xref: /freebsd/share/man/man4/tcp.4 (revision 637e4ef1a6bcd8677dabd8c08916df3091be5f64)
1.\" Copyright (c) 1983, 1991, 1993
2.\"	The Regents of the University of California.
3.\" Copyright (c) 2010-2011 The FreeBSD Foundation
4.\" All rights reserved.
5.\"
6.\" Portions of this documentation were written at the Centre for Advanced
7.\" Internet Architectures, Swinburne University of Technology, Melbourne,
8.\" Australia by David Hayes under sponsorship from the FreeBSD Foundation.
9.\"
10.\" Redistribution and use in source and binary forms, with or without
11.\" modification, are permitted provided that the following conditions
12.\" are met:
13.\" 1. Redistributions of source code must retain the above copyright
14.\"    notice, this list of conditions and the following disclaimer.
15.\" 2. Redistributions in binary form must reproduce the above copyright
16.\"    notice, this list of conditions and the following disclaimer in the
17.\"    documentation and/or other materials provided with the distribution.
18.\" 3. Neither the name of the University nor the names of its contributors
19.\"    may be used to endorse or promote products derived from this software
20.\"    without specific prior written permission.
21.\"
22.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32.\" SUCH DAMAGE.
33.\"
34.\"     From: @(#)tcp.4	8.1 (Berkeley) 6/5/93
35.\"
36.Dd November 17, 2023
37.Dt TCP 4
38.Os
39.Sh NAME
40.Nm tcp
41.Nd Internet Transmission Control Protocol
42.Sh SYNOPSIS
43.In sys/types.h
44.In sys/socket.h
45.In netinet/in.h
46.In netinet/tcp.h
47.Ft int
48.Fn socket AF_INET SOCK_STREAM 0
49.Sh DESCRIPTION
50The
51.Tn TCP
52protocol provides reliable, flow-controlled, two-way
53transmission of data.
54It is a byte-stream protocol used to
55support the
56.Dv SOCK_STREAM
57abstraction.
58.Tn TCP
59uses the standard
60Internet address format and, in addition, provides a per-host
61collection of
62.Dq "port addresses" .
63Thus, each address is composed
64of an Internet address specifying the host and network,
65with a specific
66.Tn TCP
67port on the host identifying the peer entity.
68.Pp
69Sockets utilizing the
70.Tn TCP
71protocol are either
72.Dq active
73or
74.Dq passive .
75Active sockets initiate connections to passive
76sockets.
77By default,
78.Tn TCP
79sockets are created active; to create a
80passive socket, the
81.Xr listen 2
82system call must be used
83after binding the socket with the
84.Xr bind 2
85system call.
86Only passive sockets may use the
87.Xr accept 2
88call to accept incoming connections.
89Only active sockets may use the
90.Xr connect 2
91call to initiate connections.
92.Pp
93Passive sockets may
94.Dq underspecify
95their location to match
96incoming connection requests from multiple networks.
97This technique, termed
98.Dq "wildcard addressing" ,
99allows a single
100server to provide service to clients on multiple networks.
101To create a socket which listens on all networks, the Internet
102address
103.Dv INADDR_ANY
104must be bound.
105The
106.Tn TCP
107port may still be specified
108at this time; if the port is not specified, the system will assign one.
109Once a connection has been established, the socket's address is
110fixed by the peer entity's location.
111The address assigned to the
112socket is the address associated with the network interface
113through which packets are being transmitted and received.
114Normally, this address corresponds to the peer entity's network.
115.Pp
116.Tn TCP
117supports a number of socket options which can be set with
118.Xr setsockopt 2
119and tested with
120.Xr getsockopt 2 :
121.Bl -tag -width ".Dv TCP_FUNCTION_BLK"
122.It Dv TCP_INFO
123Information about a socket's underlying TCP session may be retrieved
124by passing the read-only option
125.Dv TCP_INFO
126to
127.Xr getsockopt 2 .
128It accepts a single argument: a pointer to an instance of
129.Vt "struct tcp_info" .
130.Pp
131This API is subject to change; consult the source to determine
132which fields are currently filled out by this option.
133.Fx
134specific additions include
135send window size,
136receive window size,
137and
138bandwidth-controlled window space.
139.It Dv TCP_CCALGOOPT
140Set or query congestion control algorithm specific parameters.
141See
142.Xr mod_cc 4
143for details.
144.It Dv TCP_CONGESTION
145Select or query the congestion control algorithm that TCP will use for the
146connection.
147See
148.Xr mod_cc 4
149for details.
150.It Dv TCP_FASTOPEN
151Enable or disable TCP Fast Open (TFO).
152To use this option, the kernel must be built with the
153.Dv TCP_RFC7413
154option.
155.Pp
156This option can be set on the socket either before or after the
157.Xr listen 2
158is invoked.
