1.. SPDX-License-Identifier: GPL-2.0 2 3========= 4IP Sysctl 5========= 6 7/proc/sys/net/ipv4/* Variables 8============================== 9 10ip_forward - BOOLEAN 11 - 0 - disabled (default) 12 - not 0 - enabled 13 14 Forward Packets between interfaces. 15 16 This variable is special, its change resets all configuration 17 parameters to their default state (RFC1122 for hosts, RFC1812 18 for routers) 19 20ip_default_ttl - INTEGER 21 Default value of TTL field (Time To Live) for outgoing (but not 22 forwarded) IP packets. Should be between 1 and 255 inclusive. 23 Default: 64 (as recommended by RFC1700) 24 25ip_no_pmtu_disc - INTEGER 26 Disable Path MTU Discovery. If enabled in mode 1 and a 27 fragmentation-required ICMP is received, the PMTU to this 28 destination will be set to min_pmtu (see below). You will need 29 to raise min_pmtu to the smallest interface MTU on your system 30 manually if you want to avoid locally generated fragments. 31 32 In mode 2 incoming Path MTU Discovery messages will be 33 discarded. Outgoing frames are handled the same as in mode 1, 34 implicitly setting IP_PMTUDISC_DONT on every created socket. 35 36 Mode 3 is a hardened pmtu discover mode. The kernel will only 37 accept fragmentation-needed errors if the underlying protocol 38 can verify them besides a plain socket lookup. Current 39 protocols for which pmtu events will be honored are TCP, SCTP 40 and DCCP as they verify e.g. the sequence number or the 41 association. This mode should not be enabled globally but is 42 only intended to secure e.g. name servers in namespaces where 43 TCP path mtu must still work but path MTU information of other 44 protocols should be discarded. If enabled globally this mode 45 could break other protocols. 46 47 Possible values: 0-3 48 49 Default: FALSE 50 51min_pmtu - INTEGER 52 default 552 - minimum discovered Path MTU 53 54ip_forward_use_pmtu - BOOLEAN 55 By default we don't trust protocol path MTUs while forwarding 56 because they could be easily forged and can lead to unwanted 57 fragmentation by the router. 58 You only need to enable this if you have user-space software 59 which tries to discover path mtus by itself and depends on the 60 kernel honoring this information. This is normally not the 61 case. 62 63 Default: 0 (disabled) 64 65 Possible values: 66 67 - 0 - disabled 68 - 1 - enabled 69 70fwmark_reflect - BOOLEAN 71 Controls the fwmark of kernel-generated IPv4 reply packets that are not 72 associated with a socket for example, TCP RSTs or ICMP echo replies). 73 If unset, these packets have a fwmark of zero. If set, they have the 74 fwmark of the packet they are replying to. 75 76 Default: 0 77 78fib_multipath_use_neigh - BOOLEAN 79 Use status of existing neighbor entry when determining nexthop for 80 multipath routes. If disabled, neighbor information is not used and 81 packets could be directed to a failed nexthop. Only valid for kernels 82 built with CONFIG_IP_ROUTE_MULTIPATH enabled. 83 84 Default: 0 (disabled) 85 86 Possible values: 87 88 - 0 - disabled 89 - 1 - enabled 90 91fib_multipath_hash_policy - INTEGER 92 Controls which hash policy to use for multipath routes. Only valid 93 for kernels built with CONFIG_IP_ROUTE_MULTIPATH enabled. 94 95 Default: 0 (Layer 3) 96 97 Possible values: 98 99 - 0 - Layer 3 100 - 1 - Layer 4 101 - 2 - Layer 3 or inner Layer 3 if present 102 103fib_sync_mem - UNSIGNED INTEGER 104 Amount of dirty memory from fib entries that can be backlogged before 105 synchronize_rcu is forced. 106 107 Default: 512kB Minimum: 64kB Maximum: 64MB 108 109ip_forward_update_priority - INTEGER 110 Whether to update SKB priority from "TOS" field in IPv4 header after it 111 is forwarded. The new SKB priority is mapped from TOS field value 112 according to an rt_tos2priority table (see e.g. man tc-prio). 113 114 Default: 1 (Update priority.) 115 116 Possible values: 117 118 - 0 - Do not update priority. 119 - 1 - Update priority. 120 121route/max_size - INTEGER 122 Maximum number of routes allowed in the kernel. Increase 123 this when using large numbers of interfaces and/or routes. 124 125 From linux kernel 3.6 onwards, this is deprecated for ipv4 126 as route cache is no longer used. 127 128neigh/default/gc_thresh1 - INTEGER 129 Minimum number of entries to keep. Garbage collector will not 130 purge entries if there are fewer than this number. 131 132 Default: 128 133 134neigh/default/gc_thresh2 - INTEGER 135 Threshold when garbage collector becomes more aggressive about 136 purging entries. Entries older than 5 seconds will be cleared 137 when over this number. 138 139 Default: 512 140 141neigh/default/gc_thresh3 - INTEGER 142 Maximum number of non-PERMANENT neighbor entries allowed. Increase 143 this when using large numbers of interfaces and when communicating 144 with large numbers of directly-connected peers. 145 146 Default: 1024 147 148neigh/default/unres_qlen_bytes - INTEGER 149 The maximum number of bytes which may be used by packets 150 queued for each unresolved address by other network layers. 151 (added in linux 3.3) 152 153 Setting negative value is meaningless and will return error. 154 155 Default: SK_WMEM_MAX, (same as net.core.wmem_default). 156 157 Exact value depends on architecture and kernel options, 158 but should be enough to allow queuing 256 packets 159 of medium size. 160 161neigh/default/unres_qlen - INTEGER 162 The maximum number of packets which may be queued for each 163 unresolved address by other network layers. 164 165 (deprecated in linux 3.3) : use unres_qlen_bytes instead. 166 167 Prior to linux 3.3, the default value is 3 which may cause 168 unexpected packet loss. The current default value is calculated 169 according to default value of unres_qlen_bytes and true size of 170 packet. 171 172 Default: 101 173 174mtu_expires - INTEGER 175 Time, in seconds, that cached PMTU information is kept. 176 177min_adv_mss - INTEGER 178 The advertised MSS depends on the first hop route MTU, but will 179 never be lower than this setting. 180 181IP Fragmentation: 182 183ipfrag_high_thresh - LONG INTEGER 184 Maximum memory used to reassemble IP fragments. 185 186ipfrag_low_thresh - LONG INTEGER 187 (Obsolete since linux-4.17) 188 Maximum memory used to reassemble IP fragments before the kernel 189 begins to remove incomplete fragment queues to free up resources. 190 The kernel still accepts new fragments for defragmentation. 191 192ipfrag_time - INTEGER 193 Time in seconds to keep an IP fragment in memory. 194 195ipfrag_max_dist - INTEGER 196 ipfrag_max_dist is a non-negative integer value which defines the 197 maximum "disorder" which is allowed among fragments which share a 198 common IP source address. Note that reordering of packets is 199 not unusual, but if a large number of fragments arrive from a source 200 IP address while a particular fragment queue remains incomplete, it 201 probably indicates that one or more fragments belonging to that queue 202 have been lost. When ipfrag_max_dist is positive, an additional check 203 is done on fragments before they are added to a reassembly queue - if 204 ipfrag_max_dist (or more) fragments have arrived from a particular IP 205 address between additions to any IP fragment queue using that source 206 address, it's presumed that one or more fragments in the queue are 207 lost. The existing fragment queue will be dropped, and a new one 208 started. An ipfrag_max_dist value of zero disables this check. 209 210 Using a very small value, e.g. 1 or 2, for ipfrag_max_dist can 211 result in unnecessarily dropping fragment queues when normal 212 reordering of packets occurs, which could lead to poor application 213 performance. Using a very large value, e.g. 50000, increases the 214 likelihood of incorrectly reassembling IP fragments that originate 215 from different IP datagrams, which could result in data corruption. 216 Default: 64 217 218INET peer storage 219================= 220 221inet_peer_threshold - INTEGER 222 The approximate size of the storage. Starting from this threshold 223 entries will be thrown aggressively. This threshold also determines 224 entries' time-to-live and time intervals between garbage collection 225 passes. More entries, less time-to-live, less GC interval. 226 227inet_peer_minttl - INTEGER 228 Minimum time-to-live of entries. Should be enough to cover fragment 229 time-to-live on the reassembling side. This minimum time-to-live is 230 guaranteed if the pool size is less than inet_peer_threshold. 231 Measured in seconds. 232 233inet_peer_maxttl - INTEGER 234 Maximum time-to-live of entries. Unused entries will expire after 235 this period of time if there is no memory pressure on the pool (i.e. 236 when the number of entries in the pool is very small). 237 Measured in seconds. 238 239TCP variables 240============= 241 242somaxconn - INTEGER 243 Limit of socket listen() backlog, known in userspace as SOMAXCONN. 244 Defaults to 4096. (Was 128 before linux-5.4) 245 See also tcp_max_syn_backlog for additional tuning for TCP sockets. 246 247tcp_abort_on_overflow - BOOLEAN 248 If listening service is too slow to accept new connections, 249 reset them. Default state is FALSE. It means that if overflow 250 occurred due to a burst, connection will recover. Enable this 251 option _only_ if you are really sure that listening daemon 252 cannot be tuned to accept connections faster. Enabling this 253 option can harm clients of your server. 254 255tcp_adv_win_scale - INTEGER 256 Count buffering overhead as bytes/2^tcp_adv_win_scale 257 (if tcp_adv_win_scale > 0) or bytes-bytes/2^(-tcp_adv_win_scale), 258 if it is <= 0. 259 260 Possible values are [-31, 31], inclusive. 261 262 Default: 1 263 264tcp_allowed_congestion_control - STRING 265 Show/set the congestion control choices available to non-privileged 266 processes. The list is a subset of those listed in 267 tcp_available_congestion_control. 268 269 Default is "reno" and the default setting (tcp_congestion_control). 270 271tcp_app_win - INTEGER 272 Reserve max(window/2^tcp_app_win, mss) of window for application 273 buffer. Value 0 is special, it means that nothing is reserved. 274 275 Possible values are [0, 31], inclusive. 276 277 Default: 31 278 279tcp_autocorking - BOOLEAN 280 Enable TCP auto corking : 281 When applications do consecutive small write()/sendmsg() system calls, 282 we try to coalesce these small writes as much as possible, to lower 283 total amount of sent packets. This is done if at least one prior 284 packet for the flow is waiting in Qdisc queues or device transmit 285 queue. Applications can still use TCP_CORK for optimal behavior 286 when they know how/when to uncork their sockets. 287 288 Default : 1 289 290tcp_available_congestion_control - STRING 291 Shows the available congestion control choices that are registered. 292 More congestion control algorithms may be available as modules, 293 but not loaded. 294 295tcp_base_mss - INTEGER 296 The initial value of search_low to be used by the packetization layer 297 Path MTU discovery (MTU probing). If MTU probing is enabled, 298 this is the initial MSS used by the connection. 299 300tcp_mtu_probe_floor - INTEGER 301 If MTU probing is enabled this caps the minimum MSS used for search_low 302 for the connection. 303 304 Default : 48 305 306tcp_min_snd_mss - INTEGER 307 TCP SYN and SYNACK messages usually advertise an ADVMSS option, 308 as described in RFC 1122 and RFC 6691. 309 310 If this ADVMSS option is smaller than tcp_min_snd_mss, 311 it is silently capped to tcp_min_snd_mss. 312 313 Default : 48 (at least 8 bytes of payload per segment) 314 315tcp_congestion_control - STRING 316 Set the congestion control algorithm to be used for new 317 connections. The algorithm "reno" is always available, but 318 additional choices may be available based on kernel configuration. 319 Default is set as part of kernel configuration. 320 For passive connections, the listener congestion control choice 321 is inherited. 322 323 [see setsockopt(listenfd, SOL_TCP, TCP_CONGESTION, "name" ...) ] 324 325tcp_dsack - BOOLEAN 326 Allows TCP to send "duplicate" SACKs. 327 328tcp_early_retrans - INTEGER 329 Tail loss probe (TLP) converts RTOs occurring due to tail 330 losses into fast recovery (draft-ietf-tcpm-rack). Note that 331 TLP requires RACK to function properly (see tcp_recovery below) 332 333 Possible values: 334 335 - 0 disables TLP 336 - 3 or 4 enables TLP 337 338 Default: 3 339 340tcp_ecn - INTEGER 341 Control use of Explicit Congestion Notification (ECN) by TCP. 342 ECN is used only when both ends of the TCP connection indicate 343 support for it. This feature is useful in avoiding losses due 344 to congestion by allowing supporting routers to signal 345 congestion before having to drop packets. 