]>
Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | /proc/sys/net/ipv4/* Variables: |
2 | ||
3 | ip_forward - BOOLEAN | |
4 | 0 - disabled (default) | |
5 | not 0 - enabled | |
6 | ||
7 | Forward Packets between interfaces. | |
8 | ||
9 | This variable is special, its change resets all configuration | |
10 | parameters to their default state (RFC1122 for hosts, RFC1812 | |
11 | for routers) | |
12 | ||
13 | ip_default_ttl - INTEGER | |
14 | default 64 | |
15 | ||
16 | ip_no_pmtu_disc - BOOLEAN | |
17 | Disable Path MTU Discovery. | |
18 | default FALSE | |
19 | ||
20 | min_pmtu - INTEGER | |
21 | default 562 - minimum discovered Path MTU | |
22 | ||
23 | mtu_expires - INTEGER | |
24 | Time, in seconds, that cached PMTU information is kept. | |
25 | ||
26 | min_adv_mss - INTEGER | |
27 | The advertised MSS depends on the first hop route MTU, but will | |
28 | never be lower than this setting. | |
29 | ||
30 | IP Fragmentation: | |
31 | ||
32 | ipfrag_high_thresh - INTEGER | |
33 | Maximum memory used to reassemble IP fragments. When | |
34 | ipfrag_high_thresh bytes of memory is allocated for this purpose, | |
35 | the fragment handler will toss packets until ipfrag_low_thresh | |
36 | is reached. | |
37 | ||
38 | ipfrag_low_thresh - INTEGER | |
39 | See ipfrag_high_thresh | |
40 | ||
41 | ipfrag_time - INTEGER | |
42 | Time in seconds to keep an IP fragment in memory. | |
43 | ||
44 | ipfrag_secret_interval - INTEGER | |
45 | Regeneration interval (in seconds) of the hash secret (or lifetime | |
46 | for the hash secret) for IP fragments. | |
47 | Default: 600 | |
48 | ||
89cee8b1 HX |
49 | ipfrag_max_dist - INTEGER |
50 | ipfrag_max_dist is a non-negative integer value which defines the | |
51 | maximum "disorder" which is allowed among fragments which share a | |
52 | common IP source address. Note that reordering of packets is | |
53 | not unusual, but if a large number of fragments arrive from a source | |
54 | IP address while a particular fragment queue remains incomplete, it | |
55 | probably indicates that one or more fragments belonging to that queue | |
56 | have been lost. When ipfrag_max_dist is positive, an additional check | |
57 | is done on fragments before they are added to a reassembly queue - if | |
58 | ipfrag_max_dist (or more) fragments have arrived from a particular IP | |
59 | address between additions to any IP fragment queue using that source | |
60 | address, it's presumed that one or more fragments in the queue are | |
61 | lost. The existing fragment queue will be dropped, and a new one | |
62 | started. An ipfrag_max_dist value of zero disables this check. | |
63 | ||
64 | Using a very small value, e.g. 1 or 2, for ipfrag_max_dist can | |
65 | result in unnecessarily dropping fragment queues when normal | |
66 | reordering of packets occurs, which could lead to poor application | |
67 | performance. Using a very large value, e.g. 50000, increases the | |
68 | likelihood of incorrectly reassembling IP fragments that originate | |
69 | from different IP datagrams, which could result in data corruption. | |
70 | Default: 64 | |
71 | ||
1da177e4 LT |
72 | INET peer storage: |
73 | ||
74 | inet_peer_threshold - INTEGER | |
75 | The approximate size of the storage. Starting from this threshold | |
76 | entries will be thrown aggressively. This threshold also determines | |
77 | entries' time-to-live and time intervals between garbage collection | |
78 | passes. More entries, less time-to-live, less GC interval. | |
79 | ||
80 | inet_peer_minttl - INTEGER | |
81 | Minimum time-to-live of entries. Should be enough to cover fragment | |
82 | time-to-live on the reassembling side. This minimum time-to-live is | |
83 | guaranteed if the pool size is less than inet_peer_threshold. | |
84 | Measured in jiffies(1). | |
85 | ||
86 | inet_peer_maxttl - INTEGER | |
87 | Maximum time-to-live of entries. Unused entries will expire after | |
88 | this period of time if there is no memory pressure on the pool (i.e. | |
89 | when the number of entries in the pool is very small). | |
90 | Measured in jiffies(1). | |
91 | ||
92 | inet_peer_gc_mintime - INTEGER | |
93 | Minimum interval between garbage collection passes. This interval is | |
94 | in effect under high memory pressure on the pool. | |
95 | Measured in jiffies(1). | |
96 | ||
97 | inet_peer_gc_maxtime - INTEGER | |
98 | Minimum interval between garbage collection passes. This interval is | |
99 | in effect under low (or absent) memory pressure on the pool. | |
100 | Measured in jiffies(1). | |
101 | ||
102 | TCP variables: | |
103 | ||
9772efb9 SH |
104 | tcp_abc - INTEGER |
105 | Controls Appropriate Byte Count defined in RFC3465. If set to | |
106 | 0 then does congestion avoid once per ack. 1 is conservative | |
107 | value, and 2 is more agressive. | |
108 | ||
1da177e4 LT |
