoting from RFC 2461, section 4.4, Target link-layer address: 1384 1385 "The option MUST be included for multicast solicitations in order to 1386 avoid infinite Neighbor Solicitation "recursion" when the peer node 1387 does not have a cache entry to return a Neighbor Advertisements 1388 message. When responding to unicast solicitations, the option can be 1389 omitted since the sender of the solicitation has the correct link- 1390 layer address; otherwise it would not have be able to send the unicast 1391 solicitation in the first place. However, including the link-layer 1392 address in this case adds little overhead and eliminates a potential 1393 race condition where the sender deletes the cached link-layer address 1394 prior to receiving a response to a previous solicitation." 1395 1396ndisc_notify - BOOLEAN 1397 Define mode for notification of address and device changes. 1398 0 - (default): do nothing 1399 1 - Generate unsolicited neighbour advertisements when device is brought 1400 up or hardware address changes. 1401 1402mldv1_unsolicited_report_interval - INTEGER 1403 The interval in milliseconds in which the next unsolicited 1404 MLDv1 report retransmit will take place. 1405 Default: 10000 (10 seconds) 1406 1407mldv2_unsolicited_report_interval - INTEGER 1408 The interval in milliseconds in which the next unsolicited 1409 MLDv2 report retransmit will take place. 1410 Default: 1000 (1 second) 1411 1412force_mld_version - INTEGER 1413 0 - (default) No enforcement of a MLD version, MLDv1 fallback allowed 1414 1 - Enforce to use MLD version 1 1415 2 - Enforce to use MLD version 2 1416 1417suppress_frag_ndisc - INTEGER 1418 Control RFC 6980 (Security Implications of IPv6 Fragmentation 1419 with IPv6 Neighbor Discovery) behavior: 1420 1 - (default) discard fragmented neighbor discovery packets 1421 0 - allow fragmented neighbor discovery packets 1422 1423icmp/*: 1424ratelimit - INTEGER 1425 Limit the maximal rates for sending ICMPv6 packets. 1426 0 to disable any limiting, 1427 otherwise the minimal space between responses in milliseconds. 1428 Default: 1000 1429 1430 1431IPv6 Update by: 1432Pekka Savola <pekkas@netcore.fi> 1433YOSHIFUJI Hideaki / USAGI Project <yoshfuji@linux-ipv6.org> 1434 1435 1436/proc/sys/net/bridge/* Variables: 1437 1438bridge-nf-call-arptables - BOOLEAN 1439 1 : pass bridged ARP traffic to arptables' FORWARD chain. 1440 0 : disable this. 1441 Default: 1 1442 1443bridge-nf-call-iptables - BOOLEAN 1444 1 : pass bridged IPv4 traffic to iptables' chains. 1445 0 : disable this. 1446 Default: 1 1447 1448bridge-nf-call-ip6tables - BOOLEAN 1449 1 : pass bridged IPv6 traffic to ip6tables' chains. 1450 0 : disable this. 1451 Default: 1 1452 1453bridge-nf-filter-vlan-tagged - BOOLEAN 1454 1 : pass bridged vlan-tagged ARP/IP/IPv6 traffic to {arp,ip,ip6}tables. 1455 0 : disable this. 1456 Default: 0 1457 1458bridge-nf-filter-pppoe-tagged - BOOLEAN 1459 1 : pass bridged pppoe-tagged IP/IPv6 traffic to {ip,ip6}tables. 1460 0 : disable this. 1461 Default: 0 1462 1463bridge-nf-pass-vlan-input-dev - BOOLEAN 1464 1: if bridge-nf-filter-vlan-tagged is enabled, try to find a vlan 1465 interface on the bridge and set the netfilter input device to the vlan. 1466 This allows use of e.g. "iptables -i br0.1" and makes the REDIRECT 1467 target work with vlan-on-top-of-bridge interfaces. When no matching 1468 vlan interface is found, or this switch is off, the input device is 1469 set to the bridge interface. 1470 0: disable bridge netfilter vlan interface lookup. 1471 Default: 0 1472 1473proc/sys/net/sctp/* Variables: 1474 1475addip_enable - BOOLEAN 1476 Enable or disable extension of Dynamic Address Reconfiguration 1477 (ADD-IP) functionality specified in RFC5061. This extension provides 1478 the ability to dynamically add and remove new addresses for the SCTP 1479 associations. 1480 1481 1: Enable extension. 1482 1483 0: Disable extension. 