346 347 Possible values are: 348 349 = ===================================================== 350 0 Disable ECN. Neither initiate nor accept ECN. 351 1 Enable ECN when requested by incoming connections and 352 also request ECN on outgoing connection attempts. 353 2 Enable ECN when requested by incoming connections 354 but do not request ECN on outgoing connections. 355 = ===================================================== 356 357 Default: 2 358 359tcp_ecn_fallback - BOOLEAN 360 If the kernel detects that ECN connection misbehaves, enable fall 361 back to non-ECN. Currently, this knob implements the fallback 362 from RFC3168, section 6.1.1.1., but we reserve that in future, 363 additional detection mechanisms could be implemented under this 364 knob. The value is not used, if tcp_ecn or per route (or congestion 365 control) ECN settings are disabled. 366 367 Default: 1 (fallback enabled) 368 369tcp_fack - BOOLEAN 370 This is a legacy option, it has no effect anymore. 371 372tcp_fin_timeout - INTEGER 373 The length of time an orphaned (no longer referenced by any 374 application) connection will remain in the FIN_WAIT_2 state 375 before it is aborted at the local end. While a perfectly 376 valid "receive only" state for an un-orphaned connection, an 377 orphaned connection in FIN_WAIT_2 state could otherwise wait 378 forever for the remote to close its end of the connection. 379 380 Cf. tcp_max_orphans 381 382 Default: 60 seconds 383 384tcp_frto - INTEGER 385 Enables Forward RTO-Recovery (F-RTO) defined in RFC5682. 386 F-RTO is an enhanced recovery algorithm for TCP retransmission 387 timeouts. It is particularly beneficial in networks where the 388 RTT fluctuates (e.g., wireless). F-RTO is sender-side only 389 modification. It does not require any support from the peer. 390 391 By default it's enabled with a non-zero value. 0 disables F-RTO. 392 393tcp_fwmark_accept - BOOLEAN 394 If set, incoming connections to listening sockets that do not have a 395 socket mark will set the mark of the accepting socket to the fwmark of 396 the incoming SYN packet. This will cause all packets on that connection 397 (starting from the first SYNACK) to be sent with that fwmark. The 398 listening socket's mark is unchanged. Listening sockets that already 399 have a fwmark set via setsockopt(SOL_SOCKET, SO_MARK, ...) are 400 unaffected. 401 402 Default: 0 403 404tcp_invalid_ratelimit - INTEGER 405 Limit the maximal rate for sending duplicate acknowledgments 406 in response to incoming TCP packets that are for an existing 407 connection but that are invalid due to any of these reasons: 408 409 (a) out-of-window sequence number, 410 (b) out-of-window acknowledgment number, or 411 (c) PAWS (Protection Against Wrapped Sequence numbers) check failure 412 413 This can help mitigate simple "ack loop" DoS attacks, wherein 414 a buggy or malicious middlebox or man-in-the-middle can 415 rewrite TCP header fields in manner that causes each endpoint 416 to think that the other is sending invalid TCP segments, thus 417 causing each side to send an unterminating stream of duplicate 418 acknowledgments for invalid segments. 419 420 Using 0 disables rate-limiting of dupacks in response to 421 invalid segments; otherwise this value specifies the minimal 422 space between sending such dupacks, in milliseconds. 423 424 Default: 500 (milliseconds). 425 426tcp_keepalive_time - INTEGER 427 How often TCP sends out keepalive messages when keepalive is enabled. 428 Default: 2hours. 429 430tcp_keepalive_probes - INTEGER 431 How many keepalive probes TCP sends out, until it decides that the 432 connection is broken. Default value: 9. 433 434tcp_keepalive_intvl - INTEGER 435 How frequently the probes are send out. Multiplied by 436 tcp_keepalive_probes it is time to kill not responding connection, 437 after probes started. Default value: 75sec i.e. connection 438 will be aborted after ~11 minutes of retries. 439 440tcp_l3mdev_accept - BOOLEAN 441 Enables child sockets to inherit the L3 master device index. 442 Enabling this option allows a "global" listen socket to work 443 across L3 master domains (e.g., VRFs) with connected sockets 444 derived from the listen socket to be bound to the L3 domain in 445 which the packets originated. Only valid when the kernel was 446 compiled with CONFIG_NET_L3_MASTER_DEV. 447 448 Default: 0 (disabled) 449 450tcp_low_latency - BOOLEAN 451 This is a legacy option, it has no effect anymore. 452 453tcp_max_orphans - INTEGER 454 Maximal number of TCP sockets not attached to any user file handle, 455 held by system. If this number is exceeded orphaned connections are 456 reset immediately and warning is printed. This limit exists 457 only to prevent simple DoS attacks, you _must_ not rely on this 458 or lower the limit artificially, but rather increase it 459 (probably, after increasing installed memory), 460 if network conditions require more than default value, 461 and tune network services to linger and kill such states 462 more aggressively. Let me to remind again: each orphan eats 463 up to ~64K of unswappable memory. 464 465tcp_max_syn_backlog - INTEGER 466 Maximal number of remembered connection requests (SYN_RECV), 467 which have not received an acknowledgment from connecting client. 468 469 This is a per-listener limit. 470 471 The minimal value is 128 for low memory machines, and it will 472 increase in proportion to the memory of machine. 473 474 If server suffers from overload, try increasing this number. 475 476 Remember to also check /proc/sys/net/core/somaxconn 477 A SYN_RECV request socket consumes about 304 bytes of memory. 478 479tcp_max_tw_buckets - INTEGER 480 Maximal number of timewait sockets held by system simultaneously. 481 If this number is exceeded time-wait socket is immediately destroyed 482 and warning is printed. This limit exists only to prevent 483 simple DoS attacks, you _must_ not lower the limit artificially, 484 but rather increase it (probably, after increasing installed memory), 485 if network conditions require more than default value. 486 487tcp_mem - vector of 3 INTEGERs: min, pressure, max 488 min: below this number of pages TCP is not bothered about its 489 memory appetite. 490 491 pressure: when amount of memory allocated by TCP exceeds this number 492 of pages, TCP moderates its memory consumption and enters memory 493 pressure mode, which is exited when memory consumption falls 494 under "min". 495 496 max: number of pages allowed for queueing by all TCP sockets. 497 498 Defaults are calculated at boot time from amount of available 499 memory. 500 501tcp_min_rtt_wlen - INTEGER 502 The window length of the windowed min filter to track the minimum RTT. 503 A shorter window lets a flow more quickly pick up new (higher) 504 minimum RTT when it is moved to a longer path (e.g., due to traffic 505 engineering). A longer window makes the filter more resistant to RTT 506 inflations such as transient congestion. The unit is seconds. 507 508 Possible values: 0 - 86400 (1 day) 509 510 Default: 300 511 512tcp_moderate_rcvbuf - BOOLEAN 513 If set, TCP performs receive buffer auto-tuning, attempting to 514 automatically size the buffer (no greater than tcp_rmem[2]) to 515 match the size required by the path for full throughput. Enabled by 516 default. 517 518tcp_mtu_probing - INTEGER 519 Controls TCP Packetization-Layer Path MTU Discovery. Takes three 520 values: 521 522 - 0 - Disabled 523 - 1 - Disabled by default, enabled when an ICMP black hole detected 524 - 2 - Always enabled, use initial MSS of tcp_base_mss. 525 526tcp_probe_interval - UNSIGNED INTEGER 527 Controls how often to start TCP Packetization-Layer Path MTU 528 Discovery reprobe. The default is reprobing every 10 minutes as 529 per RFC4821. 530 531tcp_probe_threshold - INTEGER 532 Controls when TCP Packetization-Layer Path MTU Discovery probing 533 will stop in respect to the width of search range in bytes. Default 534 is 8 bytes. 535 536tcp_no_metrics_save - BOOLEAN 537 By default, TCP saves various connection metrics in the route cache 538 when the connection closes, so that connections established in the 539 near future can use these to set initial conditions. Usually, this 540 increases overall performance, but may sometimes cause performance 541 degradation. If set, TCP will not cache metrics on closing 542 connections. 543 544tcp_no_ssthresh_metrics_save - BOOLEAN 545 Controls whether TCP saves ssthresh metrics in the route cache. 546 547 Default is 1, which disables ssthresh metrics. 548 549tcp_orphan_retries - INTEGER 550 This value influences the timeout of a locally closed TCP connection, 551 when RTO retransmissions remain unacknowledged. 552 See tcp_retries2 for more details. 553 554 The default value is 8. 555 556 If your machine is a loaded WEB server, 557 you should think about lowering this value, such sockets 558 may consume significant resources. Cf. tcp_max_orphans. 559 560tcp_recovery - INTEGER 561 This value is a bitmap to enable various experimental loss recovery 562 features. 563 564 ========= ============================================================= 565 RACK: 0x1 enables the RACK loss detection for fast detection of lost 566 retransmissions and tail drops. It also subsumes and disables 567 RFC6675 recovery for SACK connections. 568 569 RACK: 0x2 makes RACK's reordering window static (min_rtt/4). 570 571 RACK: 0x4 disables RACK's DUPACK threshold heuristic 572 ========= ============================================================= 573 574 Default: 0x1 575 576tcp_reordering - INTEGER 577 Initial reordering level of packets in a TCP stream. 578 TCP stack can then dynamically adjust flow reordering level 579 between this initial value and tcp_max_reordering 580 581 Default: 3 582 583tcp_max_reordering - INTEGER 584 Maximal reordering level of packets in a TCP stream. 585 300 is a fairly conservative value, but you might increase it 586 if paths are using per packet load balancing (like bonding rr mode) 587 588 Default: 300 589 590tcp_retrans_collapse - BOOLEAN 591 Bug-to-bug compatibility with some broken printers. 592 On retransmit try to send bigger packets to work around bugs in 593 certain TCP stacks. 594 595tcp_retries1 - INTEGER 596 This value influences the time, after which TCP decides, that 597 something is wrong due to unacknowledged RTO retransmissions, 598 and reports this suspicion to the network layer. 599 See tcp_retries2 for more details. 600 601 RFC 1122 recommends at least 3 retransmissions, which is the 602 default. 603 604tcp_retries2 - INTEGER 605 This value influences the timeout of an alive TCP connection, 606 when RTO retransmissions remain unacknowledged. 607 Given a value of N, a hypothetical TCP connection following 608 exponential backoff with an initial RTO of TCP_RTO_MIN would 609 retransmit N times before killing the connection at the (N+1)th RTO. 610 611 The default value of 15 yields a hypothetical timeout of 924.6 612 seconds and is a lower bound for the effective timeout. 613 TCP will effectively time out at the first RTO which exceeds the 614 hypothetical timeout. 615 616 RFC 1122 recommends at least 100 seconds for the timeout, 617 which corresponds to a value of at least 8. 618 619tcp_rfc1337 - BOOLEAN 620 If set, the TCP stack behaves conforming to RFC1337. If unset, 621 we are not conforming to RFC, but prevent TCP TIME_WAIT 622 assassination. 623 624 Default: 0 625 626tcp_rmem - vector of 3 INTEGERs: min, default, max 627 min: Minimal size of receive buffer used by TCP sockets. 628 It is guaranteed to each TCP socket, even under moderate memory 629 pressure. 630 631 Default: 4K 632 633 default: initial size of receive buffer used by TCP sockets. 634 This value overrides net.core.rmem_default used by other protocols. 635 Default: 131072 bytes. 636 This value results in initial window of 65535. 637 638 max: maximal size of receive buffer allowed for automatically 639 selected receiver buffers for TCP socket. This value does not override 640 net.core.rmem_max. Calling setsockopt() with SO_RCVBUF disables 641 automatic tuning of that socket's receive buffer size, in which 642 case this value is ignored. 643 Default: between 131072 and 6MB, depending on RAM size. 644 645tcp_sack - BOOLEAN 646 Enable select acknowledgments (SACKS). 