109 | tcp_syn_retries - INTEGER |
110 | Number of times initial SYNs for an active TCP connection attempt | |
111 | will be retransmitted. Should not be higher than 255. Default value | |
112 | is 5, which corresponds to ~180seconds. | |
113 | ||
114 | tcp_synack_retries - INTEGER | |
115 | Number of times SYNACKs for a passive TCP connection attempt will | |
116 | be retransmitted. Should not be higher than 255. Default value | |
117 | is 5, which corresponds to ~180seconds. | |
118 | ||
119 | tcp_keepalive_time - INTEGER | |
120 | How often TCP sends out keepalive messages when keepalive is enabled. | |
121 | Default: 2hours. | |
122 | ||
123 | tcp_keepalive_probes - INTEGER | |
124 | How many keepalive probes TCP sends out, until it decides that the | |
125 | connection is broken. Default value: 9. | |
126 | ||
127 | tcp_keepalive_intvl - INTEGER | |
128 | How frequently the probes are send out. Multiplied by | |
129 | tcp_keepalive_probes it is time to kill not responding connection, | |
130 | after probes started. Default value: 75sec i.e. connection | |
131 | will be aborted after ~11 minutes of retries. | |
132 | ||
133 | tcp_retries1 - INTEGER | |
134 | How many times to retry before deciding that something is wrong | |
135 | and it is necessary to report this suspicion to network layer. | |
136 | Minimal RFC value is 3, it is default, which corresponds | |
137 | to ~3sec-8min depending on RTO. | |
138 | ||
139 | tcp_retries2 - INTEGER | |
140 | How may times to retry before killing alive TCP connection. | |
141 | RFC1122 says that the limit should be longer than 100 sec. | |
142 | It is too small number. Default value 15 corresponds to ~13-30min | |
143 | depending on RTO. | |
144 | ||
145 | tcp_orphan_retries - INTEGER | |
146 | How may times to retry before killing TCP connection, closed | |
147 | by our side. Default value 7 corresponds to ~50sec-16min | |
148 | depending on RTO. If you machine is loaded WEB server, | |
149 | you should think about lowering this value, such sockets | |
150 | may consume significant resources. Cf. tcp_max_orphans. | |
151 | ||
152 | tcp_fin_timeout - INTEGER | |
153 | Time to hold socket in state FIN-WAIT-2, if it was closed | |
154 | by our side. Peer can be broken and never close its side, | |
155 | or even died unexpectedly. Default value is 60sec. | |
156 | Usual value used in 2.2 was 180 seconds, you may restore | |
157 | it, but remember that if your machine is even underloaded WEB server, | |
158 | you risk to overflow memory with kilotons of dead sockets, | |
159 | FIN-WAIT-2 sockets are less dangerous than FIN-WAIT-1, | |
160 | because they eat maximum 1.5K of memory, but they tend | |
161 | to live longer. Cf. tcp_max_orphans. | |
162 | ||
163 | tcp_max_tw_buckets - INTEGER | |
164 | Maximal number of timewait sockets held by system simultaneously. | |
165 | If this number is exceeded time-wait socket is immediately destroyed | |
166 | and warning is printed. This limit exists only to prevent | |
167 | simple DoS attacks, you _must_ not lower the limit artificially, | |
168 | but rather increase it (probably, after increasing installed memory), | |
169 | if network conditions require more than default value. | |
170 | ||
171 | tcp_tw_recycle - BOOLEAN | |
172 | Enable fast recycling TIME-WAIT sockets. Default value is 0. | |
173 | It should not be changed without advice/request of technical | |
174 | experts. | |
175 | ||
176 | tcp_tw_reuse - BOOLEAN | |
177 | Allow to reuse TIME-WAIT sockets for new connections when it is | |
178 | safe from protocol viewpoint. Default value is 0. | |
179 | It should not be changed without advice/request of technical | |
180 | experts. | |
181 | ||
182 | tcp_max_orphans - INTEGER | |
183 | Maximal number of TCP sockets not attached to any user file handle, | |
184 | held by system. If this number is exceeded orphaned connections are | |
185 | reset immediately and warning is printed. This limit exists | |
186 | only to prevent simple DoS attacks, you _must_ not rely on this | |
187 | or lower the limit artificially, but rather increase it | |
188 | (probably, after increasing installed memory), | |
189 | if network conditions require more than default value, | |
190 | and tune network services to linger and kill such states | |
191 | more aggressively. Let me to remind again: each orphan eats | |
192 | up to ~64K of unswappable memory. | |
193 | ||
194 | tcp_abort_on_overflow - BOOLEAN | |
195 | If listening service is too slow to accept new connections, | |
196 | reset them. Default state is FALSE. It means that if overflow | |
197 | occurred due to a burst, connection will recover. Enable this | |
198 | option _only_ if you are really sure that listening daemon | |
199 | cannot be tuned to accept connections faster. Enabling this | |