159Clearing this option on a listen socket after it has been set has no effect on
160existing TFO connections or TFO connections in progress; it only prevents new
161TFO connections from being established.
162.Pp
163For passively-created sockets, the
164.Dv TCP_FASTOPEN
165socket option can be queried to determine whether the connection was established
166using TFO.
167Note that connections that are established via a TFO
168.Tn SYN ,
169but that fall back to using a non-TFO
170.Tn SYN|ACK
171will have the
172.Dv TCP_FASTOPEN
173socket option set.
174.Pp
175In addition to the facilities defined in RFC7413, this implementation supports a
176pre-shared key (PSK) mode of operation in which the TFO server requires the
177client to be in posession of a shared secret in order for the client to be able
178to successfully open TFO connections with the server.
179This is useful, for example, in environments where TFO servers are exposed to
180both internal and external clients and only wish to allow TFO connections from
181internal clients.
182.Pp
183In the PSK mode of operation, the server generates and sends TFO cookies to
184requesting clients as usual.
185However, when validating cookies received in TFO SYNs from clients, the server
186requires the client-supplied cookie to equal
187.Bd -literal -offset left
188SipHash24(key=\fI16-byte-psk\fP, msg=\fIcookie-sent-to-client\fP)
189.Ed
190.Pp
191Multiple concurrent valid pre-shared keys are supported so that time-based
192rolling PSK invalidation policies can be implemented in the system.
193The default number of concurrent pre-shared keys is 2.
194.Pp
195This can be adjusted with the
196.Dv TCP_RFC7413_MAX_PSKS
197kernel option.
198.It Dv TCP_FUNCTION_BLK
199Select or query the set of functions that TCP will use for this connection.
200This allows a user to select an alternate TCP stack.
201The alternate TCP stack must already be loaded in the kernel.
202To list the available TCP stacks, see
203.Va functions_available
204in the
205.Sx MIB (sysctl) Variables
206section further down.
207To list the default TCP stack, see
208.Va functions_default
209in the
210.Sx MIB (sysctl) Variables
211section.
212.It Dv TCP_KEEPINIT
213This
214.Xr setsockopt 2
215option accepts a per-socket timeout argument of
216.Vt "u_int"
217in seconds, for new, non-established
218.Tn TCP
219connections.
220For the global default in milliseconds see
221.Va keepinit
222in the
223.Sx MIB (sysctl) Variables
224section further down.
225.It Dv TCP_KEEPIDLE
226This
227.Xr setsockopt 2
228option accepts an argument of
229.Vt "u_int"
230for the amount of time, in seconds, that the connection must be idle
231before keepalive probes (if enabled) are sent for the connection of this
232socket.
233If set on a listening socket, the value is inherited by the newly created
234socket upon
235.Xr accept 2 .
236For the global default in milliseconds see
237.Va keepidle
238in the
239.Sx MIB (sysctl) Variables
240section further down.
241.It Dv TCP_KEEPINTVL
242This
243.Xr setsockopt 2
244option accepts an argument of
245.Vt "u_int"
246to set the per-socket interval, in seconds, between keepalive probes sent
247to a peer.
248If set on a listening socket, the value is inherited by the newly created
249socket upon
250.Xr accept 2 .
251For the global default in milliseconds see
252.Va keepintvl
253in the
254.Sx MIB (sysctl) Variables
255section further down.
256.It Dv TCP_KEEPCNT
257This
258.Xr setsockopt 2
259option accepts an argument of
260.Vt "u_int"
261and allows a per-socket tuning of the number of probes sent, with no response,
262before the connection will be dropped.
263If set on a listening socket, the value is inherited by the newly created
264socket upon
265.Xr accept 2 .
266For the global default see the
267.Va keepcnt
268in the
269.Sx MIB (sysctl) Variables
270section further down.
271.It Dv TCP_NODELAY
272Under most circumstances,
273.Tn TCP
274sends data when it is presented;
275when outstanding data has not yet been acknowledged, it gathers
276small amounts of output to be sent in a single packet once
277an acknowledgement is received.
278For a small number of clients, such as window systems
279that send a stream of mouse events which receive no replies,
280this packetization may cause significant delays.
281The boolean option
282.Dv TCP_NODELAY
283defeats this algorithm.
284
285.It Dv TCP_MAXSEG
286By default, a sender- and
287.No receiver- Ns Tn TCP
288will negotiate among themselves to determine the maximum segment size
289to be used for each connection.
290The
291.Dv TCP_MAXSEG
292option allows the user to determine the result of this negotiation,
293and to reduce it if desired.
294.It Dv TCP_MAXUNACKTIME
295This
296.Xr setsockopt 2
297option accepts an argument of
298.Vt "u_int"
299to set the per-socket interval, in seconds, in which the connection must
300make progress. Progress is defined by at least 1 byte being acknowledged within
301the set time period. If a connection fails to make progress, then the
302.Tn TCP
303stack will terminate the connection with a reset. Note that the default
304value for this is zero which indicates no progress checks should be made.
