1.\" Copyright (c) 1983, 1991, 1993 2.\" The Regents of the University of California. 3.\" Copyright (c) 2010-2011 The FreeBSD Foundation 4.\" All rights reserved. 5.\" 6.\" Portions of this documentation were written at the Centre for Advanced 7.\" Internet Architectures, Swinburne University of Technology, Melbourne, 8.\" Australia by David Hayes under sponsorship from the FreeBSD Foundation. 9.\" 10.\" Redistribution and use in source and binary forms, with or without 11.\" modification, are permitted provided that the following conditions 12.\" are met: 13.\" 1. Redistributions of source code must retain the above copyright 14.\" notice, this list of conditions and the following disclaimer. 15.\" 2. Redistributions in binary form must reproduce the above copyright 16.\" notice, this list of conditions and the following disclaimer in the 17.\" documentation and/or other materials provided with the distribution. 18.\" 3. Neither the name of the University nor the names of its contributors 19.\" may be used to endorse or promote products derived from this software 20.\" without specific prior written permission. 21.\" 22.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 23.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 26.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32.\" SUCH DAMAGE. 33.\" 34.Dd July 21, 2024 35.Dt TCP 4 36.Os 37.Sh NAME 38.Nm tcp 39.Nd Internet Transmission Control Protocol 40.Sh SYNOPSIS 41.In sys/types.h 42.In sys/socket.h 43.In netinet/in.h 44.In netinet/tcp.h 45.Ft int 46.Fn socket AF_INET SOCK_STREAM 0 47.Sh DESCRIPTION 48The 49.Tn TCP 50protocol provides reliable, flow-controlled, two-way 51transmission of data. 52It is a byte-stream protocol used to 53support the 54.Dv SOCK_STREAM 55abstraction. 56.Tn TCP 57uses the standard 58Internet address format and, in addition, provides a per-host 59collection of 60.Dq "port addresses" . 61Thus, each address is composed 62of an Internet address specifying the host and network, 63with a specific 64.Tn TCP 65port on the host identifying the peer entity. 66.Pp 67Sockets utilizing the 68.Tn TCP 69protocol are either 70.Dq active 71or 72.Dq passive . 73Active sockets initiate connections to passive 74sockets. 75By default, 76.Tn TCP 77sockets are created active; to create a 78passive socket, the 79.Xr listen 2 80system call must be used 81after binding the socket with the 82.Xr bind 2 83system call. 84Only passive sockets may use the 85.Xr accept 2 86call to accept incoming connections. 87Only active sockets may use the 88.Xr connect 2 89call to initiate connections. 90.Pp 91Passive sockets may 92.Dq underspecify 93their location to match 94incoming connection requests from multiple networks. 95This technique, termed 96.Dq "wildcard addressing" , 97allows a single 98server to provide service to clients on multiple networks. 99To create a socket which listens on all networks, the Internet 100address 101.Dv INADDR_ANY 102must be bound. 103The 104.Tn TCP 105port may still be specified 106at this time; if the port is not specified, the system will assign one. 107Once a connection has been established, the socket's address is 108fixed by the peer entity's location. 109The address assigned to the 110socket is the address associated with the network interface 111through which packets are being transmitted and received. 112Normally, this address corresponds to the peer entity's network. 113.Pp 114.Tn TCP 115supports a number of socket options which can be set with 116.Xr setsockopt 2 117and tested with 118.Xr getsockopt 2 : 119.Bl -tag -width ".Dv TCP_FUNCTION_BLK" 120.It Dv TCP_INFO 121Information about a socket's underlying TCP session may be retrieved 122by passing the read-only option 123.Dv TCP_INFO 124to 125.Xr getsockopt 2 . 126It accepts a single argument: a pointer to an instance of 127.Vt "struct tcp_info" . 128.Pp 129This API is subject to change; consult the source to determine 130which fields are currently filled out by this option. 131.Fx 132specific additions include 133send window size, 134receive window size, 135and 136bandwidth-controlled window space. 137.It Dv TCP_CCALGOOPT 138Set or query congestion control algorithm specific parameters. 139See 140.Xr mod_cc 4 141for details. 142.It Dv TCP_CONGESTION 143Select or query the congestion control algorithm that TCP will use for the 144connection. 145See 146.Xr mod_cc 4 147for details. 148.It Dv TCP_FASTOPEN 149Enable or disable TCP Fast Open (TFO). 150To use this option, the kernel must be built with the 151.Dv TCP_RFC7413 152option. 153.Pp 154This option can be set on the socket either before or after the 155.Xr listen 2 156is invoked. 