647 648tcp_comp_sack_delay_ns - LONG INTEGER 649 TCP tries to reduce number of SACK sent, using a timer 650 based on 5% of SRTT, capped by this sysctl, in nano seconds. 651 The default is 1ms, based on TSO autosizing period. 652 653 Default : 1,000,000 ns (1 ms) 654 655tcp_comp_sack_slack_ns - LONG INTEGER 656 This sysctl control the slack used when arming the 657 timer used by SACK compression. This gives extra time 658 for small RTT flows, and reduces system overhead by allowing 659 opportunistic reduction of timer interrupts. 660 661 Default : 100,000 ns (100 us) 662 663tcp_comp_sack_nr - INTEGER 664 Max number of SACK that can be compressed. 665 Using 0 disables SACK compression. 666 667 Default : 44 668 669tcp_slow_start_after_idle - BOOLEAN 670 If set, provide RFC2861 behavior and time out the congestion 671 window after an idle period. An idle period is defined at 672 the current RTO. If unset, the congestion window will not 673 be timed out after an idle period. 674 675 Default: 1 676 677tcp_stdurg - BOOLEAN 678 Use the Host requirements interpretation of the TCP urgent pointer field. 679 Most hosts use the older BSD interpretation, so if you turn this on 680 Linux might not communicate correctly with them. 681 682 Default: FALSE 683 684tcp_synack_retries - INTEGER 685 Number of times SYNACKs for a passive TCP connection attempt will 686 be retransmitted. Should not be higher than 255. Default value 687 is 5, which corresponds to 31seconds till the last retransmission 688 with the current initial RTO of 1second. With this the final timeout 689 for a passive TCP connection will happen after 63seconds. 690 691tcp_syncookies - INTEGER 692 Only valid when the kernel was compiled with CONFIG_SYN_COOKIES 693 Send out syncookies when the syn backlog queue of a socket 694 overflows. This is to prevent against the common 'SYN flood attack' 695 Default: 1 696 697 Note, that syncookies is fallback facility. 698 It MUST NOT be used to help highly loaded servers to stand 699 against legal connection rate. If you see SYN flood warnings 700 in your logs, but investigation shows that they occur 701 because of overload with legal connections, you should tune 702 another parameters until this warning disappear. 703 See: tcp_max_syn_backlog, tcp_synack_retries, tcp_abort_on_overflow. 704 705 syncookies seriously violate TCP protocol, do not allow 706 to use TCP extensions, can result in serious degradation 707 of some services (f.e. SMTP relaying), visible not by you, 708 but your clients and relays, contacting you. While you see 709 SYN flood warnings in logs not being really flooded, your server 710 is seriously misconfigured. 711 712 If you want to test which effects syncookies have to your 713 network connections you can set this knob to 2 to enable 714 unconditionally generation of syncookies. 715 716tcp_fastopen - INTEGER 717 Enable TCP Fast Open (RFC7413) to send and accept data in the opening 718 SYN packet. 719 720 The client support is enabled by flag 0x1 (on by default). The client 721 then must use sendmsg() or sendto() with the MSG_FASTOPEN flag, 722 rather than connect() to send data in SYN. 723 724 The server support is enabled by flag 0x2 (off by default). Then 725 either enable for all listeners with another flag (0x400) or 726 enable individual listeners via TCP_FASTOPEN socket option with 727 the option value being the length of the syn-data backlog. 728 729 The values (bitmap) are 730 731 ===== ======== ====================================================== 732 0x1 (client) enables sending data in the opening SYN on the client. 733 0x2 (server) enables the server support, i.e., allowing data in 734 a SYN packet to be accepted and passed to the 735 application before 3-way handshake finishes. 736 0x4 (client) send data in the opening SYN regardless of cookie 737 availability and without a cookie option. 738 0x200 (server) accept data-in-SYN w/o any cookie option present. 739 0x400 (server) enable all listeners to support Fast Open by 740 default without explicit TCP_FASTOPEN socket option. 741 ===== ======== ====================================================== 742 743 Default: 0x1 744 745 Note that additional client or server features are only 746 effective if the basic support (0x1 and 0x2) are enabled respectively. 747 748tcp_fastopen_blackhole_timeout_sec - INTEGER 749 Initial time period in second to disable Fastopen on active TCP sockets 750 when a TFO firewall blackhole issue happens. 751 This time period will grow exponentially when more blackhole issues 752 get detected right after Fastopen is re-enabled and will reset to 753 initial value when the blackhole issue goes away. 754 0 to disable the blackhole detection. 755 756 By default, it is set to 0 (feature is disabled). 757 758tcp_fastopen_key - list of comma separated 32-digit hexadecimal INTEGERs 759 The list consists of a primary key and an optional backup key. The 760 primary key is used for both creating and validating cookies, while the 761 optional backup key is only used for validating cookies. The purpose of 762 the backup key is to maximize TFO validation when keys are rotated. 763 764 A randomly chosen primary key may be configured by the kernel if 765 the tcp_fastopen sysctl is set to 0x400 (see above), or if the 766 TCP_FASTOPEN setsockopt() optname is set and a key has not been 767 previously configured via sysctl. If keys are configured via 768 setsockopt() by using the TCP_FASTOPEN_KEY optname, then those 769 per-socket keys will be used instead of any keys that are specified via 770 sysctl. 771 772 A key is specified as 4 8-digit hexadecimal integers which are separated 773 by a '-' as: xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx. Leading zeros may be 774 omitted. A primary and a backup key may be specified by separating them 775 by a comma. If only one key is specified, it becomes the primary key and 776 any previously configured backup keys are removed. 777 778tcp_syn_retries - INTEGER 779 Number of times initial SYNs for an active TCP connection attempt 780 will be retransmitted. Should not be higher than 127. Default value 781 is 6, which corresponds to 63seconds till the last retransmission 782 with the current initial RTO of 1second. With this the final timeout 783 for an active TCP connection attempt will happen after 127seconds. 784 785tcp_timestamps - INTEGER 786 Enable timestamps as defined in RFC1323. 787 788 - 0: Disabled. 789 - 1: Enable timestamps as defined in RFC1323 and use random offset for 790 each connection rather than only using the current time. 791 - 2: Like 1, but without random offsets. 792 793 Default: 1 794 795tcp_min_tso_segs - INTEGER 796 Minimal number of segments per TSO frame. 797 798 Since linux-3.12, TCP does an automatic sizing of TSO frames, 799 depending on flow rate, instead of filling 64Kbytes packets. 800 For specific usages, it's possible to force TCP to build big 801 TSO frames. Note that TCP stack might split too big TSO packets 802 if available window is too small. 803 804 Default: 2 805 806tcp_pacing_ss_ratio - INTEGER 807 sk->sk_pacing_rate is set by TCP stack using a ratio applied 808 to current rate. (current_rate = cwnd * mss / srtt) 809 If TCP is in slow start, tcp_pacing_ss_ratio is applied 810 to let TCP probe for bigger speeds, assuming cwnd can be 811 doubled every other RTT. 812 813 Default: 200 814 815tcp_pacing_ca_ratio - INTEGER 816 sk->sk_pacing_rate is set by TCP stack using a ratio applied 817 to current rate. (current_rate = cwnd * mss / srtt) 818 If TCP is in congestion avoidance phase, tcp_pacing_ca_ratio 819 is applied to conservatively probe for bigger throughput. 820 821 Default: 120 822 823tcp_tso_win_divisor - INTEGER 824 This allows control over what percentage of the congestion window 825 can be consumed by a single TSO frame. 826 The setting of this parameter is a choice between burstiness and 827 building larger TSO frames. 828 829 Default: 3 830 831tcp_tw_reuse - INTEGER 832 Enable reuse of TIME-WAIT sockets for new connections when it is 833 safe from protocol viewpoint. 834 835 - 0 - disable 836 - 1 - global enable 837 - 2 - enable for loopback traffic only 838 839 It should not be changed without advice/request of technical 840 experts. 841 842 Default: 2 843 844tcp_window_scaling - BOOLEAN 845 Enable window scaling as defined in RFC1323. 846 847tcp_wmem - vector of 3 INTEGERs: min, default, max 848 min: Amount of memory reserved for send buffers for TCP sockets. 849 Each TCP socket has rights to use it due to fact of its birth. 850 851 Default: 4K 852 853 default: initial size of send buffer used by TCP sockets. This 854 value overrides net.core.wmem_default used by other protocols. 855 856 It is usually lower than net.core.wmem_default. 857 858 Default: 16K 859 860 max: Maximal amount of memory allowed for automatically tuned 861 send buffers for TCP sockets. This value does not override 862 net.core.wmem_max. Calling setsockopt() with SO_SNDBUF disables 863 automatic tuning of that socket's send buffer size, in which case 864 this value is ignored. 865 866 Default: between 64K and 4MB, depending on RAM size. 867 868tcp_notsent_lowat - UNSIGNED INTEGER 869 A TCP socket can control the amount of unsent bytes in its write queue, 870 thanks to TCP_NOTSENT_LOWAT socket option. poll()/select()/epoll() 871 reports POLLOUT events if the amount of unsent bytes is below a per 872 socket value, and if the write queue is not full. sendmsg() will 873 also not add new buffers if the limit is hit. 874 875 This global variable controls the amount of unsent data for 876 sockets not using TCP_NOTSENT_LOWAT. For these sockets, a change 877 to the global variable has immediate effect. 878 879 Default: UINT_MAX (0xFFFFFFFF) 880 881tcp_workaround_signed_windows - BOOLEAN 882 If set, assume no receipt of a window scaling option means the 883 remote TCP is broken and treats the window as a signed quantity. 884 If unset, assume the remote TCP is not broken even if we do 885 not receive a window scaling option from them. 886 887 Default: 0 888 889tcp_thin_linear_timeouts - BOOLEAN 890 Enable dynamic triggering of linear timeouts for thin streams. 891 If set, a check is performed upon retransmission by timeout to 892 determine if the stream is thin (less than 4 packets in flight). 893 As long as the stream is found to be thin, up to 6 linear 894 timeouts may be performed before exponential backoff mode is 895 initiated. This improves retransmission latency for 896 non-aggressive thin streams, often found to be time-dependent. 897 For more information on thin streams, see 898 Documentation/networking/tcp-thin.rst 899 900 Default: 0 901 902tcp_limit_output_bytes - INTEGER 903 Controls TCP Small Queue limit per tcp socket. 904 TCP bulk sender tends to increase packets in flight until it 905 gets losses notifications. With SNDBUF autotuning, this can 906 result in a large amount of packets queued on the local machine 907 (e.g.: qdiscs, CPU backlog, or device) hurting latency of other 908 flows, for typical pfifo_fast qdiscs. tcp_limit_output_bytes 909 limits the number of bytes on qdisc or device to reduce artificial 910 RTT/cwnd and reduce bufferbloat. 911 912 Default: 1048576 (16 * 65536) 913 914tcp_challenge_ack_limit - INTEGER 915 Limits number of Challenge ACK sent per second, as recommended 916 in RFC 5961 (Improving TCP's Robustness to Blind In-Window Attacks) 917 Default: 1000 918 919tcp_rx_skb_cache - BOOLEAN 920 Controls a per TCP socket cache of one skb, that might help 921 performance of some workloads. This might be dangerous 922 on systems with a lot of TCP sockets, since it increases 923 memory usage. 924 925 Default: 0 (disabled) 926 927UDP variables 928============= 929 930udp_l3mdev_accept - BOOLEAN 931 Enabling this option allows a "global" bound socket to work 932 across L3 master domains (e.g., VRFs) with packets capable of 933 being received regardless of the L3 domain in which they 934 originated. Only valid when the kernel was compiled with 935 CONFIG_NET_L3_MASTER_DEV. 936 937 Default: 0 (disabled) 938 939udp_mem - vector of 3 INTEGERs: min, pressure, max 940 Number of pages allowed for queueing by all UDP sockets. 941 942 min: Below this number of pages UDP is not bothered about its 943 memory appetite. When amount of memory allocated by UDP exceeds 944 this number, UDP starts to moderate memory usage. 945 946 pressure: This value was introduced to follow format of tcp_mem. 947 948 max: Number of pages allowed for queueing by all UDP sockets. 