305.It Dv TCP_NOOPT
306.Tn TCP
307usually sends a number of options in each packet, corresponding to
308various
309.Tn TCP
310extensions which are provided in this implementation.
311The boolean option
312.Dv TCP_NOOPT
313is provided to disable
314.Tn TCP
315option use on a per-connection basis.
316.It Dv TCP_NOPUSH
317By convention, the
318.No sender- Ns Tn TCP
319will set the
320.Dq push
321bit, and begin transmission immediately (if permitted) at the end of
322every user call to
323.Xr write 2
324or
325.Xr writev 2 .
326When this option is set to a non-zero value,
327.Tn TCP
328will delay sending any data at all until either the socket is closed,
329or the internal send buffer is filled.
330.It Dv TCP_MD5SIG
331This option enables the use of MD5 digests (also known as TCP-MD5)
332on writes to the specified socket.
333Outgoing traffic is digested;
334digests on incoming traffic are verified.
335When this option is enabled on a socket, all inbound and outgoing
336TCP segments must be signed with MD5 digests.
337.Pp
338One common use for this in a
339.Fx
340router deployment is to enable
341based routers to interwork with Cisco equipment at peering points.
342Support for this feature conforms to RFC 2385.
343.Pp
344In order for this option to function correctly, it is necessary for the
345administrator to add a tcp-md5 key entry to the system's security
346associations database (SADB) using the
347.Xr setkey 8
348utility.
349This entry can only be specified on a per-host basis at this time.
350.Pp
351If an SADB entry cannot be found for the destination,
352the system does not send any outgoing segments and drops any inbound segments.
353However, during connection negotiation, a non-signed segment will be accepted if
354an SADB entry does not exist between hosts.
355When a non-signed segment is accepted, the established connection is not
356protected with MD5 digests.
357.It Dv TCP_STATS
358Manage collection of connection level statistics using the
359.Xr stats 3
360framework.
361.Pp
362Each dropped segment is taken into account in the TCP protocol statistics.
363.It Dv TCP_TXTLS_ENABLE
364Enable in-kernel Transport Layer Security (TLS) for data written to this
365socket.
366See
367.Xr ktls 4
368for more details.
369.It Dv TCP_TXTLS_MODE
370The integer argument can be used to get or set the current TLS transmit mode
371of a socket.
372See
373.Xr ktls 4
374for more details.
375.It Dv TCP_RXTLS_ENABLE
376Enable in-kernel TLS for data read from this socket.
377See
378.Xr ktls 4
379for more details.
380.It Dv TCP_REUSPORT_LB_NUMA
381Changes NUMA affinity filtering for an established TCP listen
382socket.
383This option takes a single integer argument which specifies
384the NUMA domain to filter on for this listen socket.
385The argument can also have the follwing special values:
386.Bl -tag -width "Dv TCP_REUSPORT_LB_NUMA"
387.It Dv TCP_REUSPORT_LB_NUMA_NODOM
388Remove NUMA filtering for this listen socket.
389.It Dv TCP_REUSPORT_LB_NUMA_CURDOM
390Filter traffic associated with the domain where the calling thread is
391currently executing.
392This is typically used after a process or thread inherits a listen
393socket from its parent, and sets its CPU affinity to a particular core.
394.El
395.It Dv TCP_REMOTE_UDP_ENCAPS_PORT
396Set and get the remote UDP encapsulation port.
397It can only be set on a closed TCP socket.
398.El
399.Pp
400The option level for the
401.Xr setsockopt 2
402call is the protocol number for
403.Tn TCP ,
404available from
405.Xr getprotobyname 3 ,
406or
407.Dv IPPROTO_TCP .
408All options are declared in
409.In netinet/tcp.h .
410.Pp
411Options at the
412.Tn IP
413transport level may be used with
414.Tn TCP ;
415see
416.Xr ip 4 .
417Incoming connection requests that are source-routed are noted,
418and the reverse source route is used in responding.
419.Pp
420The default congestion control algorithm for
421.Tn TCP
422is
423.Xr cc_newreno 4 .
424Other congestion control algorithms can be made available using the
425.Xr mod_cc 4
426framework.
427.Ss MIB (sysctl) Variables
428The
429.Tn TCP
430protocol implements a number of variables in the
431.Va net.inet.tcp
432branch of the
433.Xr sysctl 3
434MIB, which can also be read or modified with
435.Xr sysctl 8 .
436.Bl -tag -width ".Va v6pmtud_blackhole_mss"
437.It Va always_keepalive
438Assume that
439.Dv SO_KEEPALIVE
440is set on all
441.Tn TCP
442connections, the kernel will
443periodically send a packet to the remote host to verify the connection
444is still up.