157Clearing this option on a listen socket after it has been set has no effect on 158existing TFO connections or TFO connections in progress; it only prevents new 159TFO connections from being established. 160.Pp 161For passively-created sockets, the 162.Dv TCP_FASTOPEN 163socket option can be queried to determine whether the connection was established 164using TFO. 165Note that connections that are established via a TFO 166.Tn SYN , 167but that fall back to using a non-TFO 168.Tn SYN|ACK 169will have the 170.Dv TCP_FASTOPEN 171socket option set. 172.Pp 173In addition to the facilities defined in RFC7413, this implementation supports a 174pre-shared key (PSK) mode of operation in which the TFO server requires the 175client to be in possession of a shared secret in order for the client to be able 176to successfully open TFO connections with the server. 177This is useful, for example, in environments where TFO servers are exposed to 178both internal and external clients and only wish to allow TFO connections from 179internal clients. 180.Pp 181In the PSK mode of operation, the server generates and sends TFO cookies to 182requesting clients as usual. 183However, when validating cookies received in TFO SYNs from clients, the server 184requires the client-supplied cookie to equal 185.Bd -literal -offset left 186SipHash24(key=\fI16-byte-psk\fP, msg=\fIcookie-sent-to-client\fP) 187.Ed 188.Pp 189Multiple concurrent valid pre-shared keys are supported so that time-based 190rolling PSK invalidation policies can be implemented in the system. 191The default number of concurrent pre-shared keys is 2. 192.Pp 193This can be adjusted with the 194.Dv TCP_RFC7413_MAX_PSKS 195kernel option. 196.It Dv TCP_FUNCTION_BLK 197Select or query the set of functions that TCP will use for this connection. 198This allows a user to select an alternate TCP stack. 199The alternate TCP stack must already be loaded in the kernel. 200To list the available TCP stacks, see 201.Va functions_available 202in the 203.Sx MIB (sysctl) Variables 204section further down. 205To list the default TCP stack, see 206.Va functions_default 207in the 208.Sx MIB (sysctl) Variables 209section. 210.It Dv TCP_KEEPINIT 211This 212.Xr setsockopt 2 213option accepts a per-socket timeout argument of 214.Vt "u_int" 215in seconds, for new, non-established 216.Tn TCP 217connections. 218For the global default in milliseconds see 219.Va keepinit 220in the 221.Sx MIB (sysctl) Variables 222section further down. 223.It Dv TCP_KEEPIDLE 224This 225.Xr setsockopt 2 226option accepts an argument of 227.Vt "u_int" 228for the amount of time, in seconds, that the connection must be idle 229before keepalive probes (if enabled) are sent for the connection of this 230socket. 231If set on a listening socket, the value is inherited by the newly created 232socket upon 233.Xr accept 2 . 234For the global default in milliseconds see 235.Va keepidle 236in the 237.Sx MIB (sysctl) Variables 238section further down. 239.It Dv TCP_KEEPINTVL 240This 241.Xr setsockopt 2 242option accepts an argument of 243.Vt "u_int" 244to set the per-socket interval, in seconds, between keepalive probes sent 245to a peer. 246If set on a listening socket, the value is inherited by the newly created 247socket upon 248.Xr accept 2 . 249For the global default in milliseconds see 250.Va keepintvl 251in the 252.Sx MIB (sysctl) Variables 253section further down. 254.It Dv TCP_KEEPCNT 255This 256.Xr setsockopt 2 257option accepts an argument of 258.Vt "u_int" 259and allows a per-socket tuning of the number of probes sent, with no response, 260before the connection will be dropped. 261If set on a listening socket, the value is inherited by the newly created 262socket upon 263.Xr accept 2 . 264For the global default see the 265.Va keepcnt 266in the 267.Sx MIB (sysctl) Variables 268section further down. 269.It Dv TCP_NODELAY 270Under most circumstances, 271.Tn TCP 272sends data when it is presented; 273when outstanding data has not yet been acknowledged, it gathers 274small amounts of output to be sent in a single packet once 275an acknowledgement is received. 276For a small number of clients, such as window systems 277that send a stream of mouse events which receive no replies, 278this packetization may cause significant delays. 279The boolean option 280.Dv TCP_NODELAY 281defeats this algorithm. 282 283.It Dv TCP_MAXSEG 284By default, a sender- and 285.No receiver- Ns Tn TCP 286will negotiate among themselves to determine the maximum segment size 287to be used for each connection. 288The 289.Dv TCP_MAXSEG 290option allows the user to determine the result of this negotiation, 291and to reduce it if desired. 