1484 1485 Default: 0 1486 1487addip_noauth_enable - BOOLEAN 1488 Dynamic Address Reconfiguration (ADD-IP) requires the use of 1489 authentication to protect the operations of adding or removing new 1490 addresses. This requirement is mandated so that unauthorized hosts 1491 would not be able to hijack associations. However, older 1492 implementations may not have implemented this requirement while 1493 allowing the ADD-IP extension. For reasons of interoperability, 1494 we provide this variable to control the enforcement of the 1495 authentication requirement. 1496 1497 1: Allow ADD-IP extension to be used without authentication. This 1498 should only be set in a closed environment for interoperability 1499 with older implementations. 1500 1501 0: Enforce the authentication requirement 1502 1503 Default: 0 1504 1505auth_enable - BOOLEAN 1506 Enable or disable Authenticated Chunks extension. This extension 1507 provides the ability to send and receive authenticated chunks and is 1508 required for secure operation of Dynamic Address Reconfiguration 1509 (ADD-IP) extension. 1510 1511 1: Enable this extension. 1512 0: Disable this extension. 1513 1514 Default: 0 1515 1516prsctp_enable - BOOLEAN 1517 Enable or disable the Partial Reliability extension (RFC3758) which 1518 is used to notify peers that a given DATA should no longer be expected. 1519 1520 1: Enable extension 1521 0: Disable 1522 1523 Default: 1 1524 1525max_burst - INTEGER 1526 The limit of the number of new packets that can be initially sent. It 1527 controls how bursty the generated traffic can be. 1528 1529 Default: 4 1530 1531association_max_retrans - INTEGER 1532 Set the maximum number for retransmissions that an association can 1533 attempt deciding that the remote end is unreachable. If this value 1534 is exceeded, the association is terminated. 1535 1536 Default: 10 1537 1538max_init_retransmits - INTEGER 1539 The maximum number of retransmissions of INIT and COOKIE-ECHO chunks 1540 that an association will attempt before declaring the destination 1541 unreachable and terminating. 1542 1543 Default: 8 1544 1545path_max_retrans - INTEGER 1546 The maximum number of retransmissions that will be attempted on a given 1547 path. Once this threshold is exceeded, the path is considered 1548 unreachable, and new traffic will use a different path when the 1549 association is multihomed. 1550 1551 Default: 5 1552 1553pf_retrans - INTEGER 1554 The number of retransmissions that will be attempted on a given path 1555 before traffic is redirected to an alternate transport (should one 1556 exist). Note this is distinct from path_max_retrans, as a path that 1557 passes the pf_retrans threshold can still be used. Its only 1558 deprioritized when a transmission path is selected by the stack. This 1559 setting is primarily used to enable fast failover mechanisms without 1560 having to reduce path_max_retrans to a very low value. See: 1561 http://www.ietf.org/id/draft-nishida-tsvwg-sctp-failover-05.txt 1562 for details. Note also that a value of pf_retrans > path_max_retrans 1563 disables this feature 1564 1565 Default: 0 1566 1567rto_initial - INTEGER 1568 The initial round trip timeout value in milliseconds that will be used 1569 in calculating round trip times. This is the initial time interval 1570 for retransmissions. 1571 1572 Default: 3000 1573 1574rto_max - INTEGER 1575 The maximum value (in milliseconds) of the round trip timeout. This 1576 is the largest time interval that can elapse between retransmissions. 1577 1578 Default: 60000 1579 1580rto_min - INTEGER 1581 The minimum value (in milliseconds) of the round trip timeout. This 1582 is the smallest time interval the can elapse between retransmissions. 1583 1584 Default: 1000 1585 1586hb_interval - INTEGER 1587 The interval (in milliseconds) between HEARTBEAT chunks. These chunks 1588 are sent at the specified interval on idle paths to probe the state of 1589 a given path between 2 associations. 