445.It Va blackhole
446If enabled, disable sending of RST when a connection is attempted
447to a port where there is no socket accepting connections.
448See
449.Xr blackhole 4 .
450.It Va blackhole_local
451See
452.Xr blackhole 4 .
453.It Va cc
454A number of variables for congestion control are under the
455.Va net.inet.tcp.cc
456node.
457See
458.Xr mod_cc 4 .
459.It Va cc.newreno
460Variables for NewReno congestion control are under the
461.Va net.inet.tcp.cc.newreno
462node.
463See
464.Xr cc_newreno 4 .
465.It Va delacktime
466Maximum amount of time, in milliseconds, before a delayed ACK is sent.
467.It Va delayed_ack
468Delay ACK to try and piggyback it onto a data packet or another ACK.
469.It Va do_lrd
470Enable Lost Retransmission Detection for SACK-enabled sessions, disabled by
471default.
472Under severe congestion, a retransmission can be lost which then leads to a
473mandatory Retransmission Timeout (RTO), followed by slow-start.
474LRD will try to resend the repeatedly lost packet, preventing the time-consuming
475RTO and performance reducing slow-start.
476.It Va do_prr
477Perform SACK loss recovery using the Proportional Rate Reduction (PRR) algorithm
478described in RFC6937.
479This improves the effectiveness of retransmissions particular in environments
480with ACK thinning or burst loss events, as chances to run out of the ACK clock
481are reduced, preventing lengthy and performance reducing RTO based loss recovery
482(default is true).
483.It Va do_tcpdrain
484Flush packets in the
485.Tn TCP
486reassembly queue if the system is low on mbufs.
487.It Va drop_synfin
488Drop TCP packets with both SYN and FIN set.
489.It Va ecn.enable
490Enable support for TCP Explicit Congestion Notification (ECN).
491ECN allows a TCP sender to reduce the transmission rate in order to
492avoid packet drops.
493.Bl -tag -compact
494.It 0
495Disable ECN.
496.It 1
497Allow incoming connections to request ECN.
498Outgoing connections will request ECN.
499.It 2
500Allow incoming connections to request ECN.
501Outgoing connections will not request ECN.
502(default)
503.It 3
504Negotiate on incoming connection for Accurate ECN, ECN, or no ECN.
505Outgoing connections will request Accurate ECN and fall back to
506ECN depending on the capabilities of the server.
507.It 4
508Negotiate on incoming connection for Accurate ECN, ECN, or no ECN.
509Outgoing connections will not request ECN.
510.El
511.It Va ecn.maxretries
512Number of retries (SYN or SYN/ACK retransmits) before disabling ECN on a
513specific connection.
514This is needed to help with connection establishment
515when a broken firewall is in the network path.
516.It Va fast_finwait2_recycle
517Recycle
518.Tn TCP
519.Dv FIN_WAIT_2
520connections faster when the socket is marked as
521.Dv SBS_CANTRCVMORE
522(no user process has the socket open, data received on
523the socket cannot be read).
524The timeout used here is
525.Va finwait2_timeout .
526.It Va fastopen.acceptany
527When non-zero, all client-supplied TFO cookies will be considered to be valid.
528The default is 0.
529.It Va fastopen.autokey
530When this and
531.Va net.inet.tcp.fastopen.server_enable
532are non-zero, a new key will be automatically generated after this specified
533seconds.
534The default is 120.
535.It Va fastopen.ccache_bucket_limit
536The maximum number of entries in a client cookie cache bucket.
537The default value can be tuned with the
538.Dv TCP_FASTOPEN_CCACHE_BUCKET_LIMIT_DEFAULT
539kernel option or by setting
540.Va net.inet.tcp.fastopen_ccache_bucket_limit
541in the
542.Xr loader 8 .
543.It Va fastopen.ccache_buckets
544The number of client cookie cache buckets.
545Read-only.
546The value can be tuned with the
547.Dv TCP_FASTOPEN_CCACHE_BUCKETS_DEFAULT
548kernel option or by setting
549.Va fastopen.ccache_buckets
550in the
551.Xr loader 8 .
552.It Va fastopen.ccache_list
553Print the client cookie cache.
554Read-only.
555.It Va fastopen.client_enable
556When zero, no new active (i.e., client) TFO connections can be created.
557On the transition from enabled to disabled, the client cookie cache is cleared
558and disabled.
559The transition from enabled to disabled does not affect any active TFO
560connections in progress; it only prevents new ones from being established.
561The default is 0.
562.It Va fastopen.keylen
563The key length in bytes.
564Read-only.
565.It Va fastopen.maxkeys
566The maximum number of keys supported.
567Read-only,
568.It Va fastopen.maxpsks
569The maximum number of pre-shared keys supported.
570Read-only.
571.It Va fastopen.numkeys
572The current number of keys installed.
