1.\" Copyright (c) 1983, 1991, 1993 2.\" The Regents of the University of California. 3.\" Copyright (c) 2010-2011 The FreeBSD Foundation 4.\" All rights reserved. 5.\" 6.\" Portions of this documentation were written at the Centre for Advanced 7.\" Internet Architectures, Swinburne University of Technology, Melbourne, 8.\" Australia by David Hayes under sponsorship from the FreeBSD Foundation. 9.\" 10.\" Redistribution and use in source and binary forms, with or without 11.\" modification, are permitted provided that the following conditions 12.\" are met: 13.\" 1. Redistributions of source code must retain the above copyright 14.\" notice, this list of conditions and the following disclaimer. 15.\" 2. Redistributions in binary form must reproduce the above copyright 16.\" notice, this list of conditions and the following disclaimer in the 17.\" documentation and/or other materials provided with the distribution. 18.\" 3. Neither the name of the University nor the names of its contributors 19.\" may be used to endorse or promote products derived from this software 20.\" without specific prior written permission. 21.\" 22.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 23.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 26.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32.\" SUCH DAMAGE. 33.\" 34.Dd November 30, 2023 35.Dt TCP 4 36.Os 37.Sh NAME 38.Nm tcp 39.Nd Internet Transmission Control Protocol 40.Sh SYNOPSIS 41.In sys/types.h 42.In sys/socket.h 43.In netinet/in.h 44.In netinet/tcp.h 45.Ft int 46.Fn socket AF_INET SOCK_STREAM 0 47.Sh DESCRIPTION 48The 49.Tn TCP 50protocol provides reliable, flow-controlled, two-way 51transmission of data. 52It is a byte-stream protocol used to 53support the 54.Dv SOCK_STREAM 55abstraction. 56.Tn TCP 57uses the standard 58Internet address format and, in addition, provides a per-host 59collection of 60.Dq "port addresses" . 61Thus, each address is composed 62of an Internet address specifying the host and network, 63with a specific 64.Tn TCP 65port on the host identifying the peer entity. 66.Pp 67Sockets utilizing the 68.Tn TCP 69protocol are either 70.Dq active 71or 72.Dq passive . 73Active sockets initiate connections to passive 74sockets. 75By default, 76.Tn TCP 77sockets are created active; to create a 78passive socket, the 79.Xr listen 2 80system call must be used 81after binding the socket with the 82.Xr bind 2 83system call. 84Only passive sockets may use the 85.Xr accept 2 86call to accept incoming connections. 87Only active sockets may use the 88.Xr connect 2 89call to initiate connections. 90.Pp 91Passive sockets may 92.Dq underspecify 93their location to match 94incoming connection requests from multiple networks. 95This technique, termed 96.Dq "wildcard addressing" , 97allows a single 98server to provide service to clients on multiple networks. 99To create a socket which listens on all networks, the Internet 100address 101.Dv INADDR_ANY 102must be bound. 103The 104.Tn TCP 105port may still be specified 106at this time; if the port is not specified, the system will assign one. 107Once a connection has been established, the socket's address is 108fixed by the peer entity's location. 109The address assigned to the 110socket is the address associated with the network interface 111through which packets are being transmitted and received. 112Normally, this address corresponds to the peer entity's network. 113.Pp 114.Tn TCP 115supports a number of socket options which can be set with 116.Xr setsockopt 2 117and tested with 118.Xr getsockopt 2 : 119.Bl -tag -width ".Dv TCP_FUNCTION_BLK" 120.It Dv TCP_INFO 121Information about a socket's underlying TCP session may be retrieved 122by passing the read-only option 123.Dv TCP_INFO 124to 125.Xr getsockopt 2 . 126It accepts a single argument: a pointer to an instance of 127.Vt "struct tcp_info" . 128.Pp 129This API is subject to change; consult the source to determine 130which fields are currently filled out by this option. 131.Fx 132specific additions include 133send window size, 134receive window size, 135and 136bandwidth-controlled window space. 137.It Dv TCP_CCALGOOPT 138Set or query congestion control algorithm specific parameters. 139See 140.Xr mod_cc 4 141for details. 142.It Dv TCP_CONGESTION 143Select or query the congestion control algorithm that TCP will use for the 144connection. 145See 146.Xr mod_cc 4 147for details. 148.It Dv TCP_FASTOPEN 149Enable or disable TCP Fast Open (TFO). 