949 950 Default is calculated at boot time from amount of available memory. 951 952udp_rmem_min - INTEGER 953 Minimal size of receive buffer used by UDP sockets in moderation. 954 Each UDP socket is able to use the size for receiving data, even if 955 total pages of UDP sockets exceed udp_mem pressure. The unit is byte. 956 957 Default: 4K 958 959udp_wmem_min - INTEGER 960 Minimal size of send buffer used by UDP sockets in moderation. 961 Each UDP socket is able to use the size for sending data, even if 962 total pages of UDP sockets exceed udp_mem pressure. The unit is byte. 963 964 Default: 4K 965 966RAW variables 967============= 968 969raw_l3mdev_accept - BOOLEAN 970 Enabling this option allows a "global" bound socket to work 971 across L3 master domains (e.g., VRFs) with packets capable of 972 being received regardless of the L3 domain in which they 973 originated. Only valid when the kernel was compiled with 974 CONFIG_NET_L3_MASTER_DEV. 975 976 Default: 1 (enabled) 977 978CIPSOv4 Variables 979================= 980 981cipso_cache_enable - BOOLEAN 982 If set, enable additions to and lookups from the CIPSO label mapping 983 cache. If unset, additions are ignored and lookups always result in a 984 miss. However, regardless of the setting the cache is still 985 invalidated when required when means you can safely toggle this on and 986 off and the cache will always be "safe". 987 988 Default: 1 989 990cipso_cache_bucket_size - INTEGER 991 The CIPSO label cache consists of a fixed size hash table with each 992 hash bucket containing a number of cache entries. This variable limits 993 the number of entries in each hash bucket; the larger the value is, the 994 more CIPSO label mappings that can be cached. When the number of 995 entries in a given hash bucket reaches this limit adding new entries 996 causes the oldest entry in the bucket to be removed to make room. 997 998 Default: 10 999 1000cipso_rbm_optfmt - BOOLEAN 1001 Enable the "Optimized Tag 1 Format" as defined in section 3.4.2.6 of 1002 the CIPSO draft specification (see Documentation/netlabel for details). 1003 This means that when set the CIPSO tag will be padded with empty 1004 categories in order to make the packet data 32-bit aligned. 1005 1006 Default: 0 1007 1008cipso_rbm_structvalid - BOOLEAN 1009 If set, do a very strict check of the CIPSO option when 1010 ip_options_compile() is called. If unset, relax the checks done during 1011 ip_options_compile(). Either way is "safe" as errors are caught else 1012 where in the CIPSO processing code but setting this to 0 (False) should 1013 result in less work (i.e. it should be faster) but could cause problems 1014 with other implementations that require strict checking. 1015 1016 Default: 0 1017 1018IP Variables 1019============ 1020 1021ip_local_port_range - 2 INTEGERS 1022 Defines the local port range that is used by TCP and UDP to 1023 choose the local port. The first number is the first, the 1024 second the last local port number. 1025 If possible, it is better these numbers have different parity 1026 (one even and one odd value). 1027 Must be greater than or equal to ip_unprivileged_port_start. 1028 The default values are 32768 and 60999 respectively. 1029 1030ip_local_reserved_ports - list of comma separated ranges 1031 Specify the ports which are reserved for known third-party 1032 applications. These ports will not be used by automatic port 1033 assignments (e.g. when calling connect() or bind() with port 1034 number 0). Explicit port allocation behavior is unchanged. 1035 1036 The format used for both input and output is a comma separated 1037 list of ranges (e.g. "1,2-4,10-10" for ports 1, 2, 3, 4 and 1038 10). Writing to the file will clear all previously reserved 1039 ports and update the current list with the one given in the 1040 input. 1041 1042 Note that ip_local_port_range and ip_local_reserved_ports 1043 settings are independent and both are considered by the kernel 1044 when determining which ports are available for automatic port 1045 assignments. 1046 1047 You can reserve ports which are not in the current 1048 ip_local_port_range, e.g.:: 1049 1050 $ cat /proc/sys/net/ipv4/ip_local_port_range 1051 32000 60999 1052 $ cat /proc/sys/net/ipv4/ip_local_reserved_ports 1053 8080,9148 1054 1055 although this is redundant. However such a setting is useful 1056 if later the port range is changed to a value that will 1057 include the reserved ports. 1058 1059 Default: Empty 1060 1061ip_unprivileged_port_start - INTEGER 1062 This is a per-namespace sysctl. It defines the first 1063 unprivileged port in the network namespace. Privileged ports 1064 require root or CAP_NET_BIND_SERVICE in order to bind to them. 1065 To disable all privileged ports, set this to 0. They must not 1066 overlap with the ip_local_port_range. 1067 1068 Default: 1024 1069 1070ip_nonlocal_bind - BOOLEAN 1071 If set, allows processes to bind() to non-local IP addresses, 1072 which can be quite useful - but may break some applications. 1073 1074 Default: 0 1075 1076ip_autobind_reuse - BOOLEAN 1077 By default, bind() does not select the ports automatically even if 1078 the new socket and all sockets bound to the port have SO_REUSEADDR. 1079 ip_autobind_reuse allows bind() to reuse the port and this is useful 1080 when you use bind()+connect(), but may break some applications. 1081 The preferred solution is to use IP_BIND_ADDRESS_NO_PORT and this 1082 option should only be set by experts. 1083 Default: 0 1084 1085ip_dynaddr - INTEGER 1086 If set non-zero, enables support for dynamic addresses. 1087 If set to a non-zero value larger than 1, a kernel log 1088 message will be printed when dynamic address rewriting 1089 occurs. 1090 1091 Default: 0 1092 1093ip_early_demux - BOOLEAN 1094 Optimize input packet processing down to one demux for 1095 certain kinds of local sockets. Currently we only do this 1096 for established TCP and connected UDP sockets. 1097 1098 It may add an additional cost for pure routing workloads that 1099 reduces overall throughput, in such case you should disable it. 1100 1101 Default: 1 1102 1103ping_group_range - 2 INTEGERS 1104 Restrict ICMP_PROTO datagram sockets to users in the group range. 1105 The default is "1 0", meaning, that nobody (not even root) may 1106 create ping sockets. Setting it to "100 100" would grant permissions 1107 to the single group. "0 4294967295" would enable it for the world, "100 1108 4294967295" would enable it for the users, but not daemons. 1109 1110tcp_early_demux - BOOLEAN 1111 Enable early demux for established TCP sockets. 1112 1113 Default: 1 1114 1115udp_early_demux - BOOLEAN 1116 Enable early demux for connected UDP sockets. Disable this if 1117 your system could experience more unconnected load. 1118 1119 Default: 1 1120 1121icmp_echo_ignore_all - BOOLEAN 1122 If set non-zero, then the kernel will ignore all ICMP ECHO 1123 requests sent to it. 1124 1125 Default: 0 1126 1127icmp_echo_ignore_broadcasts - BOOLEAN 1128 If set non-zero, then the kernel will ignore all ICMP ECHO and 1129 TIMESTAMP requests sent to it via broadcast/multicast. 1130 1131 Default: 1 1132 1133icmp_ratelimit - INTEGER 1134 Limit the maximal rates for sending ICMP packets whose type matches 1135 icmp_ratemask (see below) to specific targets. 1136 0 to disable any limiting, 1137 otherwise the minimal space between responses in milliseconds. 1138 Note that another sysctl, icmp_msgs_per_sec limits the number 1139 of ICMP packets sent on all targets. 1140 1141 Default: 1000 1142 1143icmp_msgs_per_sec - INTEGER 1144 Limit maximal number of ICMP packets sent per second from this host. 1145 Only messages whose type matches icmp_ratemask (see below) are 1146 controlled by this limit. For security reasons, the precise count 1147 of messages per second is randomized. 1148 1149 Default: 1000 1150 1151icmp_msgs_burst - INTEGER 1152 icmp_msgs_per_sec controls number of ICMP packets sent per second, 1153 while icmp_msgs_burst controls the burst size of these packets. 1154 For security reasons, the precise burst size is randomized. 1155 1156 Default: 50 1157 1158icmp_ratemask - INTEGER 1159 Mask made of ICMP types for which rates are being limited. 1160 1161 Significant bits: IHGFEDCBA9876543210 1162 1163 Default mask: 0000001100000011000 (6168) 1164 1165 Bit definitions (see include/linux/icmp.h): 1166 1167 = ========================= 1168 0 Echo Reply 1169 3 Destination Unreachable [1]_ 1170 4 Source Quench [1]_ 1171 5 Redirect 1172 8 Echo Request 1173 B Time Exceeded [1]_ 1174 C Parameter Problem [1]_ 1175 D Timestamp Request 1176 E Timestamp Reply 1177 F Info Request 1178 G Info Reply 1179 H Address Mask Request 1180 I Address Mask Reply 1181 = ========================= 1182 1183 .. [1] These are rate limited by default (see default mask above) 1184 1185icmp_ignore_bogus_error_responses - BOOLEAN 1186 Some routers violate RFC1122 by sending bogus responses to broadcast 1187 frames. Such violations are normally logged via a kernel warning. 1188 If this is set to TRUE, the kernel will not give such warnings, which 1189 will avoid log file clutter. 1190 1191 Default: 1 1192 1193icmp_errors_use_inbound_ifaddr - BOOLEAN 1194 1195 If zero, icmp error messages are sent with the primary address of 1196 the exiting interface. 1197 1198 If non-zero, the message will be sent with the primary address of 1199 the interface that received the packet that caused the icmp error. 1200 This is the behaviour network many administrators will expect from 1201 a router. And it can make debugging complicated network layouts 1202 much easier. 1203 1204 Note that if no primary address exists for the interface selected, 1205 then the primary address of the first non-loopback interface that 1206 has one will be used regardless of this setting. 1207 1208 Default: 0 1209 1210igmp_max_memberships - INTEGER 1211 Change the maximum number of multicast groups we can subscribe to. 1212 Default: 20 1213 1214 Theoretical maximum value is bounded by having to send a membership 1215 report in a single datagram (i.e. the report can't span multiple 1216 datagrams, or risk confusing the switch and leaving groups you don't 1217 intend to). 1218 1219 The number of supported groups 'M' is bounded by the number of group 1220 report entries you can fit into a single datagram of 65535 bytes. 1221 1222 M = 65536-sizeof (ip header)/(sizeof(Group record)) 1223 1224 Group records are variable length, with a minimum of 12 bytes. 1225 So net.ipv4.igmp_max_memberships should not be set higher than: 1226 1227 (65536-24) / 12 = 5459 1228 1229 The value 5459 assumes no IP header options, so in practice 1230 this number may be lower. 1231 1232igmp_max_msf - INTEGER 1233 Maximum number of addresses allowed in the source filter list for a 1234 multicast group. 1235 1236 Default: 10 1237 1238igmp_qrv - INTEGER 1239 Controls the IGMP query robustness variable (see RFC2236 8.1). 1240 1241 Default: 2 (as specified by RFC2236 8.1) 1242 1243 Minimum: 1 (as specified by RFC6636 4.5) 1244 1245force_igmp_version - INTEGER 1246 - 0 - (default) No enforcement of a IGMP version, IGMPv1/v2 fallback 1247 allowed. Will back to IGMPv3 mode again if all IGMPv1/v2 Querier 1248 Present timer expires. 1249 - 1 - Enforce to use IGMP version 1. Will also reply IGMPv1 report if 1250 receive IGMPv2/v3 query. 1251 - 2 - Enforce to use IGMP version 2. Will fallback to IGMPv1 if receive 1252 IGMPv1 query message. Will reply report if receive IGMPv3 query. 1253 - 3 - Enforce to use IGMP version 3. The same react with default 0. 1254 1255 .. note:: 1256 1257 this is not the same with force_mld_version because IGMPv3 RFC3376 1258 Security Considerations does not have clear description that we could 1259 ignore other version messages completely as MLDv2 RFC3810. So make 1260 this value as default 0 is recommended. 1261 1262``conf/interface/*`` 1263 changes special settings per interface (where 1264 interface" is the name of your network interface) 1265 1266``conf/all/*`` 1267 is special, changes the settings for all interfaces 1268 1269log_martians - BOOLEAN 1270 Log packets with impossible addresses to kernel log. 1271 log_martians for the interface will be enabled if at least one of 1272 conf/{all,interface}/log_martians is set to TRUE, 1273 it will be disabled otherwise 1274 1275accept_redirects - BOOLEAN 1276 Accept ICMP redirect messages. 