200 | option can harm clients of your server. | |
201 | ||
202 | tcp_syncookies - BOOLEAN | |
203 | Only valid when the kernel was compiled with CONFIG_SYNCOOKIES | |
204 | Send out syncookies when the syn backlog queue of a socket | |
205 | overflows. This is to prevent against the common 'syn flood attack' | |
206 | Default: FALSE | |
207 | ||
208 | Note, that syncookies is fallback facility. | |
209 | It MUST NOT be used to help highly loaded servers to stand | |
210 | against legal connection rate. If you see synflood warnings | |
211 | in your logs, but investigation shows that they occur | |
212 | because of overload with legal connections, you should tune | |
213 | another parameters until this warning disappear. | |
214 | See: tcp_max_syn_backlog, tcp_synack_retries, tcp_abort_on_overflow. | |
215 | ||
216 | syncookies seriously violate TCP protocol, do not allow | |
217 | to use TCP extensions, can result in serious degradation | |
218 | of some services (f.e. SMTP relaying), visible not by you, | |
219 | but your clients and relays, contacting you. While you see | |
220 | synflood warnings in logs not being really flooded, your server | |
221 | is seriously misconfigured. | |
222 | ||
223 | tcp_stdurg - BOOLEAN | |
224 | Use the Host requirements interpretation of the TCP urg pointer field. | |
225 | Most hosts use the older BSD interpretation, so if you turn this on | |
226 | Linux might not communicate correctly with them. | |
227 | Default: FALSE | |
228 | ||
229 | tcp_max_syn_backlog - INTEGER | |
230 | Maximal number of remembered connection requests, which are | |
231 | still did not receive an acknowledgment from connecting client. | |
232 | Default value is 1024 for systems with more than 128Mb of memory, | |
233 | and 128 for low memory machines. If server suffers of overload, | |
234 | try to increase this number. | |
235 | ||
236 | tcp_window_scaling - BOOLEAN | |
237 | Enable window scaling as defined in RFC1323. | |
238 | ||
239 | tcp_timestamps - BOOLEAN | |
240 | Enable timestamps as defined in RFC1323. | |
241 | ||
242 | tcp_sack - BOOLEAN | |
243 | Enable select acknowledgments (SACKS). | |
244 | ||
245 | tcp_fack - BOOLEAN | |
246 | Enable FACK congestion avoidance and fast retransmission. | |
247 | The value is not used, if tcp_sack is not enabled. | |
248 | ||
249 | tcp_dsack - BOOLEAN | |
250 | Allows TCP to send "duplicate" SACKs. | |
251 | ||
252 | tcp_ecn - BOOLEAN | |
253 | Enable Explicit Congestion Notification in TCP. | |
254 | ||
255 | tcp_reordering - INTEGER | |
256 | Maximal reordering of packets in a TCP stream. | |
257 | Default: 3 | |
258 | ||
259 | tcp_retrans_collapse - BOOLEAN | |
260 | Bug-to-bug compatibility with some broken printers. | |
261 | On retransmit try to send bigger packets to work around bugs in | |
262 | certain TCP stacks. | |
263 | ||
264 | tcp_wmem - vector of 3 INTEGERs: min, default, max | |
265 | min: Amount of memory reserved for send buffers for TCP socket. | |
266 | Each TCP socket has rights to use it due to fact of its birth. | |
267 | Default: 4K | |
268 | ||
269 | default: Amount of memory allowed for send buffers for TCP socket | |
270 | by default. This value overrides net.core.wmem_default used | |
271 | by other protocols, it is usually lower than net.core.wmem_default. | |
272 | Default: 16K | |
273 | ||
274 | max: Maximal amount of memory allowed for automatically selected | |
275 | send buffers for TCP socket. This value does not override | |
276 | net.core.wmem_max, "static" selection via SO_SNDBUF does not use this. | |
277 | Default: 128K | |
278 | ||
279 | tcp_rmem - vector of 3 INTEGERs: min, default, max | |
280 | min: Minimal size of receive buffer used by TCP sockets. | |
281 | It is guaranteed to each TCP socket, even under moderate memory | |
282 | pressure. | |
283 | Default: 8K | |
284 | ||
285 | default: default size of receive buffer used by TCP sockets. | |
286 | This value overrides net.core.rmem_default used by other protocols. | |
287 | Default: 87380 bytes. This value results in window of 65535 with | |
288 | default setting of tcp_adv_win_scale and tcp_app_win:0 and a bit | |
289 | less for default tcp_app_win. See below about these variables. | |
290 | ||
291 | max: maximal size of receive buffer allowed for automatically | |
292 | selected receiver buffers for TCP socket. This value does not override | |
293 | net.core.rmem_max, "static" selection via SO_RCVBUF does not use this. | |
294 | Default: 87380*2 bytes. | |
295 | ||
296 | tcp_mem - vector of 3 INTEGERs: min, pressure, max | |
297 | low: below this number of pages TCP is not bothered about its | |
298 | memory appetite. | |
299 | ||
300 | pressure: when amount of memory allocated by TCP exceeds this number | |
301 | of pages, TCP moderates its memory consumption and enters memory | |
