]>
Commit | Line | Data |
---|---|---|
c9f9e0e1 JP |
1 | /proc/sys/net/netfilter/nf_conntrack_* Variables: |
2 | ||
3 | nf_conntrack_acct - BOOLEAN | |
4 | 0 - disabled (default) | |
5 | not 0 - enabled | |
6 | ||
7 | Enable connection tracking flow accounting. 64-bit byte and packet | |
8 | counters per flow are added. | |
9 | ||
3183ab89 | 10 | nf_conntrack_buckets - INTEGER |
c9f9e0e1 JP |
11 | Size of hash table. If not specified as parameter during module |
12 | loading, the default size is calculated by dividing total memory | |
13 | by 16384 to determine the number of buckets but the hash table will | |
88eab472 ML |
14 | never have fewer than 32 and limited to 16384 buckets. For systems |
15 | with more than 4GB of memory it will be 65536 buckets. | |
3183ab89 | 16 | This sysctl is only writeable in the initial net namespace. |
c9f9e0e1 JP |
17 | |
18 | nf_conntrack_checksum - BOOLEAN | |
19 | 0 - disabled | |
20 | not 0 - enabled (default) | |
21 | ||
22 | Verify checksum of incoming packets. Packets with bad checksums are | |
23 | in INVALID state. If this is enabled, such packets will not be | |
24 | considered for connection tracking. | |
25 | ||
26 | nf_conntrack_count - INTEGER (read-only) | |
27 | Number of currently allocated flow entries. | |
28 | ||
29 | nf_conntrack_events - BOOLEAN | |
30 | 0 - disabled | |
31 | not 0 - enabled (default) | |
32 | ||
33 | If this option is enabled, the connection tracking code will | |
34 | provide userspace with connection tracking events via ctnetlink. | |
35 | ||
c9f9e0e1 JP |
36 | nf_conntrack_expect_max - INTEGER |
37 | Maximum size of expectation table. Default value is | |
38 | nf_conntrack_buckets / 256. Minimum is 1. | |
39 | ||
40 | nf_conntrack_frag6_high_thresh - INTEGER | |
41 | default 262144 | |
42 | ||
43 | Maximum memory used to reassemble IPv6 fragments. When | |
44 | nf_conntrack_frag6_high_thresh bytes of memory is allocated for this | |
45 | purpose, the fragment handler will toss packets until | |
46 | nf_conntrack_frag6_low_thresh is reached. | |
47 | ||
48 | nf_conntrack_frag6_low_thresh - INTEGER | |
49 | default 196608 | |
50 | ||
51 | See nf_conntrack_frag6_low_thresh | |
52 | ||
53 | nf_conntrack_frag6_timeout - INTEGER (seconds) | |
54 | default 60 | |
55 | ||
56 | Time to keep an IPv6 fragment in memory. | |
57 | ||
58 | nf_conntrack_generic_timeout - INTEGER (seconds) | |
59 | default 600 | |
60 | ||
61 | Default for generic timeout. This refers to layer 4 unknown/unsupported | |
62 | protocols. | |
63 | ||
64 | nf_conntrack_helper - BOOLEAN | |
486dcf43 FW |
65 | 0 - disabled (default) |
66 | not 0 - enabled | |
c9f9e0e1 JP |
67 | |
68 | Enable automatic conntrack helper assignment. | |
486dcf43 FW |
69 | If disabled it is required to set up iptables rules to assign |
70 | helpers to connections. See the CT target description in the | |
71 | iptables-extensions(8) man page for further information. | |
c9f9e0e1 JP |
72 | |
73 | nf_conntrack_icmp_timeout - INTEGER (seconds) | |
74 | default 30 | |
75 | ||
76 | Default for ICMP timeout. | |
77 | ||
78 | nf_conntrack_icmpv6_timeout - INTEGER (seconds) | |
79 | default 30 | |
80 | ||
81 | Default for ICMP6 timeout. | |
82 | ||
83 | nf_conntrack_log_invalid - INTEGER | |
84 | 0 - disable (default) | |