573Read-only.
574.It Va fastopen.numpsks
575The current number of pre-shared keys installed.
576Read-only.
577.It Va fastopen.path_disable_time
578When a failure occurs while trying to create a new active (i.e., client) TFO
579connection, new active connections on the same path, as determined by the tuple
580.Brq client_ip, server_ip, server_port ,
581will be forced to be non-TFO for this many seconds.
582Note that the path disable mechanism relies on state stored in client cookie
583cache entries, so it is possible for the disable time for a given path to be
584reduced if the corresponding client cookie cache entry is reused due to resource
585pressure before the disable period has elapsed.
586The default is
587.Dv TCP_FASTOPEN_PATH_DISABLE_TIME_DEFAULT .
588.It Va fastopen.psk_enable
589When non-zero, pre-shared key (PSK) mode is enabled for all TFO servers.
590On the transition from enabled to disabled, all installed pre-shared keys are
591removed.
592The default is 0.
593.It Va fastopen.server_enable
594When zero, no new passive (i.e., server) TFO connections can be created.
595On the transition from enabled to disabled, all installed keys and pre-shared
596keys are removed.
597On the transition from disabled to enabled, if
598.Va fastopen.autokey
599is non-zero and there are no keys installed, a new key will be generated
600immediately.
601The transition from enabled to disabled does not affect any passive TFO
602connections in progress; it only prevents new ones from being established.
603The default is 0.
604.It Va fastopen.setkey
605Install a new key by writing
606.Va net.inet.tcp.fastopen.keylen
607bytes to this sysctl.
608.It Va fastopen.setpsk
609Install a new pre-shared key by writing
610.Va net.inet.tcp.fastopen.keylen
611bytes to this sysctl.
612.It Va finwait2_timeout
613Timeout to use for fast recycling of
614.Tn TCP
615.Dv FIN_WAIT_2
616connections
617.Pq Va fast_finwait2_recycle .
618Defaults to 60 seconds.
619.It Va functions_available
620List of available TCP function blocks (TCP stacks).
621.It Va functions_default
622The default TCP function block (TCP stack).
623.It Va functions_inherit_listen_socket_stack
624Determines whether to inherit listen socket's TCP stack or use the current
625system default TCP stack, as defined by
626.Va functions_default .
627Default is true.
628.It Va hostcache
629The TCP host cache is used to cache connection details and metrics to
630improve future performance of connections between the same hosts.
631At the completion of a TCP connection, a host will cache information
632for the connection for some defined period of time.
633There are a number of
634.Va hostcache
635variables under this node.
636See
637.Va hostcache.enable .
638.It Va hostcache.bucketlimit
639The maximum number of entries for the same hash.
640Defaults to 30.
641.It Va hostcache.cachelimit
642Overall entry limit for hostcache.
643Defaults to
644.Va hashsize
645*
646.Va bucketlimit .
647.It Va hostcache.count
648The current number of entries in the host cache.
649.It Va hostcache.enable
650Enable/disable the host cache:
651.Bl -tag -compact
652.It 0
653Disable the host cache.
654.It 1
655Enable the host cache. (default)
656.El
657.It Va hostcache.expire
658Time in seconds, how long a entry should be kept in the
659host cache since last accessed.
660Defaults to 3600 (1 hour).
661.It Va hostcache.hashsize
662Size of TCP hostcache hashtable.
663This number has to be a power of two, or will be rejected.
664Defaults to 512.
665.It Va hostcache.histo
666Provide a Histogram of the hostcache hash utilization.
667.It Va hostcache.list
668Provide a complete list of all current entries in the host
669cache.
670.It Va hostcache.prune
671Time in seconds between pruning expired host cache entries.
672Defaults to 300 (5 minutes).
673.It Va hostcache.purge
674Expire all entires on next pruning of host cache entries.
675Any non-zero setting will be reset to zero, once the purge
676is running.
677.Bl -tag -compact
678.It 0
679Do not purge all entries when pruning the host cache (default).
680.It 1
681Purge all entries when doing the next pruning.
682.It 2
683Purge all entries and also reseed the hash salt.
684.El
685.It Va hostcache.purgenow
686Immediately purge all entries once set to any value.
687Setting this to 2 will also reseed the hash salt.
688.It Va icmp_may_rst
689Certain
690.Tn ICMP
691unreachable messages may abort connections in
692.Tn SYN-SENT
693state.
694.It Va initcwnd_segments
695Enable the ability to specify initial congestion window in number of segments.
696The default value is 10 as suggested by RFC 6928.
697Changing the value on the fly would not affect connections
698using congestion window from the hostcache.
699Caution:
700This regulates the burst of packets allowed to be sent in the first RTT.
701The value should be relative to the link capacity.
702Start with small values for lower-capacity links.