302 | pressure mode, which is exited when memory consumption falls | |
303 | under "low". | |
304 | ||
305 | high: number of pages allowed for queueing by all TCP sockets. | |
306 | ||
307 | Defaults are calculated at boot time from amount of available | |
308 | memory. | |
309 | ||
310 | tcp_app_win - INTEGER | |
311 | Reserve max(window/2^tcp_app_win, mss) of window for application | |
312 | buffer. Value 0 is special, it means that nothing is reserved. | |
313 | Default: 31 | |
314 | ||
315 | tcp_adv_win_scale - INTEGER | |
316 | Count buffering overhead as bytes/2^tcp_adv_win_scale | |
317 | (if tcp_adv_win_scale > 0) or bytes-bytes/2^(-tcp_adv_win_scale), | |
318 | if it is <= 0. | |
319 | Default: 2 | |
320 | ||
321 | tcp_rfc1337 - BOOLEAN | |
322 | If set, the TCP stack behaves conforming to RFC1337. If unset, | |
323 | we are not conforming to RFC, but prevent TCP TIME_WAIT | |
324 | assassination. | |
325 | Default: 0 | |
326 | ||
327 | tcp_low_latency - BOOLEAN | |
328 | If set, the TCP stack makes decisions that prefer lower | |
329 | latency as opposed to higher throughput. By default, this | |
330 | option is not set meaning that higher throughput is preferred. | |
331 | An example of an application where this default should be | |
332 | changed would be a Beowulf compute cluster. | |
333 | Default: 0 | |
334 | ||
1da177e4 LT |
335 | tcp_tso_win_divisor - INTEGER |
336 | This allows control over what percentage of the congestion window | |
337 | can be consumed by a single TSO frame. | |
338 | The setting of this parameter is a choice between burstiness and | |
339 | building larger TSO frames. | |
e83b8605 | 340 | Default: 3 |
1da177e4 LT |
341 | |
342 | tcp_frto - BOOLEAN | |
343 | Enables F-RTO, an enhanced recovery algorithm for TCP retransmission | |
344 | timeouts. It is particularly beneficial in wireless environments | |
345 | where packet loss is typically due to random radio interference | |
346 | rather than intermediate router congestion. | |
347 | ||
9d7bcfc6 SH |
348 | tcp_congestion_control - STRING |
349 | Set the congestion control algorithm to be used for new | |
350 | connections. The algorithm "reno" is always available, but | |
351 | additional choices may be available based on kernel configuration. | |
352 | ||
1da177e4 LT |
353 | somaxconn - INTEGER |
354 | Limit of socket listen() backlog, known in userspace as SOMAXCONN. | |
355 | Defaults to 128. See also tcp_max_syn_backlog for additional tuning | |
356 | for TCP sockets. | |
357 | ||
358 | IP Variables: | |
359 | ||
360 | ip_local_port_range - 2 INTEGERS | |
361 | Defines the local port range that is used by TCP and UDP to | |
362 | choose the local port. The first number is the first, the | |
363 | second the last local port number. Default value depends on | |
364 | amount of memory available on the system: | |
365 | > 128Mb 32768-61000 | |
366 | < 128Mb 1024-4999 or even less. | |
367 | This number defines number of active connections, which this | |
368 | system can issue simultaneously to systems not supporting | |
369 | TCP extensions (timestamps). With tcp_tw_recycle enabled | |
370 | (i.e. by default) range 1024-4999 is enough to issue up to | |
371 | 2000 connections per second to systems supporting timestamps. | |
372 | ||
373 | ip_nonlocal_bind - BOOLEAN | |
374 | If set, allows processes to bind() to non-local IP addresses, | |
375 | which can be quite useful - but may break some applications. | |
376 | Default: 0 | |
377 | ||
378 | ip_dynaddr - BOOLEAN | |
379 | If set non-zero, enables support for dynamic addresses. | |
380 | If set to a non-zero value larger than 1, a kernel log | |
381 | message will be printed when dynamic address rewriting | |
382 | occurs. | |
383 | Default: 0 | |
384 | ||
385 | icmp_echo_ignore_all - BOOLEAN | |
7ce31246 DM |
386 | If set non-zero, then the kernel will ignore all ICMP ECHO |
387 | requests sent to it. | |
388 | Default: 0 | |
389 | ||
1da177e4 | 390 | icmp_echo_ignore_broadcasts - BOOLEAN |
7ce31246 DM |
391 | If set non-zero, then the kernel will ignore all ICMP ECHO and |
392 | TIMESTAMP requests sent to it via broadcast/multicast. | |
393 | Default: 1 | |
1da177e4 LT |
394 | |
395 | icmp_ratelimit - INTEGER | |
396 | Limit the maximal rates for sending ICMP packets whose type matches | |
397 | icmp_ratemask (see below) to specific targets. | |
398 | 0 to disable any limiting, otherwise the maximal rate in jiffies(1) | |
399 | Default: 100 | |
400 | ||
401 | icmp_ratemask - INTEGER | |
402 | Mask made of ICMP types for which rates are being limited. | |
403 | Significant bits: IHGFEDCBA9876543210 | |
404 | Default mask: 0000001100000011000 (6168) | |
405 | ||
406 | Bit definitions (see include/linux/icmp.h): | |
407 | 0 Echo Reply | |
408 | 3 Destination Unreachable * | |
409 | 4 Source Quench * | |
410 | 5 Redirect | |