150To use this option, the kernel must be built with the 151.Dv TCP_RFC7413 152option. 153.Pp 154This option can be set on the socket either before or after the 155.Xr listen 2 156is invoked. 157Clearing this option on a listen socket after it has been set has no effect on 158existing TFO connections or TFO connections in progress; it only prevents new 159TFO connections from being established. 160.Pp 161For passively-created sockets, the 162.Dv TCP_FASTOPEN 163socket option can be queried to determine whether the connection was established 164using TFO. 165Note that connections that are established via a TFO 166.Tn SYN , 167but that fall back to using a non-TFO 168.Tn SYN|ACK 169will have the 170.Dv TCP_FASTOPEN 171socket option set. 172.Pp 173In addition to the facilities defined in RFC7413, this implementation supports a 174pre-shared key (PSK) mode of operation in which the TFO server requires the 175client to be in possession of a shared secret in order for the client to be able 176to successfully open TFO connections with the server. 177This is useful, for example, in environments where TFO servers are exposed to 178both internal and external clients and only wish to allow TFO connections from 179internal clients. 180.Pp 181In the PSK mode of operation, the server generates and sends TFO cookies to 182requesting clients as usual. 183However, when validating cookies received in TFO SYNs from clients, the server 184requires the client-supplied cookie to equal 185.Bd -literal -offset left 186SipHash24(key=\fI16-byte-psk\fP, msg=\fIcookie-sent-to-client\fP) 187.Ed 188.Pp 189Multiple concurrent valid pre-shared keys are supported so that time-based 190rolling PSK invalidation policies can be implemented in the system. 191The default number of concurrent pre-shared keys is 2. 192.Pp 193This can be adjusted with the 194.Dv TCP_RFC7413_MAX_PSKS 195kernel option. 196.It Dv TCP_FUNCTION_BLK 197Select or query the set of functions that TCP will use for this connection. 198This allows a user to select an alternate TCP stack. 199The alternate TCP stack must already be loaded in the kernel. 200To list the available TCP stacks, see 201.Va functions_available 202in the 203.Sx MIB (sysctl) Variables 204section further down. 205To list the default TCP stack, see 206.Va functions_default 207in the 208.Sx MIB (sysctl) Variables 209section. 210.It Dv TCP_KEEPINIT 211This 212.Xr setsockopt 2 213option accepts a per-socket timeout argument of 214.Vt "u_int" 215in seconds, for new, non-established 216.Tn TCP 217connections. 218For the global default in milliseconds see 219.Va keepinit 220in the 221.Sx MIB (sysctl) Variables 222section further down. 223.It Dv TCP_KEEPIDLE 224This 225.Xr setsockopt 2 226option accepts an argument of 227.Vt "u_int" 228for the amount of time, in seconds, that the connection must be idle 229before keepalive probes (if enabled) are sent for the connection of this 230socket. 231If set on a listening socket, the value is inherited by the newly created 232socket upon 233.Xr accept 2 . 234For the global default in milliseconds see 235.Va keepidle 236in the 237.Sx MIB (sysctl) Variables 238section further down. 239.It Dv TCP_KEEPINTVL 240This 241.Xr setsockopt 2 242option accepts an argument of 243.Vt "u_int" 244to set the per-socket interval, in seconds, between keepalive probes sent 245to a peer. 246If set on a listening socket, the value is inherited by the newly created 247socket upon 248.Xr accept 2 . 249For the global default in milliseconds see 250.Va keepintvl 251in the 252.Sx MIB (sysctl) Variables 253section further down. 254.It Dv TCP_KEEPCNT 255This 256.Xr setsockopt 2 257option accepts an argument of 258.Vt "u_int" 259and allows a per-socket tuning of the number of probes sent, with no response, 260before the connection will be dropped. 261If set on a listening socket, the value is inherited by the newly created 262socket upon 263.Xr accept 2 . 264For the global default see the 265.Va keepcnt 266in the 267.Sx MIB (sysctl) Variables 268section further down. 269.It Dv TCP_NODELAY 270Under most circumstances, 271.Tn TCP 272sends data when it is presented; 273when outstanding data has not yet been acknowledged, it gathers 274small amounts of output to be sent in a single packet once 275an acknowledgement is received. 276For a small number of clients, such as window systems 277that send a stream of mouse events which receive no replies, 278this packetization may cause significant delays. 