85 | 1 - log ICMP packets | |
86 | 6 - log TCP packets | |
87 | 17 - log UDP packets | |
88 | 33 - log DCCP packets | |
89 | 41 - log ICMPv6 packets | |
90 | 136 - log UDPLITE packets | |
91 | 255 - log packets of any protocol | |
92 | ||
93 | Log invalid packets of a type specified by value. | |
94 | ||
95 | nf_conntrack_max - INTEGER | |
96 | Size of connection tracking table. Default value is | |
97 | nf_conntrack_buckets value * 4. | |
98 | ||
481fa373 FW |
99 | nf_conntrack_default_on - BOOLEAN |
100 | 0 - don't register conntrack in new net namespaces | |
101 | 1 - register conntrack in new net namespaces (default) | |
102 | ||
103 | This controls wheter newly created network namespaces have connection | |
104 | tracking enabled by default. It will be enabled automatically | |
105 | regardless of this setting if the new net namespace requires | |
106 | connection tracking, e.g. when NAT rules are created. | |
107 | This setting is only visible in initial user namespace, it has no | |
108 | effect on existing namespaces. | |
109 | ||
c9f9e0e1 JP |
110 | nf_conntrack_tcp_be_liberal - BOOLEAN |
111 | 0 - disabled (default) | |
112 | not 0 - enabled | |
113 | ||
114 | Be conservative in what you do, be liberal in what you accept from others. | |
115 | If it's non-zero, we mark only out of window RST segments as INVALID. | |
116 | ||
117 | nf_conntrack_tcp_loose - BOOLEAN | |
118 | 0 - disabled | |
119 | not 0 - enabled (default) | |
120 | ||
121 | If it is set to zero, we disable picking up already established | |
122 | connections. | |
123 | ||
124 | nf_conntrack_tcp_max_retrans - INTEGER | |
125 | default 3 | |
126 | ||
127 | Maximum number of packets that can be retransmitted without | |
128 | received an (acceptable) ACK from the destination. If this number | |
129 | is reached, a shorter timer will be started. | |
130 | ||
131 | nf_conntrack_tcp_timeout_close - INTEGER (seconds) | |
132 | default 10 | |
133 | ||
134 | nf_conntrack_tcp_timeout_close_wait - INTEGER (seconds) | |
135 | default 60 | |
136 | ||
137 | nf_conntrack_tcp_timeout_established - INTEGER (seconds) | |
138 | default 432000 (5 days) | |
139 | ||
140 | nf_conntrack_tcp_timeout_fin_wait - INTEGER (seconds) | |
141 | default 120 | |
142 | ||
143 | nf_conntrack_tcp_timeout_last_ack - INTEGER (seconds) | |
144 | default 30 | |
145 | ||
146 | nf_conntrack_tcp_timeout_max_retrans - INTEGER (seconds) | |
147 | default 300 | |
148 | ||
149 | nf_conntrack_tcp_timeout_syn_recv - INTEGER (seconds) | |
150 | default 60 | |
151 | ||
152 | nf_conntrack_tcp_timeout_syn_sent - INTEGER (seconds) | |
153 | default 120 | |
154 | ||
155 | nf_conntrack_tcp_timeout_time_wait - INTEGER (seconds) | |
156 | default 120 | |
157 | ||
158 | nf_conntrack_tcp_timeout_unacknowledged - INTEGER (seconds) | |
159 | default 300 | |
160 | ||
161 | nf_conntrack_timestamp - BOOLEAN | |
162 | 0 - disabled (default) | |
163 | not 0 - enabled | |
164 | ||
165 | Enable connection tracking flow timestamping. | |
166 | ||
167 | nf_conntrack_udp_timeout - INTEGER (seconds) | |
168 | default 30 | |
169 | ||
170 | nf_conntrack_udp_timeout_stream2 - INTEGER (seconds) | |
171 | default 180 | |
172 | ||
173 | This extended timeout will be used in case there is an UDP stream | |
174 | detected. |