411 | 8 Echo Request | |
412 | B Time Exceeded * | |
413 | C Parameter Problem * | |
414 | D Timestamp Request | |
415 | E Timestamp Reply | |
416 | F Info Request | |
417 | G Info Reply | |
418 | H Address Mask Request | |
419 | I Address Mask Reply | |
420 | ||
421 | * These are rate limited by default (see default mask above) | |
422 | ||
423 | icmp_ignore_bogus_error_responses - BOOLEAN | |
424 | Some routers violate RFC1122 by sending bogus responses to broadcast | |
425 | frames. Such violations are normally logged via a kernel warning. | |
426 | If this is set to TRUE, the kernel will not give such warnings, which | |
427 | will avoid log file clutter. | |
428 | Default: FALSE | |
429 | ||
95f7daf1 H |
430 | icmp_errors_use_inbound_ifaddr - BOOLEAN |
431 | ||
432 | If zero, icmp error messages are sent with the primary address of | |
433 | the exiting interface. | |
434 | ||
435 | If non-zero, the message will be sent with the primary address of | |
436 | the interface that received the packet that caused the icmp error. | |
437 | This is the behaviour network many administrators will expect from | |
438 | a router. And it can make debugging complicated network layouts | |
439 | much easier. | |
440 | ||
441 | Note that if no primary address exists for the interface selected, | |
442 | then the primary address of the first non-loopback interface that | |
443 | has one will be used regarldess of this setting. | |
444 | ||
445 | Default: 0 | |
446 | ||
1da177e4 LT |
447 | igmp_max_memberships - INTEGER |
448 | Change the maximum number of multicast groups we can subscribe to. | |
449 | Default: 20 | |
450 | ||
451 | conf/interface/* changes special settings per interface (where "interface" is | |
452 | the name of your network interface) | |
453 | conf/all/* is special, changes the settings for all interfaces | |
454 | ||
455 | ||
456 | log_martians - BOOLEAN | |
457 | Log packets with impossible addresses to kernel log. | |
458 | log_martians for the interface will be enabled if at least one of | |
459 | conf/{all,interface}/log_martians is set to TRUE, | |
460 | it will be disabled otherwise | |
461 | ||
462 | accept_redirects - BOOLEAN | |
463 | Accept ICMP redirect messages. | |
464 | accept_redirects for the interface will be enabled if: | |
465 | - both conf/{all,interface}/accept_redirects are TRUE in the case forwarding | |
466 | for the interface is enabled | |
467 | or | |
468 | - at least one of conf/{all,interface}/accept_redirects is TRUE in the case | |
469 | forwarding for the interface is disabled | |
470 | accept_redirects for the interface will be disabled otherwise | |
471 | default TRUE (host) | |
472 | FALSE (router) | |
473 | ||
474 | forwarding - BOOLEAN | |
475 | Enable IP forwarding on this interface. | |
476 | ||
477 | mc_forwarding - BOOLEAN | |
478 | Do multicast routing. The kernel needs to be compiled with CONFIG_MROUTE | |
479 | and a multicast routing daemon is required. | |
480 | conf/all/mc_forwarding must also be set to TRUE to enable multicast routing | |
481 | for the interface | |
482 | ||
483 | medium_id - INTEGER | |
484 | Integer value used to differentiate the devices by the medium they | |
485 | are attached to. Two devices can have different id values when | |
486 | the broadcast packets are received only on one of them. | |
487 | The default value 0 means that the device is the only interface | |
488 | to its medium, value of -1 means that medium is not known. | |
489 | ||
490 | Currently, it is used to change the proxy_arp behavior: | |
491 | the proxy_arp feature is enabled for packets forwarded between | |
492 | two devices attached to different media. | |
493 | ||
494 | proxy_arp - BOOLEAN | |
495 | Do proxy arp. | |
496 | proxy_arp for the interface will be enabled if at least one of | |
497 | conf/{all,interface}/proxy_arp is set to TRUE, | |
498 | it will be disabled otherwise | |
499 | ||
500 | shared_media - BOOLEAN | |
501 | Send(router) or accept(host) RFC1620 shared media redirects. | |
502 | Overrides ip_secure_redirects. | |
503 | shared_media for the interface will be enabled if at least one of | |
504 | conf/{all,interface}/shared_media is set to TRUE, | |
505 | it will be disabled otherwise | |
506 | default TRUE | |
507 | ||
508 | secure_redirects - BOOLEAN | |
509 | Accept ICMP redirect messages only for gateways, | |
510 | listed in default gateway list. | |
511 | secure_redirects for the interface will be enabled if at least one of | |
512 | conf/{all,interface}/secure_redirects is set to TRUE, | |
513 | it will be disabled otherwise | |
514 | default TRUE | |
515 | ||
516 | send_redirects - BOOLEAN | |
517 | Send redirects, if router. | |
518 | send_redirects for the interface will be enabled if at least one of | |
519 | conf/{all,interface}/send_redirects is set to TRUE, | |