279The boolean option 280.Dv TCP_NODELAY 281defeats this algorithm. 282 283.It Dv TCP_MAXSEG 284By default, a sender- and 285.No receiver- Ns Tn TCP 286will negotiate among themselves to determine the maximum segment size 287to be used for each connection. 288The 289.Dv TCP_MAXSEG 290option allows the user to determine the result of this negotiation, 291and to reduce it if desired. 292.It Dv TCP_MAXUNACKTIME 293This 294.Xr setsockopt 2 295option accepts an argument of 296.Vt "u_int" 297to set the per-socket interval, in seconds, in which the connection must 298make progress. Progress is defined by at least 1 byte being acknowledged within 299the set time period. If a connection fails to make progress, then the 300.Tn TCP 301stack will terminate the connection with a reset. Note that the default 302value for this is zero which indicates no progress checks should be made. 303.It Dv TCP_NOOPT 304.Tn TCP 305usually sends a number of options in each packet, corresponding to 306various 307.Tn TCP 308extensions which are provided in this implementation. 309The boolean option 310.Dv TCP_NOOPT 311is provided to disable 312.Tn TCP 313option use on a per-connection basis. 314.It Dv TCP_NOPUSH 315By convention, the 316.No sender- Ns Tn TCP 317will set the 318.Dq push 319bit, and begin transmission immediately (if permitted) at the end of 320every user call to 321.Xr write 2 322or 323.Xr writev 2 . 324When this option is set to a non-zero value, 325.Tn TCP 326will delay sending any data at all until either the socket is closed, 327or the internal send buffer is filled. 328.It Dv TCP_MD5SIG 329This option enables the use of MD5 digests (also known as TCP-MD5) 330on writes to the specified socket. 331Outgoing traffic is digested; 332digests on incoming traffic are verified. 333When this option is enabled on a socket, all inbound and outgoing 334TCP segments must be signed with MD5 digests. 335.Pp 336One common use for this in a 337.Fx 338router deployment is to enable 339based routers to interwork with Cisco equipment at peering points. 340Support for this feature conforms to RFC 2385. 341.Pp 342In order for this option to function correctly, it is necessary for the 343administrator to add a tcp-md5 key entry to the system's security 344associations database (SADB) using the 345.Xr setkey 8 346utility. 347This entry can only be specified on a per-host basis at this time. 348.Pp 349If an SADB entry cannot be found for the destination, 350the system does not send any outgoing segments and drops any inbound segments. 351However, during connection negotiation, a non-signed segment will be accepted if 352an SADB entry does not exist between hosts. 353When a non-signed segment is accepted, the established connection is not 354protected with MD5 digests. 355.It Dv TCP_STATS 356Manage collection of connection level statistics using the 357.Xr stats 3 358framework. 359.Pp 360Each dropped segment is taken into account in the TCP protocol statistics. 361.It Dv TCP_TXTLS_ENABLE 362Enable in-kernel Transport Layer Security (TLS) for data written to this 363socket. 364See 365.Xr ktls 4 366for more details. 367.It Dv TCP_TXTLS_MODE 368The integer argument can be used to get or set the current TLS transmit mode 369of a socket. 370See 371.Xr ktls 4 372for more details. 373.It Dv TCP_RXTLS_ENABLE 374Enable in-kernel TLS for data read from this socket. 375See 376.Xr ktls 4 377for more details. 378.It Dv TCP_REUSPORT_LB_NUMA 379Changes NUMA affinity filtering for an established TCP listen 380socket. 381This option takes a single integer argument which specifies 382the NUMA domain to filter on for this listen socket. 383The argument can also have the following special values: 384.Bl -tag -width "Dv TCP_REUSPORT_LB_NUMA" 385.It Dv TCP_REUSPORT_LB_NUMA_NODOM 386Remove NUMA filtering for this listen socket. 387.It Dv TCP_REUSPORT_LB_NUMA_CURDOM 388Filter traffic associated with the domain where the calling thread is 389currently executing. 390This is typically used after a process or thread inherits a listen 391socket from its parent, and sets its CPU affinity to a particular core. 392.El 393.It Dv TCP_REMOTE_UDP_ENCAPS_PORT 394Set and get the remote UDP encapsulation port. 395It can only be set on a closed TCP socket. 396.El 397.Pp 398The option level for the 399.Xr setsockopt 2 400call is the protocol number for 401.Tn TCP , 402available from 403.Xr getprotobyname 3 , 404or 405.Dv IPPROTO_TCP . 