292.It Dv TCP_MAXUNACKTIME 293This 294.Xr setsockopt 2 295option accepts an argument of 296.Vt "u_int" 297to set the per-socket interval, in seconds, in which the connection must 298make progress. Progress is defined by at least 1 byte being acknowledged within 299the set time period. If a connection fails to make progress, then the 300.Tn TCP 301stack will terminate the connection with a reset. Note that the default 302value for this is zero which indicates no progress checks should be made. 303.It Dv TCP_NOOPT 304.Tn TCP 305usually sends a number of options in each packet, corresponding to 306various 307.Tn TCP 308extensions which are provided in this implementation. 309The boolean option 310.Dv TCP_NOOPT 311is provided to disable 312.Tn TCP 313option use on a per-connection basis. 314.It Dv TCP_NOPUSH 315By convention, the 316.No sender- Ns Tn TCP 317will set the 318.Dq push 319bit, and begin transmission immediately (if permitted) at the end of 320every user call to 321.Xr write 2 322or 323.Xr writev 2 . 324When this option is set to a non-zero value, 325.Tn TCP 326will delay sending any data at all until either the socket is closed, 327or the internal send buffer is filled. 328.It Dv TCP_MD5SIG 329This option enables the use of MD5 digests (also known as TCP-MD5) 330on writes to the specified socket. 331Outgoing traffic is digested; 332digests on incoming traffic are verified. 333When this option is enabled on a socket, all inbound and outgoing 334TCP segments must be signed with MD5 digests. 335.Pp 336One common use for this in a 337.Fx 338router deployment is to enable 339based routers to interwork with Cisco equipment at peering points. 340Support for this feature conforms to RFC 2385. 341.Pp 342In order for this option to function correctly, it is necessary for the 343administrator to add a tcp-md5 key entry to the system's security 344associations database (SADB) using the 345.Xr setkey 8 346utility. 347This entry can only be specified on a per-host basis at this time. 348.Pp 349If an SADB entry cannot be found for the destination, 350the system does not send any outgoing segments and drops any inbound segments. 351However, during connection negotiation, a non-signed segment will be accepted if 352an SADB entry does not exist between hosts. 353When a non-signed segment is accepted, the established connection is not 354protected with MD5 digests. 355.It Dv TCP_STATS 356Manage collection of connection level statistics using the 357.Xr stats 3 358framework. 359.Pp 360Each dropped segment is taken into account in the TCP protocol statistics. 361.It Dv TCP_TXTLS_ENABLE 362Enable in-kernel Transport Layer Security (TLS) for data written to this 363socket. 364See 365.Xr ktls 4 366for more details. 367.It Dv TCP_TXTLS_MODE 368The integer argument can be used to get or set the current TLS transmit mode 369of a socket. 370See 371.Xr ktls 4 372for more details. 373.It Dv TCP_RXTLS_ENABLE 374Enable in-kernel TLS for data read from this socket. 375See 376.Xr ktls 4 377for more details. 378.It Dv TCP_REUSPORT_LB_NUMA 379Changes NUMA affinity filtering for an established TCP listen 380socket. 381This option takes a single integer argument which specifies 382the NUMA domain to filter on for this listen socket. 383The argument can also have the following special values: 384.Bl -tag -width "Dv TCP_REUSPORT_LB_NUMA" 385.It Dv TCP_REUSPORT_LB_NUMA_NODOM 386Remove NUMA filtering for this listen socket. 387.It Dv TCP_REUSPORT_LB_NUMA_CURDOM 388Filter traffic associated with the domain where the calling thread is 389currently executing. 390This is typically used after a process or thread inherits a listen 391socket from its parent, and sets its CPU affinity to a particular core. 392.El 393.It Dv TCP_REMOTE_UDP_ENCAPS_PORT 394Set and get the remote UDP encapsulation port. 395It can only be set on a closed TCP socket. 396.El 397.Pp 398The option level for the 399.Xr setsockopt 2 400call is the protocol number for 401.Tn TCP , 402available from 403.Xr getprotobyname 3 , 404or 405.Dv IPPROTO_TCP . 406All options are declared in 407.In netinet/tcp.h . 408.Pp 409Options at the 410.Tn IP 411transport level may be used with 412.Tn TCP ; 413see 414.Xr ip 4 . 415Incoming connection requests that are source-routed are noted, 416and the reverse source route is used in responding. 417.Pp 418The default congestion control algorithm for 419.Tn TCP 420is 421.Xr cc_newreno 4 . 422Other congestion control algorithms can be made available using the 423.Xr mod_cc 4 424framework. 425.Ss MIB (sysctl) Variables 426The 427.Tn TCP 428protocol implements a number of variables in the 429.Va net.inet.tcp 430branch of the 431.Xr sysctl 3 432MIB, which can also be read or modified with 433.Xr sysctl 8 . 