1277 accept_redirects for the interface will be enabled if: 1278 1279 - both conf/{all,interface}/accept_redirects are TRUE in the case 1280 forwarding for the interface is enabled 1281 1282 or 1283 1284 - at least one of conf/{all,interface}/accept_redirects is TRUE in the 1285 case forwarding for the interface is disabled 1286 1287 accept_redirects for the interface will be disabled otherwise 1288 1289 default: 1290 1291 - TRUE (host) 1292 - FALSE (router) 1293 1294forwarding - BOOLEAN 1295 Enable IP forwarding on this interface. This controls whether packets 1296 received _on_ this interface can be forwarded. 1297 1298mc_forwarding - BOOLEAN 1299 Do multicast routing. The kernel needs to be compiled with CONFIG_MROUTE 1300 and a multicast routing daemon is required. 1301 conf/all/mc_forwarding must also be set to TRUE to enable multicast 1302 routing for the interface 1303 1304medium_id - INTEGER 1305 Integer value used to differentiate the devices by the medium they 1306 are attached to. Two devices can have different id values when 1307 the broadcast packets are received only on one of them. 1308 The default value 0 means that the device is the only interface 1309 to its medium, value of -1 means that medium is not known. 1310 1311 Currently, it is used to change the proxy_arp behavior: 1312 the proxy_arp feature is enabled for packets forwarded between 1313 two devices attached to different media. 1314 1315proxy_arp - BOOLEAN 1316 Do proxy arp. 1317 1318 proxy_arp for the interface will be enabled if at least one of 1319 conf/{all,interface}/proxy_arp is set to TRUE, 1320 it will be disabled otherwise 1321 1322proxy_arp_pvlan - BOOLEAN 1323 Private VLAN proxy arp. 1324 1325 Basically allow proxy arp replies back to the same interface 1326 (from which the ARP request/solicitation was received). 1327 1328 This is done to support (ethernet) switch features, like RFC 1329 3069, where the individual ports are NOT allowed to 1330 communicate with each other, but they are allowed to talk to 1331 the upstream router. As described in RFC 3069, it is possible 1332 to allow these hosts to communicate through the upstream 1333 router by proxy_arp'ing. Don't need to be used together with 1334 proxy_arp. 1335 1336 This technology is known by different names: 1337 1338 In RFC 3069 it is called VLAN Aggregation. 1339 Cisco and Allied Telesyn call it Private VLAN. 1340 Hewlett-Packard call it Source-Port filtering or port-isolation. 1341 Ericsson call it MAC-Forced Forwarding (RFC Draft). 1342 1343shared_media - BOOLEAN 1344 Send(router) or accept(host) RFC1620 shared media redirects. 1345 Overrides secure_redirects. 1346 1347 shared_media for the interface will be enabled if at least one of 1348 conf/{all,interface}/shared_media is set to TRUE, 1349 it will be disabled otherwise 1350 1351 default TRUE 1352 1353secure_redirects - BOOLEAN 1354 Accept ICMP redirect messages only to gateways listed in the 1355 interface's current gateway list. Even if disabled, RFC1122 redirect 1356 rules still apply. 1357 1358 Overridden by shared_media. 1359 1360 secure_redirects for the interface will be enabled if at least one of 1361 conf/{all,interface}/secure_redirects is set to TRUE, 1362 it will be disabled otherwise 1363 1364 default TRUE 1365 1366send_redirects - BOOLEAN 1367 Send redirects, if router. 1368 1369 send_redirects for the interface will be enabled if at least one of 1370 conf/{all,interface}/send_redirects is set to TRUE, 1371 it will be disabled otherwise 1372 1373 Default: TRUE 1374 1375bootp_relay - BOOLEAN 1376 Accept packets with source address 0.b.c.d destined 1377 not to this host as local ones. It is supposed, that 1378 BOOTP relay daemon will catch and forward such packets. 1379 conf/all/bootp_relay must also be set to TRUE to enable BOOTP relay 1380 for the interface 1381 1382 default FALSE 1383 1384 Not Implemented Yet. 1385 1386accept_source_route - BOOLEAN 1387 Accept packets with SRR option. 1388 conf/all/accept_source_route must also be set to TRUE to accept packets 1389 with SRR option on the interface 1390 1391 default 1392 1393 - TRUE (router) 1394 - FALSE (host) 1395 1396accept_local - BOOLEAN 1397 Accept packets with local source addresses. In combination with 1398 suitable routing, this can be used to direct packets between two 1399 local interfaces over the wire and have them accepted properly. 1400 default FALSE 1401 1402route_localnet - BOOLEAN 1403 Do not consider loopback addresses as martian source or destination 1404 while routing. This enables the use of 127/8 for local routing purposes. 1405 1406 default FALSE 1407 1408rp_filter - INTEGER 1409 - 0 - No source validation. 1410 - 1 - Strict mode as defined in RFC3704 Strict Reverse Path 1411 Each incoming packet is tested against the FIB and if the interface 1412 is not the best reverse path the packet check will fail. 1413 By default failed packets are discarded. 1414 - 2 - Loose mode as defined in RFC3704 Loose Reverse Path 1415 Each incoming packet's source address is also tested against the FIB 1416 and if the source address is not reachable via any interface 1417 the packet check will fail. 1418 1419 Current recommended practice in RFC3704 is to enable strict mode 1420 to prevent IP spoofing from DDos attacks. If using asymmetric routing 1421 or other complicated routing, then loose mode is recommended. 1422 1423 The max value from conf/{all,interface}/rp_filter is used 1424 when doing source validation on the {interface}. 1425 1426 Default value is 0. Note that some distributions enable it 1427 in startup scripts. 1428 1429arp_filter - BOOLEAN 1430 - 1 - Allows you to have multiple network interfaces on the same 1431 subnet, and have the ARPs for each interface be answered 1432 based on whether or not the kernel would route a packet from 1433 the ARP'd IP out that interface (therefore you must use source 1434 based routing for this to work). In other words it allows control 1435 of which cards (usually 1) will respond to an arp request. 1436 1437 - 0 - (default) The kernel can respond to arp requests with addresses 1438 from other interfaces. This may seem wrong but it usually makes 1439 sense, because it increases the chance of successful communication. 1440 IP addresses are owned by the complete host on Linux, not by 1441 particular interfaces. Only for more complex setups like load- 1442 balancing, does this behaviour cause problems. 1443 1444 arp_filter for the interface will be enabled if at least one of 1445 conf/{all,interface}/arp_filter is set to TRUE, 1446 it will be disabled otherwise 1447 1448arp_announce - INTEGER 1449 Define different restriction levels for announcing the local 1450 source IP address from IP packets in ARP requests sent on 1451 interface: 1452 1453 - 0 - (default) Use any local address, configured on any interface 1454 - 1 - Try to avoid local addresses that are not in the target's 1455 subnet for this interface. This mode is useful when target 1456 hosts reachable via this interface require the source IP 1457 address in ARP requests to be part of their logical network 1458 configured on the receiving interface. When we generate the 1459 request we will check all our subnets that include the 1460 target IP and will preserve the source address if it is from 1461 such subnet. If there is no such subnet we select source 1462 address according to the rules for level 2. 1463 - 2 - Always use the best local address for this target. 1464 In this mode we ignore the source address in the IP packet 1465 and try to select local address that we prefer for talks with 1466 the target host. Such local address is selected by looking 1467 for primary IP addresses on all our subnets on the outgoing 1468 interface that include the target IP address. If no suitable 1469 local address is found we select the first local address 1470 we have on the outgoing interface or on all other interfaces, 1471 with the hope we will receive reply for our request and 1472 even sometimes no matter the source IP address we announce. 1473 1474 The max value from conf/{all,interface}/arp_announce is used. 1475 1476 Increasing the restriction level gives more chance for 1477 receiving answer from the resolved target while decreasing 1478 the level announces more valid sender's information. 1479 1480arp_ignore - INTEGER 1481 Define different modes for sending replies in response to 1482 received ARP requests that resolve local target IP addresses: 1483 1484 - 0 - (default): reply for any local target IP address, configured 1485 on any interface 1486 - 1 - reply only if the target IP address is local address 1487 configured on the incoming interface 1488 - 2 - reply only if the target IP address is local address 1489 configured on the incoming interface and both with the 1490 sender's IP address are part from same subnet on this interface 1491 - 3 - do not reply for local addresses configured with scope host, 1492 only resolutions for global and link addresses are replied 1493 - 4-7 - reserved 1494 - 8 - do not reply for all local addresses 1495 1496 The max value from conf/{all,interface}/arp_ignore is used 1497 when ARP request is received on the {interface} 1498 1499arp_notify - BOOLEAN 1500 Define mode for notification of address and device changes. 1501 1502 == ========================================================== 1503 0 (default): do nothing 1504 1 Generate gratuitous arp requests when device is brought up 1505 or hardware address changes. 1506 == ========================================================== 1507 1508arp_accept - BOOLEAN 1509 Define behavior for gratuitous ARP frames who's IP is not 1510 already present in the ARP table: 1511 1512 - 0 - don't create new entries in the ARP table 1513 - 1 - create new entries in the ARP table 1514 1515 Both replies and requests type gratuitous arp will trigger the 1516 ARP table to be updated, if this setting is on. 1517 1518 If the ARP table already contains the IP address of the 1519 gratuitous arp frame, the arp table will be updated regardless 1520 if this setting is on or off. 1521 1522mcast_solicit - INTEGER 1523 The maximum number of multicast probes in INCOMPLETE state, 1524 when the associated hardware address is unknown. Defaults 1525 to 3. 1526 1527ucast_solicit - INTEGER 1528 The maximum number of unicast probes in PROBE state, when 1529 the hardware address is being reconfirmed. Defaults to 3. 1530 1531app_solicit - INTEGER 1532 The maximum number of probes to send to the user space ARP daemon 1533 via netlink before dropping back to multicast probes (see 1534 mcast_resolicit). Defaults to 0. 1535 1536mcast_resolicit - INTEGER 1537 The maximum number of multicast probes after unicast and 1538 app probes in PROBE state. Defaults to 0. 1539 1540disable_policy - BOOLEAN 1541 Disable IPSEC policy (SPD) for this interface 1542 1543disable_xfrm - BOOLEAN 1544 Disable IPSEC encryption on this interface, whatever the policy 1545 1546igmpv2_unsolicited_report_interval - INTEGER 1547 The interval in milliseconds in which the next unsolicited 1548 IGMPv1 or IGMPv2 report retransmit will take place. 1549 1550 Default: 10000 (10 seconds) 1551 1552igmpv3_unsolicited_report_interval - INTEGER 1553 The interval in milliseconds in which the next unsolicited 1554 IGMPv3 report retransmit will take place. 1555 1556 Default: 1000 (1 seconds) 1557 1558promote_secondaries - BOOLEAN 1559 When a primary IP address is removed from this interface 1560 promote a corresponding secondary IP address instead of 1561 removing all the corresponding secondary IP addresses. 1562 1563drop_unicast_in_l2_multicast - BOOLEAN 1564 Drop any unicast IP packets that are received in link-layer 1565 multicast (or broadcast) frames. 1566 1567 This behavior (for multicast) is actually a SHOULD in RFC 1568 1122, but is disabled by default for compatibility reasons. 1569 1570 Default: off (0) 1571 1572drop_gratuitous_arp - BOOLEAN 1573 Drop all gratuitous ARP frames, for example if there's a known 1574 good ARP proxy on the network and such frames need not be used 1575 (or in the case of 802.11, must not be used to prevent attacks.) 1576 1577 Default: off (0) 1578 1579 1580tag - INTEGER 1581 Allows you to write a number, which can be used as required. 1582 1583 Default value is 0. 1584 1585xfrm4_gc_thresh - INTEGER 1586 (Obsolete since linux-4.14) 1587 The threshold at which we will start garbage collecting for IPv4 1588 destination cache entries. At twice this value the system will 1589 refuse new allocations. 1590 1591igmp_link_local_mcast_reports - BOOLEAN 1592 Enable IGMP reports for link local multicast groups in the 1593 224.0.0.X range. 