703Large bursts can cause buffer overruns and packet drops if routers have small
704buffers or the link is experiencing congestion.
705.It Va insecure_rst
706Use criteria defined in RFC793 instead of RFC5961 for accepting RST segments.
707Default is false.
708.It Va insecure_syn
709Use criteria defined in RFC793 instead of RFC5961 for accepting SYN segments.
710Default is false.
711.It Va isn_reseed_interval
712The interval (in seconds) specifying how often the secret data used in
713RFC 1948 initial sequence number calculations should be reseeded.
714By default, this variable is set to zero, indicating that
715no reseeding will occur.
716Reseeding should not be necessary, and will break
717.Dv TIME_WAIT
718recycling for a few minutes.
719.It Va keepcnt
720Number of keepalive probes sent, with no response, before a connection
721is dropped.
722The default is 8 packets.
723.It Va keepidle
724Amount of time, in milliseconds, that the connection must be idle
725before sending keepalive probes (if enabled).
726The default is 7200000 msec (7.2M msec, 2 hours).
727.It Va keepinit
728Timeout, in milliseconds, for new, non-established
729.Tn TCP
730connections.
731The default is 75000 msec (75K msec, 75 sec).
732.It Va keepintvl
733The interval, in milliseconds, between keepalive probes sent to remote
734machines, when no response is received on a
735.Va keepidle
736probe.
737The default is 75000 msec (75K msec, 75 sec).
738.It Va log_in_vain
739Log any connection attempts to ports where there is no socket
740accepting connections.
741The value of 1 limits the logging to
742.Tn SYN
743(connection establishment) packets only.
744A value of 2 results in any
745.Tn TCP
746packets to closed ports being logged.
747Any value not listed above disables the logging
748(default is 0, i.e., the logging is disabled).
749.It Va minmss
750Minimum TCP Maximum Segment Size; used to prevent a denial of service attack
751from an unreasonably low MSS.
752.It Va msl
753The Maximum Segment Lifetime, in milliseconds, for a packet.
754.It Va mssdflt
755The default value used for the TCP Maximum Segment Size
756.Pq Dq MSS
757for IPv4 when no advice to the contrary is received from MSS negotiation.
758.It Va newcwd
759Enable the New Congestion Window Validation mechanism as described in RFC 7661.
760This gently reduces the congestion window during periods, where TCP is
761application limited and the network bandwidth is not utilized completely.
762That prevents self-inflicted packet losses once the application starts to
763transmit data at a higher speed.
764.It Va nolocaltimewait
765Suppress creation of TCP
766.Dv TIME_WAIT
767states for connections in
768which both endpoints are local.
769.It Va path_mtu_discovery
770Enable Path MTU Discovery.
771.It Va pcbcount
772Number of active protocol control blocks
773(read-only).
774.It Va perconn_stats_enable
775Controls the default collection of statistics for all connections using the
776.Xr stats 3
777framework.
7780 disables, 1 enables, 2 enables random sampling across log id connection
779groups with all connections in a group receiving the same setting.
780.It Va perconn_stats_sample_rates
781A CSV list of template_spec=percent key-value pairs which controls the per
782template sampling rates when
783.Xr stats 3
784sampling is enabled.
785.It Va persmax
786Maximum persistence interval, msec.
787.It Va persmin
788Minimum persistence interval, msec.
789.It Va pmtud_blackhole_detection
790Enable automatic path MTU blackhole detection.
791In case of retransmits of MSS sized segments,
792the OS will lower the MSS to check if it's an MTU problem.
793If the current MSS is greater than the configured value to try
794.Po Va net.inet.tcp.pmtud_blackhole_mss
795and
796.Va net.inet.tcp.v6pmtud_blackhole_mss
797.Pc ,
798it will be set to this value, otherwise,
799the MSS will be set to the default values
800.Po Va net.inet.tcp.mssdflt
801and
802.Va net.inet.tcp.v6mssdflt
803.Pc .
804Settings:
805.Bl -tag -compact
806.It 0
807Disable path MTU blackhole detection.
808.It 1
809Enable path MTU blackhole detection for IPv4 and IPv6.
810.It 2
811Enable path MTU blackhole detection only for IPv4.
812.It 3
813Enable path MTU blackhole detection only for IPv6.
814.El
815.It Va pmtud_blackhole_mss
816MSS to try for IPv4 if PMTU blackhole detection is turned on.
817.It Va reass.cursegments
818The current total number of segments present in all reassembly queues.
819.It Va reass.maxqueuelen
820The maximum number of segments allowed in each reassembly queue.
821By default, the system chooses a limit based on each TCP connection's
822receive buffer size and maximum segment size (MSS).
823The actual limit applied to a session's reassembly queue will be the lower of
824the system-calculated automatic limit and the user-specified
825.Va reass.maxqueuelen
826limit.
827.It Va reass.maxsegments
828The maximum limit on the total number of segments across all reassembly
829queues.