434.Bl -tag -width ".Va v6pmtud_blackhole_mss" 435.It Va always_keepalive 436Assume that 437.Dv SO_KEEPALIVE 438is set on all 439.Tn TCP 440connections, the kernel will 441periodically send a packet to the remote host to verify the connection 442is still up. 443.It Va blackhole 444If enabled, disable sending of RST when a connection is attempted 445to a port where there is no socket accepting connections. 446See 447.Xr blackhole 4 . 448.It Va blackhole_local 449See 450.Xr blackhole 4 . 451.It Va cc 452A number of variables for congestion control are under the 453.Va net.inet.tcp.cc 454node. 455See 456.Xr mod_cc 4 . 457.It Va cc.newreno 458Variables for NewReno congestion control are under the 459.Va net.inet.tcp.cc.newreno 460node. 461See 462.Xr cc_newreno 4 . 463.It Va delacktime 464Maximum amount of time, in milliseconds, before a delayed ACK is sent. 465.It Va delayed_ack 466Delay ACK to try and piggyback it onto a data packet or another ACK. 467.It Va do_prr 468Perform SACK loss recovery using the Proportional Rate Reduction (PRR) algorithm 469described in RFC6937. 470This improves the effectiveness of retransmissions particular in environments 471with ACK thinning or burst loss events, as chances to run out of the ACK clock 472are reduced, preventing lengthy and performance reducing RTO based loss recovery 473(default is true). 474.It Va do_tcpdrain 475Flush packets in the 476.Tn TCP 477reassembly queue if the system is low on mbufs. 478.It Va drop_synfin 479Drop TCP packets with both SYN and FIN set. 480.It Va ecn.enable 481Enable support for TCP Explicit Congestion Notification (ECN). 482ECN allows a TCP sender to reduce the transmission rate in order to 483avoid packet drops. 484.Bl -tag -compact 485.It 0 486Disable ECN. 487.It 1 488Allow incoming connections to request ECN. 489Outgoing connections will request ECN. 490.It 2 491Allow incoming connections to request ECN. 492Outgoing connections will not request ECN. 493(default) 494.It 3 495Negotiate on incoming connection for Accurate ECN, ECN, or no ECN. 496Outgoing connections will request Accurate ECN and fall back to 497ECN depending on the capabilities of the server. 498.It 4 499Negotiate on incoming connection for Accurate ECN, ECN, or no ECN. 500Outgoing connections will not request ECN. 501.El 502.It Va ecn.maxretries 503Number of retries (SYN or SYN/ACK retransmits) before disabling ECN on a 504specific connection. 505This is needed to help with connection establishment 506when a broken firewall is in the network path. 507.It Va fast_finwait2_recycle 508Recycle 509.Tn TCP 510.Dv FIN_WAIT_2 511connections faster when the socket is marked as 512.Dv SBS_CANTRCVMORE 513(no user process has the socket open, data received on 514the socket cannot be read). 515The timeout used here is 516.Va finwait2_timeout . 517.It Va fastopen.acceptany 518When non-zero, all client-supplied TFO cookies will be considered to be valid. 519The default is 0. 520.It Va fastopen.autokey 521When this and 522.Va net.inet.tcp.fastopen.server_enable 523are non-zero, a new key will be automatically generated after this specified 524seconds. 525The default is 120. 526.It Va fastopen.ccache_bucket_limit 527The maximum number of entries in a client cookie cache bucket. 528The default value can be tuned with the 529.Dv TCP_FASTOPEN_CCACHE_BUCKET_LIMIT_DEFAULT 530kernel option or by setting 531.Va net.inet.tcp.fastopen_ccache_bucket_limit 532in the 533.Xr loader 8 . 534.It Va fastopen.ccache_buckets 535The number of client cookie cache buckets. 536Read-only. 537The value can be tuned with the 538.Dv TCP_FASTOPEN_CCACHE_BUCKETS_DEFAULT 539kernel option or by setting 540.Va fastopen.ccache_buckets 541in the 542.Xr loader 8 . 543.It Va fastopen.ccache_list 544Print the client cookie cache. 545Read-only. 546.It Va fastopen.client_enable 547When zero, no new active (i.e., client) TFO connections can be created. 548On the transition from enabled to disabled, the client cookie cache is cleared 549and disabled. 550The transition from enabled to disabled does not affect any active TFO 551connections in progress; it only prevents new ones from being established. 552The default is 0. 553.It Va fastopen.keylen 554The key length in bytes. 555Read-only. 556.It Va fastopen.maxkeys 557The maximum number of keys supported. 558Read-only, 559.It Va fastopen.maxpsks 560The maximum number of pre-shared keys supported. 561Read-only. 562.It Va fastopen.numkeys 563The current number of keys installed. 564Read-only. 565.It Va fastopen.numpsks 566The current number of pre-shared keys installed. 567Read-only. 568.It Va fastopen.path_disable_time 569When a failure occurs while trying to create a new active (i.e., client) TFO 570connection, new active connections on the same path, as determined by the tuple 571.Brq client_ip, server_ip, server_port , 572will be forced to be non-TFO for this many seconds. 