1594 1595 Default TRUE 1596 1597Alexey Kuznetsov. 1598kuznet@ms2.inr.ac.ru 1599 1600Updated by: 1601 1602- Andi Kleen 1603 ak@muc.de 1604- Nicolas Delon 1605 delon.nicolas@wanadoo.fr 1606 1607 1608 1609 1610/proc/sys/net/ipv6/* Variables 1611============================== 1612 1613IPv6 has no global variables such as tcp_*. tcp_* settings under ipv4/ also 1614apply to IPv6 [XXX?]. 1615 1616bindv6only - BOOLEAN 1617 Default value for IPV6_V6ONLY socket option, 1618 which restricts use of the IPv6 socket to IPv6 communication 1619 only. 1620 1621 - TRUE: disable IPv4-mapped address feature 1622 - FALSE: enable IPv4-mapped address feature 1623 1624 Default: FALSE (as specified in RFC3493) 1625 1626flowlabel_consistency - BOOLEAN 1627 Protect the consistency (and unicity) of flow label. 1628 You have to disable it to use IPV6_FL_F_REFLECT flag on the 1629 flow label manager. 1630 1631 - TRUE: enabled 1632 - FALSE: disabled 1633 1634 Default: TRUE 1635 1636auto_flowlabels - INTEGER 1637 Automatically generate flow labels based on a flow hash of the 1638 packet. This allows intermediate devices, such as routers, to 1639 identify packet flows for mechanisms like Equal Cost Multipath 1640 Routing (see RFC 6438). 1641 1642 = =========================================================== 1643 0 automatic flow labels are completely disabled 1644 1 automatic flow labels are enabled by default, they can be 1645 disabled on a per socket basis using the IPV6_AUTOFLOWLABEL 1646 socket option 1647 2 automatic flow labels are allowed, they may be enabled on a 1648 per socket basis using the IPV6_AUTOFLOWLABEL socket option 1649 3 automatic flow labels are enabled and enforced, they cannot 1650 be disabled by the socket option 1651 = =========================================================== 1652 1653 Default: 1 1654 1655flowlabel_state_ranges - BOOLEAN 1656 Split the flow label number space into two ranges. 0-0x7FFFF is 1657 reserved for the IPv6 flow manager facility, 0x80000-0xFFFFF 1658 is reserved for stateless flow labels as described in RFC6437. 1659 1660 - TRUE: enabled 1661 - FALSE: disabled 1662 1663 Default: true 1664 1665flowlabel_reflect - INTEGER 1666 Control flow label reflection. Needed for Path MTU 1667 Discovery to work with Equal Cost Multipath Routing in anycast 1668 environments. See RFC 7690 and: 1669 https://tools.ietf.org/html/draft-wang-6man-flow-label-reflection-01 1670 1671 This is a bitmask. 1672 1673 - 1: enabled for established flows 1674 1675 Note that this prevents automatic flowlabel changes, as done 1676 in "tcp: change IPv6 flow-label upon receiving spurious retransmission" 1677 and "tcp: Change txhash on every SYN and RTO retransmit" 1678 1679 - 2: enabled for TCP RESET packets (no active listener) 1680 If set, a RST packet sent in response to a SYN packet on a closed 1681 port will reflect the incoming flow label. 1682 1683 - 4: enabled for ICMPv6 echo reply messages. 1684 1685 Default: 0 1686 1687fib_multipath_hash_policy - INTEGER 1688 Controls which hash policy to use for multipath routes. 1689 1690 Default: 0 (Layer 3) 1691 1692 Possible values: 1693 1694 - 0 - Layer 3 (source and destination addresses plus flow label) 1695 - 1 - Layer 4 (standard 5-tuple) 1696 - 2 - Layer 3 or inner Layer 3 if present 1697 1698anycast_src_echo_reply - BOOLEAN 1699 Controls the use of anycast addresses as source addresses for ICMPv6 1700 echo reply 1701 1702 - TRUE: enabled 1703 - FALSE: disabled 1704 1705 Default: FALSE 1706 1707idgen_delay - INTEGER 1708 Controls the delay in seconds after which time to retry 1709 privacy stable address generation if a DAD conflict is 1710 detected. 1711 1712 Default: 1 (as specified in RFC7217) 1713 1714idgen_retries - INTEGER 1715 Controls the number of retries to generate a stable privacy 1716 address if a DAD conflict is detected. 1717 1718 Default: 3 (as specified in RFC7217) 1719 1720mld_qrv - INTEGER 1721 Controls the MLD query robustness variable (see RFC3810 9.1). 1722 1723 Default: 2 (as specified by RFC3810 9.1) 1724 1725 Minimum: 1 (as specified by RFC6636 4.5) 1726 1727max_dst_opts_number - INTEGER 1728 Maximum number of non-padding TLVs allowed in a Destination 1729 options extension header. If this value is less than zero 1730 then unknown options are disallowed and the number of known 1731 TLVs allowed is the absolute value of this number. 1732 1733 Default: 8 1734 1735max_hbh_opts_number - INTEGER 1736 Maximum number of non-padding TLVs allowed in a Hop-by-Hop 1737 options extension header. If this value is less than zero 1738 then unknown options are disallowed and the number of known 1739 TLVs allowed is the absolute value of this number. 1740 1741 Default: 8 1742 1743max_dst_opts_length - INTEGER 1744 Maximum length allowed for a Destination options extension 1745 header. 1746 1747 Default: INT_MAX (unlimited) 1748 1749max_hbh_length - INTEGER 1750 Maximum length allowed for a Hop-by-Hop options extension 1751 header. 1752 1753 Default: INT_MAX (unlimited) 1754 1755skip_notify_on_dev_down - BOOLEAN 1756 Controls whether an RTM_DELROUTE message is generated for routes 1757 removed when a device is taken down or deleted. IPv4 does not 1758 generate this message; IPv6 does by default. Setting this sysctl 1759 to true skips the message, making IPv4 and IPv6 on par in relying 1760 on userspace caches to track link events and evict routes. 1761 1762 Default: false (generate message) 1763 1764nexthop_compat_mode - BOOLEAN 1765 New nexthop API provides a means for managing nexthops independent of 1766 prefixes. Backwards compatibilty with old route format is enabled by 1767 default which means route dumps and notifications contain the new 1768 nexthop attribute but also the full, expanded nexthop definition. 1769 Further, updates or deletes of a nexthop configuration generate route 1770 notifications for each fib entry using the nexthop. Once a system 1771 understands the new API, this sysctl can be disabled to achieve full 1772 performance benefits of the new API by disabling the nexthop expansion 1773 and extraneous notifications. 1774 Default: true (backward compat mode) 1775 1776IPv6 Fragmentation: 1777 1778ip6frag_high_thresh - INTEGER 1779 Maximum memory used to reassemble IPv6 fragments. When 1780 ip6frag_high_thresh bytes of memory is allocated for this purpose, 1781 the fragment handler will toss packets until ip6frag_low_thresh 1782 is reached. 1783 1784ip6frag_low_thresh - INTEGER 1785 See ip6frag_high_thresh 1786 1787ip6frag_time - INTEGER 1788 Time in seconds to keep an IPv6 fragment in memory. 1789 1790IPv6 Segment Routing: 1791 1792seg6_flowlabel - INTEGER 1793 Controls the behaviour of computing the flowlabel of outer 1794 IPv6 header in case of SR T.encaps 1795 1796 == ======================================================= 1797 -1 set flowlabel to zero. 1798 0 copy flowlabel from Inner packet in case of Inner IPv6 1799 (Set flowlabel to 0 in case IPv4/L2) 1800 1 Compute the flowlabel using seg6_make_flowlabel() 1801 == ======================================================= 1802 1803 Default is 0. 1804 1805``conf/default/*``: 1806 Change the interface-specific default settings. 1807 1808 1809``conf/all/*``: 1810 Change all the interface-specific settings. 1811 1812 [XXX: Other special features than forwarding?] 1813 1814conf/all/forwarding - BOOLEAN 1815 Enable global IPv6 forwarding between all interfaces. 1816 1817 IPv4 and IPv6 work differently here; e.g. netfilter must be used 1818 to control which interfaces may forward packets and which not. 1819 1820 This also sets all interfaces' Host/Router setting 1821 'forwarding' to the specified value. See below for details. 1822 1823 This referred to as global forwarding. 1824 1825proxy_ndp - BOOLEAN 1826 Do proxy ndp. 1827 1828fwmark_reflect - BOOLEAN 1829 Controls the fwmark of kernel-generated IPv6 reply packets that are not 1830 associated with a socket for example, TCP RSTs or ICMPv6 echo replies). 1831 If unset, these packets have a fwmark of zero. If set, they have the 1832 fwmark of the packet they are replying to. 1833 1834 Default: 0 1835 1836``conf/interface/*``: 1837 Change special settings per interface. 1838 1839 The functional behaviour for certain settings is different 1840 depending on whether local forwarding is enabled or not. 1841 1842accept_ra - INTEGER 1843 Accept Router Advertisements; autoconfigure using them. 1844 1845 It also determines whether or not to transmit Router 1846 Solicitations. If and only if the functional setting is to 1847 accept Router Advertisements, Router Solicitations will be 1848 transmitted. 1849 1850 Possible values are: 1851 1852 == =========================================================== 1853 0 Do not accept Router Advertisements. 1854 1 Accept Router Advertisements if forwarding is disabled. 1855 2 Overrule forwarding behaviour. Accept Router Advertisements 1856 even if forwarding is enabled. 1857 == =========================================================== 1858 1859 Functional default: 1860 1861 - enabled if local forwarding is disabled. 1862 - disabled if local forwarding is enabled. 1863 1864accept_ra_defrtr - BOOLEAN 1865 Learn default router in Router Advertisement. 1866 1867 Functional default: 1868 1869 - enabled if accept_ra is enabled. 1870 - disabled if accept_ra is disabled. 1871 1872accept_ra_from_local - BOOLEAN 1873 Accept RA with source-address that is found on local machine 1874 if the RA is otherwise proper and able to be accepted. 1875 1876 Default is to NOT accept these as it may be an un-intended 1877 network loop. 1878 1879 Functional default: 1880 1881 - enabled if accept_ra_from_local is enabled 1882 on a specific interface. 1883 - disabled if accept_ra_from_local is disabled 1884 on a specific interface. 1885 1886accept_ra_min_hop_limit - INTEGER 1887 Minimum hop limit Information in Router Advertisement. 1888 1889 Hop limit Information in Router Advertisement less than this 1890 variable shall be ignored. 1891 1892 Default: 1 1893 1894accept_ra_pinfo - BOOLEAN 1895 Learn Prefix Information in Router Advertisement. 1896 1897 Functional default: 1898 1899 - enabled if accept_ra is enabled. 1900 - disabled if accept_ra is disabled. 1901 1902accept_ra_rt_info_min_plen - INTEGER 1903 Minimum prefix length of Route Information in RA. 1904 1905 Route Information w/ prefix smaller than this variable shall 1906 be ignored. 1907 1908 Functional default: 1909 1910 * 0 if accept_ra_rtr_pref is enabled. 1911 * -1 if accept_ra_rtr_pref is disabled. 1912 1913accept_ra_rt_info_max_plen - INTEGER 1914 Maximum prefix length of Route Information in RA. 1915 1916 Route Information w/ prefix larger than this variable shall 1917 be ignored. 1918 1919 Functional default: 1920 1921 * 0 if accept_ra_rtr_pref is enabled. 1922 * -1 if accept_ra_rtr_pref is disabled. 1923 1924accept_ra_rtr_pref - BOOLEAN 1925 Accept Router Preference in RA. 1926 1927 Functional default: 1928 1929 - enabled if accept_ra is enabled. 1930 - disabled if accept_ra is disabled. 1931 1932accept_ra_mtu - BOOLEAN 1933 Apply the MTU value specified in RA option 5 (RFC4861). If 1934 disabled, the MTU specified in the RA will be ignored. 1935 1936 Functional default: 1937 1938 - enabled if accept_ra is enabled. 1939 - disabled if accept_ra is disabled. 1940 1941accept_redirects - BOOLEAN 1942 Accept Redirects. 1943 1944 Functional default: 1945 1946 - enabled if local forwarding is disabled. 1947 - disabled if local forwarding is enabled. 1948 1949accept_source_route - INTEGER 1950 Accept source routing (routing extension header). 1951 1952 - >= 0: Accept only routing header type 2. 1953 - < 0: Do not accept routing header. 1954 1955 Default: 0 1956 1957autoconf - BOOLEAN 1958 Autoconfigure addresses using Prefix Information in Router 1959 Advertisements. 1960 1961 Functional default: 1962 1963 - enabled if accept_ra_pinfo is enabled. 1964 - disabled if accept_ra_pinfo is disabled. 1965 1966dad_transmits - INTEGER 1967 The amount of Duplicate Address Detection probes to send. 1968 1969 Default: 1 1970 1971forwarding - INTEGER 1972 Configure interface-specific Host/Router behaviour. 1973 1974 .. note:: 1975 1976 It is recommended to have the same setting on all 1977 interfaces; mixed router/host scenarios are rather uncommon. 1978 1979 Possible values are: 1980 1981 - 0 Forwarding disabled 1982 - 1 Forwarding enabled 1983 1984 **FALSE (0)**: 1985 1986 By default, Host behaviour is assumed. This means: 1987 1988 1. IsRouter flag is not set in Neighbour Advertisements. 