830The limit can be adjusted as a tunable.
831.It Va recvbuf_auto
832Enable automatic receive buffer sizing as a connection progresses.
833.It Va recvbuf_max
834Maximum size of automatic receive buffer.
835.It Va recvspace
836Initial
837.Tn TCP
838receive window (buffer size).
839.It Va retries
840Maximum number of consecutive timer based retransmits sent after a data
841segment is lost (default and maximum is 12).
842.It Va rexmit_drop_options
843Drop TCP options from third and later retransmitted SYN segments
844of a connection.
845.It Va rexmit_initial , rexmit_min , rexmit_slop
846Adjust the retransmit timer calculation for
847.Tn TCP .
848The slop is
849typically added to the raw calculation to take into account
850occasional variances that the
851.Tn SRTT
852(smoothed round-trip time)
853is unable to accommodate, while the minimum specifies an
854absolute minimum.
855While a number of
856.Tn TCP
857RFCs suggest a 1
858second minimum, these RFCs tend to focus on streaming behavior,
859and fail to deal with the fact that a 1 second minimum has severe
860detrimental effects over lossy interactive connections, such
861as a 802.11b wireless link, and over very fast but lossy
862connections for those cases not covered by the fast retransmit
863code.
864For this reason, we use 200ms of slop and a near-0
865minimum, which gives us an effective minimum of 200ms (similar to
866.Tn Linux ) .
867The initial value is used before an RTT measurement has been performed.
868.It Va rfc1323
869Implement the window scaling and timestamp options of RFC 1323/RFC 7323
870(default is 1).
871Settings:
872.Bl -tag -compact
873.It 0
874Disable window scaling and timestamp option.
875.It 1
876Enable window scaling and timestamp option.
877.It 2
878Enable only window scaling.
879.It 3
880Enable only timestamp option.
881.El
882.It Va rfc3042
883Enable the Limited Transmit algorithm as described in RFC 3042.
884It helps avoid timeouts on lossy links and also when the congestion window
885is small, as happens on short transfers.
886.It Va rfc3390
887Enable support for RFC 3390, which allows for a variable-sized
888starting congestion window on new connections, depending on the
889maximum segment size.
890This helps throughput in general, but
891particularly affects short transfers and high-bandwidth large
892propagation-delay connections.
893.It Va rfc6675_pipe
894Deprecated and superseded by
895.Va sack.revised
896.It Va sack.enable
897Enable support for RFC 2018, TCP Selective Acknowledgment option,
898which allows the receiver to inform the sender about all successfully
899arrived segments, allowing the sender to retransmit the missing segments
900only.
901.It Va sack.globalholes
902Global number of TCP SACK holes currently allocated.
903.It Va sack.globalmaxholes
904Maximum number of SACK holes per system, across all connections.
905Defaults to 65536.
906.It Va sack.maxholes
907Maximum number of SACK holes per connection.
908Defaults to 128.
909.It Va sack.revised
910Enables three updated mechanisms from RFC6675 (default is true).
911Calculate the bytes in flight using the algorithm described in RFC 6675, and
912is also an improvement when Proportional Rate Reduction is enabled.
913Next, Rescue Retransmission helps timely loss recovery, when the trailing segments
914of a transmission are lost, while no additional data is ready to be sent.
915In case a partial ACK without a SACK block is received during SACK loss
916recovery, the trailing segment is immediately resent, rather than waiting
917for a Retransmission timeout.
918Finally, SACK loss recovery is also engaged, once two segments plus one byte are
919SACKed - even if no traditional duplicate ACKs were observed.
920.It Va sendbuf_auto
921Enable automatic send buffer sizing.
922.It Va sendbuf_auto_lowat
923Modify threshold for auto send buffer growth to account for
924.Dv SO_SNDLOWAT .
925.It Va sendbuf_inc
926Incrementor step size of automatic send buffer.
927.It Va sendbuf_max
928Maximum size of automatic send buffer.
929.It Va sendspace
930Initial
931.Tn TCP
932send window (buffer size).
933.It Va syncache
934Variables under the
935.Va net.inet.tcp.syncache
936node are documented in
937.Xr syncache 4 .
938.It Va syncookies
939Determines whether or not
940.Tn SYN
941cookies should be generated for outbound
942.Tn SYN-ACK
943packets.
944.Tn SYN
945cookies are a great help during
946.Tn SYN
947flood attacks, and are enabled by default.
948(See
949.Xr syncookies 4 . )
950.It Va syncookies_only
951See
952.Xr syncookies 4 .
953.It Va tcbhashsize
954Size of the
955.Tn TCP
956control-block hash table
957(read-only).
958This is tuned using the kernel option
959.Dv TCBHASHSIZE
960or by setting
961.Va net.inet.tcp.tcbhashsize
962in the
963.Xr loader 8 .