573Note that the path disable mechanism relies on state stored in client cookie 574cache entries, so it is possible for the disable time for a given path to be 575reduced if the corresponding client cookie cache entry is reused due to resource 576pressure before the disable period has elapsed. 577The default is 578.Dv TCP_FASTOPEN_PATH_DISABLE_TIME_DEFAULT . 579.It Va fastopen.psk_enable 580When non-zero, pre-shared key (PSK) mode is enabled for all TFO servers. 581On the transition from enabled to disabled, all installed pre-shared keys are 582removed. 583The default is 0. 584.It Va fastopen.server_enable 585When zero, no new passive (i.e., server) TFO connections can be created. 586On the transition from enabled to disabled, all installed keys and pre-shared 587keys are removed. 588On the transition from disabled to enabled, if 589.Va fastopen.autokey 590is non-zero and there are no keys installed, a new key will be generated 591immediately. 592The transition from enabled to disabled does not affect any passive TFO 593connections in progress; it only prevents new ones from being established. 594The default is 0. 595.It Va fastopen.setkey 596Install a new key by writing 597.Va net.inet.tcp.fastopen.keylen 598bytes to this sysctl. 599.It Va fastopen.setpsk 600Install a new pre-shared key by writing 601.Va net.inet.tcp.fastopen.keylen 602bytes to this sysctl. 603.It Va finwait2_timeout 604Timeout to use for fast recycling of 605.Tn TCP 606.Dv FIN_WAIT_2 607connections 608.Pq Va fast_finwait2_recycle . 609Defaults to 60 seconds. 610.It Va functions_available 611List of available TCP function blocks (TCP stacks). 612.It Va functions_default 613The default TCP function block (TCP stack). 614.It Va functions_inherit_listen_socket_stack 615Determines whether to inherit listen socket's TCP stack or use the current 616system default TCP stack, as defined by 617.Va functions_default . 618Default is true. 619.It Va hostcache 620The TCP host cache is used to cache connection details and metrics to 621improve future performance of connections between the same hosts. 622At the completion of a TCP connection, a host will cache information 623for the connection for some defined period of time. 624There are a number of 625.Va hostcache 626variables under this node. 627See 628.Va hostcache.enable . 629.It Va hostcache.bucketlimit 630The maximum number of entries for the same hash. 631Defaults to 30. 632.It Va hostcache.cachelimit 633Overall entry limit for hostcache. 634Defaults to 635.Va hashsize 636* 637.Va bucketlimit . 638.It Va hostcache.count 639The current number of entries in the host cache. 640.It Va hostcache.enable 641Enable/disable the host cache: 642.Bl -tag -compact 643.It 0 644Disable the host cache. 645.It 1 646Enable the host cache. (default) 647.El 648.It Va hostcache.expire 649Time in seconds, how long a entry should be kept in the 650host cache since last accessed. 651Defaults to 3600 (1 hour). 652.It Va hostcache.hashsize 653Size of TCP hostcache hashtable. 654This number has to be a power of two, or will be rejected. 655Defaults to 512. 656.It Va hostcache.histo 657Provide a Histogram of the hostcache hash utilization. 658.It Va hostcache.list 659Provide a complete list of all current entries in the host 660cache. 661.It Va hostcache.prune 662Time in seconds between pruning expired host cache entries. 663Defaults to 300 (5 minutes). 664.It Va hostcache.purge 665Expire all entries on next pruning of host cache entries. 666Any non-zero setting will be reset to zero, once the purge 667is running. 668.Bl -tag -compact 669.It 0 670Do not purge all entries when pruning the host cache (default). 671.It 1 672Purge all entries when doing the next pruning. 673.It 2 674Purge all entries and also reseed the hash salt. 675.El 676.It Va hostcache.purgenow 677Immediately purge all entries once set to any value. 678Setting this to 2 will also reseed the hash salt. 679.It Va icmp_may_rst 680Certain 681.Tn ICMP 682unreachable messages may abort connections in 683.Tn SYN-SENT 684state. 685.It Va initcwnd_segments 686Enable the ability to specify initial congestion window in number of segments. 687The default value is 10 as suggested by RFC 6928. 688Changing the value on the fly would not affect connections 689using congestion window from the hostcache. 690Caution: 691This regulates the burst of packets allowed to be sent in the first RTT. 692The value should be relative to the link capacity. 693Start with small values for lower-capacity links. 