1989 2. If accept_ra is TRUE (default), transmit Router 1990 Solicitations. 1991 3. If accept_ra is TRUE (default), accept Router 1992 Advertisements (and do autoconfiguration). 1993 4. If accept_redirects is TRUE (default), accept Redirects. 1994 1995 **TRUE (1)**: 1996 1997 If local forwarding is enabled, Router behaviour is assumed. 1998 This means exactly the reverse from the above: 1999 2000 1. IsRouter flag is set in Neighbour Advertisements. 2001 2. Router Solicitations are not sent unless accept_ra is 2. 2002 3. Router Advertisements are ignored unless accept_ra is 2. 2003 4. Redirects are ignored. 2004 2005 Default: 0 (disabled) if global forwarding is disabled (default), 2006 otherwise 1 (enabled). 2007 2008hop_limit - INTEGER 2009 Default Hop Limit to set. 2010 2011 Default: 64 2012 2013mtu - INTEGER 2014 Default Maximum Transfer Unit 2015 2016 Default: 1280 (IPv6 required minimum) 2017 2018ip_nonlocal_bind - BOOLEAN 2019 If set, allows processes to bind() to non-local IPv6 addresses, 2020 which can be quite useful - but may break some applications. 2021 2022 Default: 0 2023 2024router_probe_interval - INTEGER 2025 Minimum interval (in seconds) between Router Probing described 2026 in RFC4191. 2027 2028 Default: 60 2029 2030router_solicitation_delay - INTEGER 2031 Number of seconds to wait after interface is brought up 2032 before sending Router Solicitations. 2033 2034 Default: 1 2035 2036router_solicitation_interval - INTEGER 2037 Number of seconds to wait between Router Solicitations. 2038 2039 Default: 4 2040 2041router_solicitations - INTEGER 2042 Number of Router Solicitations to send until assuming no 2043 routers are present. 2044 2045 Default: 3 2046 2047use_oif_addrs_only - BOOLEAN 2048 When enabled, the candidate source addresses for destinations 2049 routed via this interface are restricted to the set of addresses 2050 configured on this interface (vis. RFC 6724, section 4). 2051 2052 Default: false 2053 2054use_tempaddr - INTEGER 2055 Preference for Privacy Extensions (RFC3041). 2056 2057 * <= 0 : disable Privacy Extensions 2058 * == 1 : enable Privacy Extensions, but prefer public 2059 addresses over temporary addresses. 2060 * > 1 : enable Privacy Extensions and prefer temporary 2061 addresses over public addresses. 2062 2063 Default: 2064 2065 * 0 (for most devices) 2066 * -1 (for point-to-point devices and loopback devices) 2067 2068temp_valid_lft - INTEGER 2069 valid lifetime (in seconds) for temporary addresses. 2070 2071 Default: 172800 (2 days) 2072 2073temp_prefered_lft - INTEGER 2074 Preferred lifetime (in seconds) for temporary addresses. 2075 2076 Default: 86400 (1 day) 2077 2078keep_addr_on_down - INTEGER 2079 Keep all IPv6 addresses on an interface down event. If set static 2080 global addresses with no expiration time are not flushed. 2081 2082 * >0 : enabled 2083 * 0 : system default 2084 * <0 : disabled 2085 2086 Default: 0 (addresses are removed) 2087 2088max_desync_factor - INTEGER 2089 Maximum value for DESYNC_FACTOR, which is a random value 2090 that ensures that clients don't synchronize with each 2091 other and generate new addresses at exactly the same time. 2092 value is in seconds. 2093 2094 Default: 600 2095 2096regen_max_retry - INTEGER 2097 Number of attempts before give up attempting to generate 2098 valid temporary addresses. 2099 2100 Default: 5 2101 2102max_addresses - INTEGER 2103 Maximum number of autoconfigured addresses per interface. Setting 2104 to zero disables the limitation. It is not recommended to set this 2105 value too large (or to zero) because it would be an easy way to 2106 crash the kernel by allowing too many addresses to be created. 2107 2108 Default: 16 2109 2110disable_ipv6 - BOOLEAN 2111 Disable IPv6 operation. If accept_dad is set to 2, this value 2112 will be dynamically set to TRUE if DAD fails for the link-local 2113 address. 2114 2115 Default: FALSE (enable IPv6 operation) 2116 2117 When this value is changed from 1 to 0 (IPv6 is being enabled), 2118 it will dynamically create a link-local address on the given 2119 interface and start Duplicate Address Detection, if necessary. 2120 2121 When this value is changed from 0 to 1 (IPv6 is being disabled), 2122 it will dynamically delete all addresses and routes on the given 2123 interface. From now on it will not possible to add addresses/routes 2124 to the selected interface. 2125 2126accept_dad - INTEGER 2127 Whether to accept DAD (Duplicate Address Detection). 2128 2129 == ============================================================== 2130 0 Disable DAD 2131 1 Enable DAD (default) 2132 2 Enable DAD, and disable IPv6 operation if MAC-based duplicate 2133 link-local address has been found. 2134 == ============================================================== 2135 2136 DAD operation and mode on a given interface will be selected according 2137 to the maximum value of conf/{all,interface}/accept_dad. 2138 2139force_tllao - BOOLEAN 2140 Enable sending the target link-layer address option even when 2141 responding to a unicast neighbor solicitation. 2142 2143 Default: FALSE 2144 2145 Quoting from RFC 2461, section 4.4, Target link-layer address: 2146 2147 "The option MUST be included for multicast solicitations in order to 2148 avoid infinite Neighbor Solicitation "recursion" when the peer node 2149 does not have a cache entry to return a Neighbor Advertisements 2150 message. When responding to unicast solicitations, the option can be 2151 omitted since the sender of the solicitation has the correct link- 2152 layer address; otherwise it would not have be able to send the unicast 2153 solicitation in the first place. However, including the link-layer 2154 address in this case adds little overhead and eliminates a potential 2155 race condition where the sender deletes the cached link-layer address 2156 prior to receiving a response to a previous solicitation." 2157 2158ndisc_notify - BOOLEAN 2159 Define mode for notification of address and device changes. 2160 2161 * 0 - (default): do nothing 2162 * 1 - Generate unsolicited neighbour advertisements when device is brought 2163 up or hardware address changes. 2164 2165ndisc_tclass - INTEGER 2166 The IPv6 Traffic Class to use by default when sending IPv6 Neighbor 2167 Discovery (Router Solicitation, Router Advertisement, Neighbor 2168 Solicitation, Neighbor Advertisement, Redirect) messages. 2169 These 8 bits can be interpreted as 6 high order bits holding the DSCP 2170 value and 2 low order bits representing ECN (which you probably want 2171 to leave cleared). 2172 2173 * 0 - (default) 2174 2175mldv1_unsolicited_report_interval - INTEGER 2176 The interval in milliseconds in which the next unsolicited 2177 MLDv1 report retransmit will take place. 2178 2179 Default: 10000 (10 seconds) 2180 2181mldv2_unsolicited_report_interval - INTEGER 2182 The interval in milliseconds in which the next unsolicited 2183 MLDv2 report retransmit will take place. 2184 2185 Default: 1000 (1 second) 2186 2187force_mld_version - INTEGER 2188 * 0 - (default) No enforcement of a MLD version, MLDv1 fallback allowed 2189 * 1 - Enforce to use MLD version 1 2190 * 2 - Enforce to use MLD version 2 2191 2192suppress_frag_ndisc - INTEGER 2193 Control RFC 6980 (Security Implications of IPv6 Fragmentation 2194 with IPv6 Neighbor Discovery) behavior: 2195 2196 * 1 - (default) discard fragmented neighbor discovery packets 2197 * 0 - allow fragmented neighbor discovery packets 2198 2199optimistic_dad - BOOLEAN 2200 Whether to perform Optimistic Duplicate Address Detection (RFC 4429). 2201 2202 * 0: disabled (default) 2203 * 1: enabled 2204 2205 Optimistic Duplicate Address Detection for the interface will be enabled 2206 if at least one of conf/{all,interface}/optimistic_dad is set to 1, 2207 it will be disabled otherwise. 2208 2209use_optimistic - BOOLEAN 2210 If enabled, do not classify optimistic addresses as deprecated during 2211 source address selection. Preferred addresses will still be chosen 2212 before optimistic addresses, subject to other ranking in the source 2213 address selection algorithm. 2214 2215 * 0: disabled (default) 2216 * 1: enabled 2217 2218 This will be enabled if at least one of 2219 conf/{all,interface}/use_optimistic is set to 1, disabled otherwise. 2220 2221stable_secret - IPv6 address 2222 This IPv6 address will be used as a secret to generate IPv6 2223 addresses for link-local addresses and autoconfigured 2224 ones. All addresses generated after setting this secret will 2225 be stable privacy ones by default. This can be changed via the 2226 addrgenmode ip-link. conf/default/stable_secret is used as the 2227 secret for the namespace, the interface specific ones can 2228 overwrite that. Writes to conf/all/stable_secret are refused. 2229 2230 It is recommended to generate this secret during installation 2231 of a system and keep it stable after that. 2232 2233 By default the stable secret is unset. 2234 2235addr_gen_mode - INTEGER 2236 Defines how link-local and autoconf addresses are generated. 2237 2238 = ================================================================= 2239 0 generate address based on EUI64 (default) 2240 1 do no generate a link-local address, use EUI64 for addresses 2241 generated from autoconf 2242 2 generate stable privacy addresses, using the secret from 2243 stable_secret (RFC7217) 2244 3 generate stable privacy addresses, using a random secret if unset 2245 = ================================================================= 2246 2247drop_unicast_in_l2_multicast - BOOLEAN 2248 Drop any unicast IPv6 packets that are received in link-layer 2249 multicast (or broadcast) frames. 2250 2251 By default this is turned off. 2252 2253drop_unsolicited_na - BOOLEAN 2254 Drop all unsolicited neighbor advertisements, for example if there's 2255 a known good NA proxy on the network and such frames need not be used 2256 (or in the case of 802.11, must not be used to prevent attacks.) 2257 2258 By default this is turned off. 2259 2260enhanced_dad - BOOLEAN 2261 Include a nonce option in the IPv6 neighbor solicitation messages used for 2262 duplicate address detection per RFC7527. A received DAD NS will only signal 2263 a duplicate address if the nonce is different. This avoids any false 2264 detection of duplicates due to loopback of the NS messages that we send. 2265 The nonce option will be sent on an interface unless both of 2266 conf/{all,interface}/enhanced_dad are set to FALSE. 2267 2268 Default: TRUE 2269 2270``icmp/*``: 2271=========== 2272 2273ratelimit - INTEGER 2274 Limit the maximal rates for sending ICMPv6 messages. 2275 2276 0 to disable any limiting, 2277 otherwise the minimal space between responses in milliseconds. 2278 2279 Default: 1000 2280 2281ratemask - list of comma separated ranges 2282 For ICMPv6 message types matching the ranges in the ratemask, limit 2283 the sending of the message according to ratelimit parameter. 2284 2285 The format used for both input and output is a comma separated 2286 list of ranges (e.g. "0-127,129" for ICMPv6 message type 0 to 127 and 2287 129). Writing to the file will clear all previous ranges of ICMPv6 2288 message types and update the current list with the input. 2289 2290 Refer to: https://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xhtml 2291 for numerical values of ICMPv6 message types, e.g. echo request is 128 2292 and echo reply is 129. 2293 2294 Default: 0-1,3-127 (rate limit ICMPv6 errors except Packet Too Big) 2295 2296echo_ignore_all - BOOLEAN 2297 If set non-zero, then the kernel will ignore all ICMP ECHO 2298 requests sent to it over the IPv6 protocol. 2299 2300 Default: 0 2301 2302echo_ignore_multicast - BOOLEAN 2303 If set non-zero, then the kernel will ignore all ICMP ECHO 2304 requests sent to it over the IPv6 protocol via multicast. 2305 2306 Default: 0 2307 2308echo_ignore_anycast - BOOLEAN 2309 If set non-zero, then the kernel will ignore all ICMP ECHO 2310 requests sent to it over the IPv6 protocol destined to anycast address. 2311 2312 Default: 0 2313 2314xfrm6_gc_thresh - INTEGER 2315 (Obsolete since linux-4.14) 2316 The threshold at which we will start garbage collecting for IPv6 2317 destination cache entries. At twice this value the system will 2318 refuse new allocations. 2319 2320 2321IPv6 Update by: 2322Pekka Savola <pekkas@netcore.fi> 2323YOSHIFUJI Hideaki / USAGI Project <yoshfuji@linux-ipv6.org> 2324 2325 2326/proc/sys/net/bridge/* Variables: 2327================================= 2328 2329bridge-nf-call-arptables - BOOLEAN 2330 - 1 : pass bridged ARP traffic to arptables' FORWARD chain. 