964.It Va tolerate_missing_ts
965Tolerate the missing of timestamps (RFC 1323/RFC 7323) for
966.Tn TCP
967segments belonging to
968.Tn TCP
969connections for which support of
970.Tn TCP
971timestamps has been negotiated.
972As of June 2021, several TCP stacks are known to violate RFC 7323, including
973modern widely deployed ones.
974Therefore the default is 1, i.e., the missing of timestamps is tolerated.
975.It Va ts_offset_per_conn
976When initializing the TCP timestamps, use a per connection offset instead of a
977per host pair offset.
978Default is to use per connection offsets as recommended in RFC 7323.
979.It Va tso
980Enable TCP Segmentation Offload.
981.It Va udp_tunneling_overhead
982The overhead taken into account when using UDP encapsulation.
983Since MSS clamping by middleboxes will most likely not work, values larger than
9848 (the size of the UDP header) are also supported.
985Supported values are between 8 and 1024.
986The default is 8.
987.It Va udp_tunneling_port
988The local UDP encapsulation port.
989A value of 0 indicates that UDP encapsulation is disabled.
990The default is 0.
991.It Va v6mssdflt
992The default value used for the TCP Maximum Segment Size
993.Pq Dq MSS
994for IPv6 when no advice to the contrary is received from MSS negotiation.
995.It Va v6pmtud_blackhole_mss
996MSS to try for IPv6 if PMTU blackhole detection is turned on.
997See
998.Va pmtud_blackhole_detection .
999.El
1000.Sh ERRORS
1001A socket operation may fail with one of the following errors returned:
1002.Bl -tag -width Er
1003.It Bq Er EISCONN
1004when trying to establish a connection on a socket which
1005already has one;
1006.It Bo Er ENOBUFS Bc or Bo Er ENOMEM Bc
1007when the system runs out of memory for
1008an internal data structure;
1009.It Bq Er ETIMEDOUT
1010when a connection was dropped
1011due to excessive retransmissions;
1012.It Bq Er ECONNRESET
1013when the remote peer
1014forces the connection to be closed;
1015.It Bq Er ECONNREFUSED
1016when the remote
1017peer actively refuses connection establishment (usually because
1018no process is listening to the port);
1019.It Bq Er EADDRINUSE
1020when an attempt
1021is made to create a socket with a port which has already been
1022allocated;
1023.It Bq Er EADDRNOTAVAIL
1024when an attempt is made to create a
1025socket with a network address for which no network interface
1026exists;
1027.It Bq Er EAFNOSUPPORT
1028when an attempt is made to bind or connect a socket to a multicast
1029address.
1030.It Bq Er EINVAL
1031when trying to change TCP function blocks at an invalid point in the session;
1032.It Bq Er ENOENT
1033when trying to use a TCP function block that is not available;
1034.El
1035.Sh SEE ALSO
1036.Xr getsockopt 2 ,
1037.Xr socket 2 ,
1038.Xr stats 3 ,
1039.Xr sysctl 3 ,
1040.Xr blackhole 4 ,
1041.Xr inet 4 ,
1042.Xr intro 4 ,
1043.Xr ip 4 ,
1044.Xr ktls 4 ,
1045.Xr mod_cc 4 ,
1046.Xr siftr 4 ,
1047.Xr syncache 4 ,
1048.Xr tcp_bbr 4 ,
1049.Xr tcp_rack 4 ,
1050.Xr setkey 8 ,
1051.Xr sysctl 8 ,
1052.Xr tcp_functions 9
1053.Rs
1054.%A "V. Jacobson"
1055.%A "B. Braden"
1056.%A "D. Borman"
1057.%T "TCP Extensions for High Performance"
1058.%O "RFC 1323"
1059.Re
1060.Rs
1061.%A "D. Borman"
1062.%A "B. Braden"
1063.%A "V. Jacobson"
1064.%A "R. Scheffenegger"
1065.%T "TCP Extensions for High Performance"
1066.%O "RFC 7323"
1067.Re
1068.Rs
1069.%A "A. Heffernan"
1070.%T "Protection of BGP Sessions via the TCP MD5 Signature Option"
1071.%O "RFC 2385"
1072.Re
1073.Rs
1074.%A "K. Ramakrishnan"
1075.%A "S. Floyd"
1076.%A "D. Black"
1077.%T "The Addition of Explicit Congestion Notification (ECN) to IP"
1078.%O "RFC 3168"
1079.Re
1080.Sh HISTORY
1081The
1082.Tn TCP
1083protocol appeared in
1084.Bx 4.2 .
1085The RFC 1323 extensions for window scaling and timestamps were added
1086in
1087.Bx 4.4 .
1088The
1089.Dv TCP_INFO
1090option was introduced in
1091.Tn Linux 2.6
1092and is
1093.Em subject to change .
1094