694Large bursts can cause buffer overruns and packet drops if routers have small 695buffers or the link is experiencing congestion. 696.It Va insecure_rst 697Use criteria defined in RFC793 instead of RFC5961 for accepting RST segments. 698Default is false. 699.It Va insecure_syn 700Use criteria defined in RFC793 instead of RFC5961 for accepting SYN segments. 701Default is false. 702.It Va insecure_ack 703Use criteria defined in RFC793 for validating SEG.ACK. 704Default is false. 705.It Va isn_reseed_interval 706The interval (in seconds) specifying how often the secret data used in 707RFC 1948 initial sequence number calculations should be reseeded. 708By default, this variable is set to zero, indicating that 709no reseeding will occur. 710Reseeding should not be necessary, and will break 711.Dv TIME_WAIT 712recycling for a few minutes. 713.It Va keepcnt 714Number of keepalive probes sent, with no response, before a connection 715is dropped. 716The default is 8 packets. 717.It Va keepidle 718Amount of time, in milliseconds, that the connection must be idle 719before sending keepalive probes (if enabled). 720The default is 7200000 msec (7.2M msec, 2 hours). 721.It Va keepinit 722Timeout, in milliseconds, for new, non-established 723.Tn TCP 724connections. 725The default is 75000 msec (75K msec, 75 sec). 726.It Va keepintvl 727The interval, in milliseconds, between keepalive probes sent to remote 728machines, when no response is received on a 729.Va keepidle 730probe. 731The default is 75000 msec (75K msec, 75 sec). 732.It Va log_in_vain 733Log any connection attempts to ports where there is no socket 734accepting connections. 735The value of 1 limits the logging to 736.Tn SYN 737(connection establishment) packets only. 738A value of 2 results in any 739.Tn TCP 740packets to closed ports being logged. 741Any value not listed above disables the logging 742(default is 0, i.e., the logging is disabled). 743.It Va minmss 744Minimum TCP Maximum Segment Size; used to prevent a denial of service attack 745from an unreasonably low MSS. 746.It Va msl 747The Maximum Segment Lifetime, in milliseconds, for a packet. 748.It Va mssdflt 749The default value used for the TCP Maximum Segment Size 750.Pq Dq MSS 751for IPv4 when no advice to the contrary is received from MSS negotiation. 752.It Va newcwd 753Enable the New Congestion Window Validation mechanism as described in RFC 7661. 754This gently reduces the congestion window during periods, where TCP is 755application limited and the network bandwidth is not utilized completely. 756That prevents self-inflicted packet losses once the application starts to 757transmit data at a higher speed. 758.It Va nolocaltimewait 759Suppress creation of TCP 760.Dv TIME_WAIT 761states for connections in 762which both endpoints are local. 763.It Va path_mtu_discovery 764Enable Path MTU Discovery. 765.It Va pcbcount 766Number of active protocol control blocks 767(read-only). 768.It Va perconn_stats_enable 769Controls the default collection of statistics for all connections using the 770.Xr stats 3 771framework. 7720 disables, 1 enables, 2 enables random sampling across log id connection 773groups with all connections in a group receiving the same setting. 774.It Va perconn_stats_sample_rates 775A CSV list of template_spec=percent key-value pairs which controls the per 776template sampling rates when 777.Xr stats 3 778sampling is enabled. 779.It Va persmax 780Maximum persistence interval, msec. 781.It Va persmin 782Minimum persistence interval, msec. 783.It Va pmtud_blackhole_detection 784Enable automatic path MTU blackhole detection. 785In case of retransmits of MSS sized segments, 786the OS will lower the MSS to check if it's an MTU problem. 787If the current MSS is greater than the configured value to try 788.Po Va net.inet.tcp.pmtud_blackhole_mss 789and 790.Va net.inet.tcp.v6pmtud_blackhole_mss 791.Pc , 792it will be set to this value, otherwise, 793the MSS will be set to the default values 794.Po Va net.inet.tcp.mssdflt 795and 796.Va net.inet.tcp.v6mssdflt 797.Pc . 798Settings: 799.Bl -tag -compact 800.It 0 801Disable path MTU blackhole detection. 802.It 1 803Enable path MTU blackhole detection for IPv4 and IPv6. 804.It 2 805Enable path MTU blackhole detection only for IPv4. 806.It 3 807Enable path MTU blackhole detection only for IPv6. 808.El 809.It Va pmtud_blackhole_mss 810MSS to try for IPv4 if PMTU blackhole detection is turned on. 811.It Va reass.cursegments 812The current total number of segments present in all reassembly queues. 813.It Va reass.maxqueuelen 814The maximum number of segments allowed in each reassembly queue. 815By default, the system chooses a limit based on each TCP connection's 816receive buffer size and maximum segment size (MSS). 