1590 1591 Default: 30000 1592 1593sack_timeout - INTEGER 1594 The amount of time (in milliseconds) that the implementation will wait 1595 to send a SACK. 1596 1597 Default: 200 1598 1599valid_cookie_life - INTEGER 1600 The default lifetime of the SCTP cookie (in milliseconds). The cookie 1601 is used during association establishment. 1602 1603 Default: 60000 1604 1605cookie_preserve_enable - BOOLEAN 1606 Enable or disable the ability to extend the lifetime of the SCTP cookie 1607 that is used during the establishment phase of SCTP association 1608 1609 1: Enable cookie lifetime extension. 1610 0: Disable 1611 1612 Default: 1 1613 1614cookie_hmac_alg - STRING 1615 Select the hmac algorithm used when generating the cookie value sent by 1616 a listening sctp socket to a connecting client in the INIT-ACK chunk. 1617 Valid values are: 1618 * md5 1619 * sha1 1620 * none 1621 Ability to assign md5 or sha1 as the selected alg is predicated on the 1622 configuration of those algorithms at build time (CONFIG_CRYPTO_MD5 and 1623 CONFIG_CRYPTO_SHA1). 1624 1625 Default: Dependent on configuration. MD5 if available, else SHA1 if 1626 available, else none. 1627 1628rcvbuf_policy - INTEGER 1629 Determines if the receive buffer is attributed to the socket or to 1630 association. SCTP supports the capability to create multiple 1631 associations on a single socket. When using this capability, it is 1632 possible that a single stalled association that's buffering a lot 1633 of data may block other associations from delivering their data by 1634 consuming all of the receive buffer space. To work around this, 1635 the rcvbuf_policy could be set to attribute the receiver buffer space 1636 to each association instead of the socket. This prevents the described 1637 blocking. 1638 1639 1: rcvbuf space is per association 1640 0: rcvbuf space is per socket 1641 1642 Default: 0 1643 1644sndbuf_policy - INTEGER 1645 Similar to rcvbuf_policy above, this applies to send buffer space. 1646 1647 1: Send buffer is tracked per association 1648 0: Send buffer is tracked per socket. 1649 1650 Default: 0 1651 1652sctp_mem - vector of 3 INTEGERs: min, pressure, max 1653 Number of pages allowed for queueing by all SCTP sockets. 1654 1655 min: Below this number of pages SCTP is not bothered about its 1656 memory appetite. When amount of memory allocated by SCTP exceeds 1657 this number, SCTP starts to moderate memory usage. 1658 1659 pressure: This value was introduced to follow format of tcp_mem. 1660 1661 max: Number of pages allowed for queueing by all SCTP sockets. 1662 1663 Default is calculated at boot time from amount of available memory. 1664 1665sctp_rmem - vector of 3 INTEGERs: min, default, max 1666 Only the first value ("min") is used, "default" and "max" are 1667 ignored. 1668 1669 min: Minimal size of receive buffer used by SCTP socket. 1670 It is guaranteed to each SCTP socket (but not association) even 1671 under moderate memory pressure. 1672 1673 Default: 1 page 1674 1675sctp_wmem - vector of 3 INTEGERs: min, default, max 1676 Currently this tunable has no effect. 1677 1678addr_scope_policy - INTEGER 1679 Control IPv4 address scoping - draft-stewart-tsvwg-sctp-ipv4-00 1680 1681 0 - Disable IPv4 address scoping 1682 1 - Enable IPv4 address scoping 1683 2 - Follow draft but allow IPv4 private addresses 1684 3 - Follow draft but allow IPv4 link local addresses 1685 1686 Default: 1 1687 1688 1689/proc/sys/net/core/* 1690 Please see: Documentation/sysctl/net.txt for descriptions of these entries. 1691 1692 1693/proc/sys/net/unix/* 1694max_dgram_qlen - INTEGER 1695 The maximum length of dgram socket receive queue 1696 1697 Default: 10 1698 1699 1700UNDOCUMENTED: 1701 1702/proc/sys/net/irda/* 1703 fast_poll_increase FIXME 1704 warn_noreply_time FIXME 1705 discovery_slots FIXME 1706 slot_timeout FIXME 1707 max_baud_rate FIXME 1708 discovery_timeout FIXME 1709 lap_keepalive_time FIXME 1710 max_noreply_time FIXME 1711 max_tx_data_size FIXME 1712 max_tx_window FIXME 1713 min_tx_turn_time FIXME 1714