2331 - 0 : disable this. 2332 2333 Default: 1 2334 2335bridge-nf-call-iptables - BOOLEAN 2336 - 1 : pass bridged IPv4 traffic to iptables' chains. 2337 - 0 : disable this. 2338 2339 Default: 1 2340 2341bridge-nf-call-ip6tables - BOOLEAN 2342 - 1 : pass bridged IPv6 traffic to ip6tables' chains. 2343 - 0 : disable this. 2344 2345 Default: 1 2346 2347bridge-nf-filter-vlan-tagged - BOOLEAN 2348 - 1 : pass bridged vlan-tagged ARP/IP/IPv6 traffic to {arp,ip,ip6}tables. 2349 - 0 : disable this. 2350 2351 Default: 0 2352 2353bridge-nf-filter-pppoe-tagged - BOOLEAN 2354 - 1 : pass bridged pppoe-tagged IP/IPv6 traffic to {ip,ip6}tables. 2355 - 0 : disable this. 2356 2357 Default: 0 2358 2359bridge-nf-pass-vlan-input-dev - BOOLEAN 2360 - 1: if bridge-nf-filter-vlan-tagged is enabled, try to find a vlan 2361 interface on the bridge and set the netfilter input device to the 2362 vlan. This allows use of e.g. "iptables -i br0.1" and makes the 2363 REDIRECT target work with vlan-on-top-of-bridge interfaces. When no 2364 matching vlan interface is found, or this switch is off, the input 2365 device is set to the bridge interface. 2366 2367 - 0: disable bridge netfilter vlan interface lookup. 2368 2369 Default: 0 2370 2371``proc/sys/net/sctp/*`` Variables: 2372================================== 2373 2374addip_enable - BOOLEAN 2375 Enable or disable extension of Dynamic Address Reconfiguration 2376 (ADD-IP) functionality specified in RFC5061. This extension provides 2377 the ability to dynamically add and remove new addresses for the SCTP 2378 associations. 2379 2380 1: Enable extension. 2381 2382 0: Disable extension. 2383 2384 Default: 0 2385 2386pf_enable - INTEGER 2387 Enable or disable pf (pf is short for potentially failed) state. A value 2388 of pf_retrans > path_max_retrans also disables pf state. That is, one of 2389 both pf_enable and pf_retrans > path_max_retrans can disable pf state. 2390 Since pf_retrans and path_max_retrans can be changed by userspace 2391 application, sometimes user expects to disable pf state by the value of 2392 pf_retrans > path_max_retrans, but occasionally the value of pf_retrans 2393 or path_max_retrans is changed by the user application, this pf state is 2394 enabled. As such, it is necessary to add this to dynamically enable 2395 and disable pf state. See: 2396 https://datatracker.ietf.org/doc/draft-ietf-tsvwg-sctp-failover for 2397 details. 2398 2399 1: Enable pf. 2400 2401 0: Disable pf. 2402 2403 Default: 1 2404 2405pf_expose - INTEGER 2406 Unset or enable/disable pf (pf is short for potentially failed) state 2407 exposure. Applications can control the exposure of the PF path state 2408 in the SCTP_PEER_ADDR_CHANGE event and the SCTP_GET_PEER_ADDR_INFO 2409 sockopt. When it's unset, no SCTP_PEER_ADDR_CHANGE event with 2410 SCTP_ADDR_PF state will be sent and a SCTP_PF-state transport info 2411 can be got via SCTP_GET_PEER_ADDR_INFO sockopt; When it's enabled, 2412 a SCTP_PEER_ADDR_CHANGE event will be sent for a transport becoming 2413 SCTP_PF state and a SCTP_PF-state transport info can be got via 2414 SCTP_GET_PEER_ADDR_INFO sockopt; When it's diabled, no 2415 SCTP_PEER_ADDR_CHANGE event will be sent and it returns -EACCES when 2416 trying to get a SCTP_PF-state transport info via SCTP_GET_PEER_ADDR_INFO 2417 sockopt. 2418 2419 0: Unset pf state exposure, Compatible with old applications. 2420 2421 1: Disable pf state exposure. 2422 2423 2: Enable pf state exposure. 2424 2425 Default: 0 2426 2427addip_noauth_enable - BOOLEAN 2428 Dynamic Address Reconfiguration (ADD-IP) requires the use of 2429 authentication to protect the operations of adding or removing new 2430 addresses. This requirement is mandated so that unauthorized hosts 2431 would not be able to hijack associations. However, older 2432 implementations may not have implemented this requirement while 2433 allowing the ADD-IP extension. For reasons of interoperability, 2434 we provide this variable to control the enforcement of the 2435 authentication requirement. 2436 2437 == =============================================================== 2438 1 Allow ADD-IP extension to be used without authentication. This 2439 should only be set in a closed environment for interoperability 2440 with older implementations. 2441 2442 0 Enforce the authentication requirement 2443 == =============================================================== 2444 2445 Default: 0 2446 2447auth_enable - BOOLEAN 2448 Enable or disable Authenticated Chunks extension. This extension 2449 provides the ability to send and receive authenticated chunks and is 2450 required for secure operation of Dynamic Address Reconfiguration 2451 (ADD-IP) extension. 2452 2453 - 1: Enable this extension. 2454 - 0: Disable this extension. 2455 2456 Default: 0 2457 2458prsctp_enable - BOOLEAN 2459 Enable or disable the Partial Reliability extension (RFC3758) which 2460 is used to notify peers that a given DATA should no longer be expected. 2461 2462 - 1: Enable extension 2463 - 0: Disable 2464 2465 Default: 1 2466 2467max_burst - INTEGER 2468 The limit of the number of new packets that can be initially sent. It 2469 controls how bursty the generated traffic can be. 2470 2471 Default: 4 2472 2473association_max_retrans - INTEGER 2474 Set the maximum number for retransmissions that an association can 2475 attempt deciding that the remote end is unreachable. If this value 2476 is exceeded, the association is terminated. 2477 2478 Default: 10 2479 2480max_init_retransmits - INTEGER 2481 The maximum number of retransmissions of INIT and COOKIE-ECHO chunks 2482 that an association will attempt before declaring the destination 2483 unreachable and terminating. 2484 2485 Default: 8 2486 2487path_max_retrans - INTEGER 2488 The maximum number of retransmissions that will be attempted on a given 2489 path. Once this threshold is exceeded, the path is considered 2490 unreachable, and new traffic will use a different path when the 2491 association is multihomed. 2492 2493 Default: 5 2494 2495pf_retrans - INTEGER 2496 The number of retransmissions that will be attempted on a given path 2497 before traffic is redirected to an alternate transport (should one 2498 exist). Note this is distinct from path_max_retrans, as a path that 2499 passes the pf_retrans threshold can still be used. Its only 2500 deprioritized when a transmission path is selected by the stack. This 2501 setting is primarily used to enable fast failover mechanisms without 2502 having to reduce path_max_retrans to a very low value. See: 2503 http://www.ietf.org/id/draft-nishida-tsvwg-sctp-failover-05.txt 2504 for details. Note also that a value of pf_retrans > path_max_retrans 2505 disables this feature. Since both pf_retrans and path_max_retrans can 2506 be changed by userspace application, a variable pf_enable is used to 2507 disable pf state. 2508 2509 Default: 0 2510 2511ps_retrans - INTEGER 2512 Primary.Switchover.Max.Retrans (PSMR), it's a tunable parameter coming 2513 from section-5 "Primary Path Switchover" in rfc7829. The primary path 2514 will be changed to another active path when the path error counter on 2515 the old primary path exceeds PSMR, so that "the SCTP sender is allowed 2516 to continue data transmission on a new working path even when the old 2517 primary destination address becomes active again". Note this feature 2518 is disabled by initializing 'ps_retrans' per netns as 0xffff by default, 2519 and its value can't be less than 'pf_retrans' when changing by sysctl. 2520 2521 Default: 0xffff 2522 2523rto_initial - INTEGER 2524 The initial round trip timeout value in milliseconds that will be used 2525 in calculating round trip times. This is the initial time interval 2526 for retransmissions. 2527 2528 Default: 3000 2529 2530rto_max - INTEGER 2531 The maximum value (in milliseconds) of the round trip timeout. This 2532 is the largest time interval that can elapse between retransmissions. 2533 2534 Default: 60000 2535 2536rto_min - INTEGER 2537 The minimum value (in milliseconds) of the round trip timeout. This 2538 is the smallest time interval the can elapse between retransmissions. 2539 2540 Default: 1000 2541 2542hb_interval - INTEGER 2543 The interval (in milliseconds) between HEARTBEAT chunks. These chunks 2544 are sent at the specified interval on idle paths to probe the state of 2545 a given path between 2 associations. 2546 2547 Default: 30000 2548 2549sack_timeout - INTEGER 2550 The amount of time (in milliseconds) that the implementation will wait 2551 to send a SACK. 2552 2553 Default: 200 2554 2555valid_cookie_life - INTEGER 2556 The default lifetime of the SCTP cookie (in milliseconds). The cookie 2557 is used during association establishment. 2558 2559 Default: 60000 2560 2561cookie_preserve_enable - BOOLEAN 2562 Enable or disable the ability to extend the lifetime of the SCTP cookie 2563 that is used during the establishment phase of SCTP association 2564 2565 - 1: Enable cookie lifetime extension. 2566 - 0: Disable 2567 2568 Default: 1 2569 2570cookie_hmac_alg - STRING 2571 Select the hmac algorithm used when generating the cookie value sent by 2572 a listening sctp socket to a connecting client in the INIT-ACK chunk. 2573 Valid values are: 2574 2575 * md5 2576 * sha1 2577 * none 2578 2579 Ability to assign md5 or sha1 as the selected alg is predicated on the 2580 configuration of those algorithms at build time (CONFIG_CRYPTO_MD5 and 2581 CONFIG_CRYPTO_SHA1). 2582 2583 Default: Dependent on configuration. MD5 if available, else SHA1 if 2584 available, else none. 2585 2586rcvbuf_policy - INTEGER 2587 Determines if the receive buffer is attributed to the socket or to 2588 association. SCTP supports the capability to create multiple 2589 associations on a single socket. When using this capability, it is 2590 possible that a single stalled association that's buffering a lot 2591 of data may block other associations from delivering their data by 2592 consuming all of the receive buffer space. To work around this, 2593 the rcvbuf_policy could be set to attribute the receiver buffer space 2594 to each association instead of the socket. This prevents the described 2595 blocking. 2596 2597 - 1: rcvbuf space is per association 2598 - 0: rcvbuf space is per socket 2599 2600 Default: 0 2601 2602sndbuf_policy - INTEGER 2603 Similar to rcvbuf_policy above, this applies to send buffer space. 2604 2605 - 1: Send buffer is tracked per association 2606 - 0: Send buffer is tracked per socket. 2607 2608 Default: 0 2609 2610sctp_mem - vector of 3 INTEGERs: min, pressure, max 2611 Number of pages allowed for queueing by all SCTP sockets. 2612 2613 min: Below this number of pages SCTP is not bothered about its 2614 memory appetite. When amount of memory allocated by SCTP exceeds 2615 this number, SCTP starts to moderate memory usage. 2616 2617 pressure: This value was introduced to follow format of tcp_mem. 2618 2619 max: Number of pages allowed for queueing by all SCTP sockets. 2620 2621 Default is calculated at boot time from amount of available memory. 2622 2623sctp_rmem - vector of 3 INTEGERs: min, default, max 2624 Only the first value ("min") is used, "default" and "max" are 2625 ignored. 2626 2627 min: Minimal size of receive buffer used by SCTP socket. 2628 It is guaranteed to each SCTP socket (but not association) even 2629 under moderate memory pressure. 2630 2631 Default: 4K 2632 2633sctp_wmem - vector of 3 INTEGERs: min, default, max 2634 Only the first value ("min") is used, "default" and "max" are 2635 ignored. 2636 2637 min: Minimum size of send buffer that can be used by SCTP sockets. 2638 It is guaranteed to each SCTP socket (but not association) even 2639 under moderate memory pressure. 2640 2641 Default: 4K 2642 2643addr_scope_policy - INTEGER 2644 Control IPv4 address scoping - draft-stewart-tsvwg-sctp-ipv4-00 2645 2646 - 0 - Disable IPv4 address scoping 2647 - 1 - Enable IPv4 address scoping 2648 - 2 - Follow draft but allow IPv4 private addresses 2649 - 3 - Follow draft but allow IPv4 link local addresses 2650 2651 Default: 1 2652 2653 2654``/proc/sys/net/core/*`` 2655======================== 2656 2657 Please see: Documentation/admin-guide/sysctl/net.rst for descriptions of these entries. 2658 2659 2660``/proc/sys/net/unix/*`` 2661======================== 2662 2663max_dgram_qlen - INTEGER 2664 The maximum length of dgram socket receive queue 2665 2666 Default: 10 2667 2668