520 | it will be disabled otherwise | |
521 | Default: TRUE | |
522 | ||
523 | bootp_relay - BOOLEAN | |
524 | Accept packets with source address 0.b.c.d destined | |
525 | not to this host as local ones. It is supposed, that | |
526 | BOOTP relay daemon will catch and forward such packets. | |
527 | conf/all/bootp_relay must also be set to TRUE to enable BOOTP relay | |
528 | for the interface | |
529 | default FALSE | |
530 | Not Implemented Yet. | |
531 | ||
532 | accept_source_route - BOOLEAN | |
533 | Accept packets with SRR option. | |
534 | conf/all/accept_source_route must also be set to TRUE to accept packets | |
535 | with SRR option on the interface | |
536 | default TRUE (router) | |
537 | FALSE (host) | |
538 | ||
539 | rp_filter - BOOLEAN | |
540 | 1 - do source validation by reversed path, as specified in RFC1812 | |
541 | Recommended option for single homed hosts and stub network | |
542 | routers. Could cause troubles for complicated (not loop free) | |
543 | networks running a slow unreliable protocol (sort of RIP), | |
544 | or using static routes. | |
545 | ||
546 | 0 - No source validation. | |
547 | ||
548 | conf/all/rp_filter must also be set to TRUE to do source validation | |
549 | on the interface | |
550 | ||
551 | Default value is 0. Note that some distributions enable it | |
552 | in startup scripts. | |
553 | ||
554 | arp_filter - BOOLEAN | |
555 | 1 - Allows you to have multiple network interfaces on the same | |
556 | subnet, and have the ARPs for each interface be answered | |
557 | based on whether or not the kernel would route a packet from | |
558 | the ARP'd IP out that interface (therefore you must use source | |
559 | based routing for this to work). In other words it allows control | |
560 | of which cards (usually 1) will respond to an arp request. | |
561 | ||
562 | 0 - (default) The kernel can respond to arp requests with addresses | |
563 | from other interfaces. This may seem wrong but it usually makes | |
564 | sense, because it increases the chance of successful communication. | |
565 | IP addresses are owned by the complete host on Linux, not by | |
566 | particular interfaces. Only for more complex setups like load- | |
567 | balancing, does this behaviour cause problems. | |
568 | ||
569 | arp_filter for the interface will be enabled if at least one of | |
570 | conf/{all,interface}/arp_filter is set to TRUE, | |
571 | it will be disabled otherwise | |
572 | ||
573 | arp_announce - INTEGER | |
574 | Define different restriction levels for announcing the local | |
575 | source IP address from IP packets in ARP requests sent on | |
576 | interface: | |
577 | 0 - (default) Use any local address, configured on any interface | |
578 | 1 - Try to avoid local addresses that are not in the target's | |
579 | subnet for this interface. This mode is useful when target | |
580 | hosts reachable via this interface require the source IP | |
581 | address in ARP requests to be part of their logical network | |
582 | configured on the receiving interface. When we generate the | |
583 | request we will check all our subnets that include the | |
584 | target IP and will preserve the source address if it is from | |
585 | such subnet. If there is no such subnet we select source | |
586 | address according to the rules for level 2. | |
587 | 2 - Always use the best local address for this target. | |
588 | In this mode we ignore the source address in the IP packet | |
589 | and try to select local address that we prefer for talks with | |
590 | the target host. Such local address is selected by looking | |
591 | for primary IP addresses on all our subnets on the outgoing | |
592 | interface that include the target IP address. If no suitable | |
593 | local address is found we select the first local address | |
594 | we have on the outgoing interface or on all other interfaces, | |
595 | with the hope we will receive reply for our request and | |
596 | even sometimes no matter the source IP address we announce. | |
597 | ||
598 | The max value from conf/{all,interface}/arp_announce is used. | |
599 | ||
600 | Increasing the restriction level gives more chance for | |
601 | receiving answer from the resolved target while decreasing | |
602 | the level announces more valid sender's information. | |
603 | ||
604 | arp_ignore - INTEGER | |
605 | Define different modes for sending replies in response to | |
606 | received ARP requests that resolve local target IP addresses: | |
607 | 0 - (default): reply for any local target IP address, configured | |
608 | on any interface | |
609 | 1 - reply only if the target IP address is local address | |
610 | configured on the incoming interface | |
611 | 2 - reply only if the target IP address is local address | |
612 | configured on the incoming interface and both with the | |