817The actual limit applied to a session's reassembly queue will be the lower of 818the system-calculated automatic limit and the user-specified 819.Va reass.maxqueuelen 820limit. 821.It Va reass.maxsegments 822The maximum limit on the total number of segments across all reassembly 823queues. 824The limit can be adjusted as a tunable. 825.It Va recvbuf_auto 826Enable automatic receive buffer sizing as a connection progresses. 827.It Va recvbuf_max 828Maximum size of automatic receive buffer. 829.It Va recvspace 830Initial 831.Tn TCP 832receive window (buffer size). 833.It Va retries 834Maximum number of consecutive timer based retransmits sent after a data 835segment is lost (default and maximum is 12). 836.It Va rexmit_drop_options 837Drop TCP options from third and later retransmitted SYN segments 838of a connection. 839.It Va rexmit_initial , rexmit_min , rexmit_slop 840Adjust the retransmit timer calculation for 841.Tn TCP . 842The slop is 843typically added to the raw calculation to take into account 844occasional variances that the 845.Tn SRTT 846(smoothed round-trip time) 847is unable to accommodate, while the minimum specifies an 848absolute minimum. 849While a number of 850.Tn TCP 851RFCs suggest a 1 852second minimum, these RFCs tend to focus on streaming behavior, 853and fail to deal with the fact that a 1 second minimum has severe 854detrimental effects over lossy interactive connections, such 855as a 802.11b wireless link, and over very fast but lossy 856connections for those cases not covered by the fast retransmit 857code. 858For this reason, we use 200ms of slop and a near-0 859minimum, which gives us an effective minimum of 200ms (similar to 860.Tn Linux ) . 861The initial value is used before an RTT measurement has been performed. 862.It Va rfc1323 863Implement the window scaling and timestamp options of RFC 1323/RFC 7323 864(default is 1). 865Settings: 866.Bl -tag -compact 867.It 0 868Disable window scaling and timestamp option. 869.It 1 870Enable window scaling and timestamp option. 871.It 2 872Enable only window scaling. 873.It 3 874Enable only timestamp option. 875.El 876.It Va rfc3042 877Enable the Limited Transmit algorithm as described in RFC 3042. 878It helps avoid timeouts on lossy links and also when the congestion window 879is small, as happens on short transfers. 880.It Va rfc3390 881Enable support for RFC 3390, which allows for a variable-sized 882starting congestion window on new connections, depending on the 883maximum segment size. 884This helps throughput in general, but 885particularly affects short transfers and high-bandwidth large 886propagation-delay connections. 887.It Va rfc6675_pipe 888Deprecated and superseded by 889.Va sack.revised 890.It Va sack.enable 891Enable support for RFC 2018, TCP Selective Acknowledgment option, 892which allows the receiver to inform the sender about all successfully 893arrived segments, allowing the sender to retransmit the missing segments 894only. 895.It Va sack.globalholes 896Global number of TCP SACK holes currently allocated. 897.It Va sack.globalmaxholes 898Maximum number of SACK holes per system, across all connections. 899Defaults to 65536. 900.It Va sack.lrd 901Enable Lost Retransmission Detection for SACK-enabled sessions, enabled by 902default. 903Under severe congestion, a retransmission can be lost which then leads to a 904mandatory Retransmission Timeout (RTO), followed by slow-start. 905LRD will try to resend the repeatedly lost packet, preventing the time-consuming 906RTO and performance reducing slow-start or purge of the SACK scoreboard. 907.It Va sack.maxholes 908Maximum number of SACK holes per connection. 909Defaults to 128. 910.It Va sack.revised 911Enables three updated mechanisms from RFC6675 (default is true). 912Calculate the bytes in flight using the algorithm described in RFC 6675, and 913is also an improvement when Proportional Rate Reduction is enabled. 914Next, Rescue Retransmission helps timely loss recovery, when the trailing segments 915of a transmission are lost, while no additional data is ready to be sent. 916In case a partial ACK without a SACK block is received during SACK loss 917recovery, the trailing segment is immediately resent, rather than waiting 918for a Retransmission timeout. 919Finally, SACK loss recovery is also engaged, once two segments plus one byte are 920SACKed - even if no traditional duplicate ACKs were observed. 921.It Va sendbuf_auto 922Enable automatic send buffer sizing. 923.It Va sendbuf_auto_lowat 924Modify threshold for auto send buffer growth to account for 925.Dv SO_SNDLOWAT . 926.It Va sendbuf_inc 927Incrementor step size of automatic send buffer. 