1/proc/sys/net/ipv4/vs/* Variables: 2 3am_droprate - INTEGER 4 default 10 5 6 It sets the always mode drop rate, which is used in the mode 3 7 of the drop_rate defense. 8 9amemthresh - INTEGER 10 default 1024 11 12 It sets the available memory threshold (in pages), which is 13 used in the automatic modes of defense. When there is no 14 enough available memory, the respective strategy will be 15 enabled and the variable is automatically set to 2, otherwise 16 the strategy is disabled and the variable is set to 1. 17 18backup_only - BOOLEAN 19 0 - disabled (default) 20 not 0 - enabled 21 22 If set, disable the director function while the server is 23 in backup mode to avoid packet loops for DR/TUN methods. 24 25conntrack - BOOLEAN 26 0 - disabled (default) 27 not 0 - enabled 28 29 If set, maintain connection tracking entries for 30 connections handled by IPVS. 31 32 This should be enabled if connections handled by IPVS are to be 33 also handled by stateful firewall rules. That is, iptables rules 34 that make use of connection tracking. It is a performance 35 optimisation to disable this setting otherwise. 36 37 Connections handled by the IPVS FTP application module 38 will have connection tracking entries regardless of this setting. 39 40 Only available when IPVS is compiled with CONFIG_IP_VS_NFCT enabled. 41 42cache_bypass - BOOLEAN 43 0 - disabled (default) 44 not 0 - enabled 45 46 If it is enabled, forward packets to the original destination 47 directly when no cache server is available and destination 48 address is not local (iph->daddr is RTN_UNICAST). It is mostly 49 used in transparent web cache cluster. 50 51debug_level - INTEGER 52 0 - transmission error messages (default) 53 1 - non-fatal error messages 54 2 - configuration 55 3 - destination trash 56 4 - drop entry 57 5 - service lookup 58 6 - scheduling 59 7 - connection new/expire, lookup and synchronization 60 8 - state transition 61 9 - binding destination, template checks and applications 62 10 - IPVS packet transmission 63 11 - IPVS packet handling (ip_vs_in/ip_vs_out) 64 12 or more - packet traversal 65 66 Only available when IPVS is compiled with CONFIG_IP_VS_DEBUG enabled. 67 68 Higher debugging levels include the messages for lower debugging 69 levels, so setting debug level 2, includes level 0, 1 and 2 70 messages. Thus, logging becomes more and more verbose the higher 71 the level. 72 73drop_entry - INTEGER 74 0 - disabled (default) 75 76 The drop_entry defense is to randomly drop entries in the 77 connection hash table, just in order to collect back some 78 memory for new connections. In the current code, the 79 drop_entry procedure can be activated every second, then it 80 randomly scans 1/32 of the whole and drops entries that are in 81 the SYN-RECV/SYNACK state, which should be effective against 82 syn-flooding attack. 83 84 The valid values of drop_entry are from 0 to 3, where 0 means 85 that this strategy is always disabled, 1 and 2 mean automatic 86 modes (when there is no enough available memory, the strategy 87 is enabled and the variable is automatically set to 2, 88 otherwise the strategy is disabled and the variable is set to 89 1), and 3 means that that the strategy is always enabled. 90 91drop_packet - INTEGER 92 0 - disabled (default) 93 94 The drop_packet defense is designed to drop 1/rate packets 95 before forwarding them to real servers. If the rate is 1, then 96 drop all the incoming packets. 97 98 The value definition is the same as that of the drop_entry. In 99 the automatic mode, the rate is determined by the follow 100 formula: rate = amemthresh / (amemthresh - available_memory) 101 when available memory is less than the available memory 102 threshold. When the mode 3 is set, the always mode drop rate 103 is controlled by the /proc/sys/net/ipv4/vs/am_droprate. 104 105expire_nodest_conn - BOOLEAN 106 0 - disabled (default) 107 not 0 - enabled 108 109 The default value is 0, the load balancer will silently drop 110 packets when its destination server is not available. It may 111 be useful, when user-space monitoring program deletes the 112 destination server (because of server overload or wrong 113 detection) and add back the server later, and the connections 114 to the server can continue. 115 116 If this feature is enabled, the load balancer will expire the 117 connection immediately when a packet arrives and its 118 destination server is not available, then the client program 119 will be notified that the connection is closed. This is 120 equivalent to the feature some people requires to flush 121 connections when its destination is not available. 122 123expire_quiescent_template - BOOLEAN 124 0 - disabled (default) 125 not 0 - enabled 126 127 When set to a non-zero value, the load balancer will expire 128 persistent templates when the destination server is quiescent. 129 This may be useful, when a user makes a destination server 130 quiescent by setting its weight to 0 and it is desired that 131 subsequent otherwise persistent connections are sent to a 132 different destination server. By default new persistent 133 connections are allowed to quiescent destination servers. 134 135 If this feature is enabled, the load balancer will expire the 136 persistence template if it is to be used to schedule a new 137 connection and the destination server is quiescent. 138 139nat_icmp_send - BOOLEAN 140 0 - disabled (default) 141 not 0 - enabled 142 143 It controls sending icmp error messages (ICMP_DEST_UNREACH) 144 for VS/NAT when the load balancer receives packets from real 145 servers but the connection entries don't exist. 146 147secure_tcp - INTEGER 148 0 - disabled (default) 149 150 The secure_tcp defense is to use a more complicated TCP state 151 transition table. For VS/NAT, it also delays entering the 152 TCP ESTABLISHED state until the three way handshake is completed. 153 154 The value definition is the same as that of drop_entry and 155 drop_packet. 156 157sync_threshold - INTEGER 158 default 3 159 160 It sets synchronization threshold, which is the minimum number 161 of incoming packets that a connection needs to receive before 162 the connection will be synchronized. A connection will be 163 synchronized, every time the number of its incoming packets 164 modulus 50 equals the threshold. The range of the threshold is 165 from 0 to 49. 166 167snat_reroute - BOOLEAN 168 0 - disabled 169 not 0 - enabled (default) 170 171 If enabled, recalculate the route of SNATed packets from 172 realservers so that they are routed as if they originate from the 173 director. Otherwise they are routed as if they are forwarded by the 174 director. 175 176 If policy routing is in effect then it is possible that the route 177 of a packet originating from a director is routed differently to a 178 packet being forwarded by the director. 179 180 If policy routing is not in effect then the recalculated route will 181 always be the same as the original route so it is an optimisation 182 to disable snat_reroute and avoid the recalculation. 183 184sync_version - INTEGER 185 default 1 186 187 The version of the synchronisation protocol used when sending 188 synchronisation messages. 189 190 0 selects the original synchronisation protocol (version 0). This 191 should be used when sending synchronisation messages to a legacy 192 system that only understands the original synchronisation protocol. 193 194 1 selects the current synchronisation protocol (version 1). This 195 should be used where possible. 196 197 Kernels with this sync_version entry are able to receive messages 198 of both version 1 and version 2 of the synchronisation protocol. 199