613 | sender's IP address are part from same subnet on this interface | |
614 | 3 - do not reply for local addresses configured with scope host, | |
615 | only resolutions for global and link addresses are replied | |
616 | 4-7 - reserved | |
617 | 8 - do not reply for all local addresses | |
618 | ||
619 | The max value from conf/{all,interface}/arp_ignore is used | |
620 | when ARP request is received on the {interface} | |
621 | ||
622 | app_solicit - INTEGER | |
623 | The maximum number of probes to send to the user space ARP daemon | |
624 | via netlink before dropping back to multicast probes (see | |
625 | mcast_solicit). Defaults to 0. | |
626 | ||
627 | disable_policy - BOOLEAN | |
628 | Disable IPSEC policy (SPD) for this interface | |
629 | ||
630 | disable_xfrm - BOOLEAN | |
631 | Disable IPSEC encryption on this interface, whatever the policy | |
632 | ||
633 | ||
634 | ||
635 | tag - INTEGER | |
636 | Allows you to write a number, which can be used as required. | |
637 | Default value is 0. | |
638 | ||
639 | (1) Jiffie: internal timeunit for the kernel. On the i386 1/100s, on the | |
640 | Alpha 1/1024s. See the HZ define in /usr/include/asm/param.h for the exact | |
641 | value on your system. | |
642 | ||
643 | Alexey Kuznetsov. | |
644 | kuznet@ms2.inr.ac.ru | |
645 | ||
646 | Updated by: | |
647 | Andi Kleen | |
648 | ak@muc.de | |
649 | Nicolas Delon | |
650 | delon.nicolas@wanadoo.fr | |
651 | ||
652 | ||
653 | ||
654 | ||
655 | /proc/sys/net/ipv6/* Variables: | |
656 | ||
657 | IPv6 has no global variables such as tcp_*. tcp_* settings under ipv4/ also | |
658 | apply to IPv6 [XXX?]. | |
659 | ||
660 | bindv6only - BOOLEAN | |
661 | Default value for IPV6_V6ONLY socket option, | |
662 | which restricts use of the IPv6 socket to IPv6 communication | |
663 | only. | |
664 | TRUE: disable IPv4-mapped address feature | |
665 | FALSE: enable IPv4-mapped address feature | |
666 | ||
667 | Default: FALSE (as specified in RFC2553bis) | |
668 | ||
669 | IPv6 Fragmentation: | |
670 | ||
671 | ip6frag_high_thresh - INTEGER | |
672 | Maximum memory used to reassemble IPv6 fragments. When | |
673 | ip6frag_high_thresh bytes of memory is allocated for this purpose, | |
674 | the fragment handler will toss packets until ip6frag_low_thresh | |
675 | is reached. | |
676 | ||
677 | ip6frag_low_thresh - INTEGER | |
678 | See ip6frag_high_thresh | |
679 | ||
680 | ip6frag_time - INTEGER | |
681 | Time in seconds to keep an IPv6 fragment in memory. | |
682 | ||
683 | ip6frag_secret_interval - INTEGER | |
684 | Regeneration interval (in seconds) of the hash secret (or lifetime | |
685 | for the hash secret) for IPv6 fragments. | |
686 | Default: 600 | |
687 | ||
688 | conf/default/*: | |
689 | Change the interface-specific default settings. | |
690 | ||
691 | ||
692 | conf/all/*: | |
693 | Change all the interface-specific settings. | |
694 | ||
695 | [XXX: Other special features than forwarding?] | |
696 | ||
697 | conf/all/forwarding - BOOLEAN | |
698 | Enable global IPv6 forwarding between all interfaces. | |
699 | ||
700 | IPv4 and IPv6 work differently here; e.g. netfilter must be used | |
701 | to control which interfaces may forward packets and which not. | |
702 | ||
703 | This also sets all interfaces' Host/Router setting | |
704 | 'forwarding' to the specified value. See below for details. | |
705 | ||
706 | This referred to as global forwarding. | |
707 | ||
708 | conf/interface/*: | |
709 | Change special settings per interface. | |
710 | ||
711 | The functional behaviour for certain settings is different | |
712 | depending on whether local forwarding is enabled or not. | |
713 | ||
714 | accept_ra - BOOLEAN | |
715 | Accept Router Advertisements; autoconfigure using them. | |
716 | ||
717 | Functional default: enabled if local forwarding is disabled. | |
718 | disabled if local forwarding is enabled. | |
719 | ||
720 | accept_redirects - BOOLEAN | |
721 | Accept Redirects. | |
722 | ||
723 | Functional default: enabled if local forwarding is disabled. | |
724 | disabled if local forwarding is enabled. | |
725 | ||
726 | autoconf - BOOLEAN | |
727 | Autoconfigure addresses using Prefix Information in Router | |
728 | Advertisements. | |
729 | ||
730 | Functional default: enabled if accept_ra is enabled. | |
731 | disabled if accept_ra is disabled. | |
732 | ||
733 | dad_transmits - INTEGER | |
734 | The amount of Duplicate Address Detection probes to send. | |
735 | Default: 1 | |
736 | ||
737 | forwarding - BOOLEAN | |
738 | Configure interface-specific Host/Router behaviour. | |
739 | ||
740 | Note: It is recommended to have the same setting on all | |
741 | interfaces; mixed router/host scenarios are rather uncommon. | |
742 | ||
743 | FALSE: | |
744 | ||
745 | By default, Host behaviour is assumed. This means: | |
746 | ||