928.It Va sendbuf_max 929Maximum size of automatic send buffer. 930.It Va sendspace 931Initial 932.Tn TCP 933send window (buffer size). 934.It Va syncache 935Variables under the 936.Va net.inet.tcp.syncache 937node are documented in 938.Xr syncache 4 . 939.It Va syncookies 940Determines whether or not 941.Tn SYN 942cookies should be generated for outbound 943.Tn SYN-ACK 944packets. 945.Tn SYN 946cookies are a great help during 947.Tn SYN 948flood attacks, and are enabled by default. 949(See 950.Xr syncookies 4 . ) 951.It Va syncookies_only 952See 953.Xr syncookies 4 . 954.It Va tcbhashsize 955Size of the 956.Tn TCP 957control-block hash table 958(read-only). 959This is tuned using the kernel option 960.Dv TCBHASHSIZE 961or by setting 962.Va net.inet.tcp.tcbhashsize 963in the 964.Xr loader 8 . 965.It Va tolerate_missing_ts 966Tolerate the missing of timestamps (RFC 1323/RFC 7323) for 967.Tn TCP 968segments belonging to 969.Tn TCP 970connections for which support of 971.Tn TCP 972timestamps has been negotiated. 973As of June 2021, several TCP stacks are known to violate RFC 7323, including 974modern widely deployed ones. 975Therefore the default is 1, i.e., the missing of timestamps is tolerated. 976.It Va ts_offset_per_conn 977When initializing the TCP timestamps, use a per connection offset instead of a 978per host pair offset. 979Default is to use per connection offsets as recommended in RFC 7323. 980.It Va tso 981Enable TCP Segmentation Offload. 982.It Va udp_tunneling_overhead 983The overhead taken into account when using UDP encapsulation. 984Since MSS clamping by middleboxes will most likely not work, values larger than 9858 (the size of the UDP header) are also supported. 986Supported values are between 8 and 1024. 987The default is 8. 988.It Va udp_tunneling_port 989The local UDP encapsulation port. 990A value of 0 indicates that UDP encapsulation is disabled. 991The default is 0. 992.It Va v6mssdflt 993The default value used for the TCP Maximum Segment Size 994.Pq Dq MSS 995for IPv6 when no advice to the contrary is received from MSS negotiation. 996.It Va v6pmtud_blackhole_mss 997MSS to try for IPv6 if PMTU blackhole detection is turned on. 998See 999.Va pmtud_blackhole_detection . 1000.El 1001.Sh ERRORS 1002A socket operation may fail with one of the following errors returned: 1003.Bl -tag -width Er 1004.It Bq Er EISCONN 1005when trying to establish a connection on a socket which 1006already has one; 1007.It Bo Er ENOBUFS Bc or Bo Er ENOMEM Bc 1008when the system runs out of memory for 1009an internal data structure; 1010.It Bq Er ETIMEDOUT 1011when a connection was dropped 1012due to excessive retransmissions; 1013.It Bq Er ECONNRESET 1014when the remote peer 1015forces the connection to be closed; 1016.It Bq Er ECONNREFUSED 1017when the remote 1018peer actively refuses connection establishment (usually because 1019no process is listening to the port); 1020.It Bq Er EADDRINUSE 1021when an attempt 1022is made to create a socket with a port which has already been 1023allocated; 1024.It Bq Er EADDRNOTAVAIL 1025when an attempt is made to create a 1026socket with a network address for which no network interface 1027exists; 1028.It Bq Er EAFNOSUPPORT 1029when an attempt is made to bind or connect a socket to a multicast 1030address. 1031.It Bq Er EINVAL 1032when trying to change TCP function blocks at an invalid point in the session; 1033.It Bq Er ENOENT 1034when trying to use a TCP function block that is not available; 1035.El 1036.Sh SEE ALSO 1037.Xr getsockopt 2 , 1038.Xr socket 2 , 1039.Xr stats 3 , 1040.Xr sysctl 3 , 1041.Xr blackhole 4 , 1042.Xr inet 4 , 1043.Xr intro 4 , 1044.Xr ip 4 , 1045.Xr ktls 4 , 1046.Xr mod_cc 4 , 1047.Xr siftr 4 , 1048.Xr syncache 4 , 1049.Xr tcp_bbr 4 , 1050.Xr tcp_rack 4 , 1051.Xr setkey 8 , 1052.Xr sysctl 8 , 1053.Xr tcp_functions 9 1054.Rs 1055.%A "V. Jacobson" 1056.%A "B. Braden" 1057.%A "D. Borman" 1058.%T "TCP Extensions for High Performance" 1059.%O "RFC 1323" 1060.Re 1061.Rs 1062.%A "D. Borman" 1063.%A "B. Braden" 1064.%A "V. Jacobson" 1065.%A "R. Scheffenegger" 1066.%T "TCP Extensions for High Performance" 1067.%O "RFC 7323" 1068.Re 1069.Rs 1070.%A "A. Heffernan" 1071.%T "Protection of BGP Sessions via the TCP MD5 Signature Option" 1072.%O "RFC 2385" 1073.Re 1074.Rs 1075.%A "K. Ramakrishnan" 1076.%A "S. Floyd" 1077.%A "D. Black" 1078.%T "The Addition of Explicit Congestion Notification (ECN) to IP" 1079.%O "RFC 3168" 1080.Re 1081.Sh HISTORY 1082The 1083.Tn TCP 1084protocol appeared in 1085.Bx 4.2 . 1086The RFC 1323 extensions for window scaling and timestamps were added 1087in 1088.Bx 4.4 . 1089The 1090.Dv TCP_INFO 1091option was introduced in 1092.Tn Linux 2.6 1093and is 1094.Em subject to change . 1095