747 | 1. IsRouter flag is not set in Neighbour Advertisements. | |
748 | 2. Router Solicitations are being sent when necessary. | |
749 | 3. If accept_ra is TRUE (default), accept Router | |
750 | Advertisements (and do autoconfiguration). | |
751 | 4. If accept_redirects is TRUE (default), accept Redirects. | |
752 | ||
753 | TRUE: | |
754 | ||
755 | If local forwarding is enabled, Router behaviour is assumed. | |
756 | This means exactly the reverse from the above: | |
757 | ||
758 | 1. IsRouter flag is set in Neighbour Advertisements. | |
759 | 2. Router Solicitations are not sent. | |
760 | 3. Router Advertisements are ignored. | |
761 | 4. Redirects are ignored. | |
762 | ||
763 | Default: FALSE if global forwarding is disabled (default), | |
764 | otherwise TRUE. | |
765 | ||
766 | hop_limit - INTEGER | |
767 | Default Hop Limit to set. | |
768 | Default: 64 | |
769 | ||
770 | mtu - INTEGER | |
771 | Default Maximum Transfer Unit | |
772 | Default: 1280 (IPv6 required minimum) | |
773 | ||
774 | router_solicitation_delay - INTEGER | |
775 | Number of seconds to wait after interface is brought up | |
776 | before sending Router Solicitations. | |
777 | Default: 1 | |
778 | ||
779 | router_solicitation_interval - INTEGER | |
780 | Number of seconds to wait between Router Solicitations. | |
781 | Default: 4 | |
782 | ||
783 | router_solicitations - INTEGER | |
784 | Number of Router Solicitations to send until assuming no | |
785 | routers are present. | |
786 | Default: 3 | |
787 | ||
788 | use_tempaddr - INTEGER | |
789 | Preference for Privacy Extensions (RFC3041). | |
790 | <= 0 : disable Privacy Extensions | |
791 | == 1 : enable Privacy Extensions, but prefer public | |
792 | addresses over temporary addresses. | |
793 | > 1 : enable Privacy Extensions and prefer temporary | |
794 | addresses over public addresses. | |
795 | Default: 0 (for most devices) | |
796 | -1 (for point-to-point devices and loopback devices) | |
797 | ||
798 | temp_valid_lft - INTEGER | |
799 | valid lifetime (in seconds) for temporary addresses. | |
800 | Default: 604800 (7 days) | |
801 | ||
802 | temp_prefered_lft - INTEGER | |
803 | Preferred lifetime (in seconds) for temporary addresses. | |
804 | Default: 86400 (1 day) | |
805 | ||
806 | max_desync_factor - INTEGER | |
807 | Maximum value for DESYNC_FACTOR, which is a random value | |
808 | that ensures that clients don't synchronize with each | |
809 | other and generate new addresses at exactly the same time. | |
810 | value is in seconds. | |
811 | Default: 600 | |
812 | ||
813 | regen_max_retry - INTEGER | |
814 | Number of attempts before give up attempting to generate | |
815 | valid temporary addresses. | |
816 | Default: 5 | |
817 | ||
818 | max_addresses - INTEGER | |
819 | Number of maximum addresses per interface. 0 disables limitation. | |
820 | It is recommended not set too large value (or 0) because it would | |
821 | be too easy way to crash kernel to allow to create too much of | |
822 | autoconfigured addresses. | |
823 | Default: 16 | |
824 | ||
825 | icmp/*: | |
826 | ratelimit - INTEGER | |
827 | Limit the maximal rates for sending ICMPv6 packets. | |
828 | 0 to disable any limiting, otherwise the maximal rate in jiffies(1) | |
829 | Default: 100 | |
830 | ||
831 | ||
832 | IPv6 Update by: | |
833 | Pekka Savola <pekkas@netcore.fi> | |
834 | YOSHIFUJI Hideaki / USAGI Project <yoshfuji@linux-ipv6.org> | |
835 | ||
836 | ||
837 | /proc/sys/net/bridge/* Variables: | |
838 | ||
839 | bridge-nf-call-arptables - BOOLEAN | |
840 | 1 : pass bridged ARP traffic to arptables' FORWARD chain. | |
841 | 0 : disable this. | |
842 | Default: 1 | |
843 | ||
844 | bridge-nf-call-iptables - BOOLEAN | |
845 | 1 : pass bridged IPv4 traffic to iptables' chains. | |
846 | 0 : disable this. | |
847 | Default: 1 | |
848 | ||
849 | bridge-nf-call-ip6tables - BOOLEAN | |
850 | 1 : pass bridged IPv6 traffic to ip6tables' chains. | |
851 | 0 : disable this. | |
852 | Default: 1 | |
853 | ||
854 | bridge-nf-filter-vlan-tagged - BOOLEAN | |
855 | 1 : pass bridged vlan-tagged ARP/IP traffic to arptables/iptables. | |
856 | 0 : disable this. | |
857 | Default: 1 | |
858 | ||
859 | ||
860 | UNDOCUMENTED: | |
861 | ||
862 | dev_weight FIXME | |
863 | discovery_slots FIXME | |
864 | discovery_timeout FIXME | |
865 | fast_poll_increase FIXME | |
866 | ip6_queue_maxlen FIXME | |
867 | lap_keepalive_time FIXME | |
868 | lo_cong FIXME | |
869 | max_baud_rate FIXME | |
870 | max_dgram_qlen FIXME | |
871 | max_noreply_time FIXME | |
872 | max_tx_data_size FIXME | |
873 | max_tx_window FIXME | |
874 | min_tx_turn_time FIXME | |
875 | mod_cong FIXME | |
876 | no_cong FIXME | |
877 | no_cong_thresh FIXME | |
878 | slot_timeout FIXME | |
879 | warn_noreply_time FIXME | |
880 | ||
881 | $Id: ip-sysctl.txt,v 1.20 2001/12/13 09:00:18 davem Exp $ |