406All options are declared in 407.In netinet/tcp.h . 408.Pp 409Options at the 410.Tn IP 411transport level may be used with 412.Tn TCP ; 413see 414.Xr ip 4 . 415Incoming connection requests that are source-routed are noted, 416and the reverse source route is used in responding. 417.Pp 418The default congestion control algorithm for 419.Tn TCP 420is 421.Xr cc_newreno 4 . 422Other congestion control algorithms can be made available using the 423.Xr mod_cc 4 424framework. 425.Ss MIB (sysctl) Variables 426The 427.Tn TCP 428protocol implements a number of variables in the 429.Va net.inet.tcp 430branch of the 431.Xr sysctl 3 432MIB, which can also be read or modified with 433.Xr sysctl 8 . 434.Bl -tag -width ".Va v6pmtud_blackhole_mss" 435.It Va always_keepalive 436Assume that 437.Dv SO_KEEPALIVE 438is set on all 439.Tn TCP 440connections, the kernel will 441periodically send a packet to the remote host to verify the connection 442is still up. 443.It Va blackhole 444If enabled, disable sending of RST when a connection is attempted 445to a port where there is no socket accepting connections. 446See 447.Xr blackhole 4 . 448.It Va blackhole_local 449See 450.Xr blackhole 4 . 451.It Va cc 452A number of variables for congestion control are under the 453.Va net.inet.tcp.cc 454node. 455See 456.Xr mod_cc 4 . 457.It Va cc.newreno 458Variables for NewReno congestion control are under the 459.Va net.inet.tcp.cc.newreno 460node. 461See 462.Xr cc_newreno 4 . 463.It Va delacktime 464Maximum amount of time, in milliseconds, before a delayed ACK is sent. 465.It Va delayed_ack 466Delay ACK to try and piggyback it onto a data packet or another ACK. 467.It Va do_prr 468Perform SACK loss recovery using the Proportional Rate Reduction (PRR) algorithm 469described in RFC6937. 470This improves the effectiveness of retransmissions particular in environments 471with ACK thinning or burst loss events, as chances to run out of the ACK clock 472are reduced, preventing lengthy and performance reducing RTO based loss recovery 473(default is true). 474.It Va do_tcpdrain 475Flush packets in the 476.Tn TCP 477reassembly queue if the system is low on mbufs. 478.It Va drop_synfin 479Drop TCP packets with both SYN and FIN set. 480.It Va ecn.enable 481Enable support for TCP Explicit Congestion Notification (ECN). 482ECN allows a TCP sender to reduce the transmission rate in order to 483avoid packet drops. 484.Bl -tag -compact 485.It 0 486Disable ECN. 487.It 1 488Allow incoming connections to request ECN. 489Outgoing connections will request ECN. 490.It 2 491Allow incoming connections to request ECN. 492Outgoing connections will not request ECN. 493(default) 494.It 3 495Negotiate on incoming connection for Accurate ECN, ECN, or no ECN. 496Outgoing connections will request Accurate ECN and fall back to 497ECN depending on the capabilities of the server. 498.It 4 499Negotiate on incoming connection for Accurate ECN, ECN, or no ECN. 500Outgoing connections will not request ECN. 501.El 502.It Va ecn.maxretries 503Number of retries (SYN or SYN/ACK retransmits) before disabling ECN on a 504specific connection. 505This is needed to help with connection establishment 506when a broken firewall is in the network path. 507.It Va fast_finwait2_recycle 508Recycle 509.Tn TCP 510.Dv FIN_WAIT_2 511connections faster when the socket is marked as 512.Dv SBS_CANTRCVMORE 513(no user process has the socket open, data received on 514the socket cannot be read). 515The timeout used here is 516.Va finwait2_timeout . 517.It Va fastopen.acceptany 518When non-zero, all client-supplied TFO cookies will be considered to be valid. 519The default is 0. 520.It Va fastopen.autokey 521When this and 522.Va net.inet.tcp.fastopen.server_enable 523are non-zero, a new key will be automatically generated after this specified 524seconds. 525The default is 120. 526.It Va fastopen.ccache_bucket_limit 527The maximum number of entries in a client cookie cache bucket. 528The default value can be tuned with the 529.Dv TCP_FASTOPEN_CCACHE_BUCKET_LIMIT_DEFAULT 530kernel option or by setting 531.Va net.inet.tcp.fastopen_ccache_bucket_limit 532in the 533.Xr loader 8 . 534.It Va fastopen.ccache_buckets 535The number of client cookie cache buckets. 536Read-only. 537The value can be tuned with the 538.Dv TCP_FASTOPEN_CCACHE_BUCKETS_DEFAULT 539kernel option or by setting 540.Va fastopen.ccache_buckets 541in the 542.Xr loader 8 . 543.It Va fastopen.ccache_list 544Print the client cookie cache. 545Read-only. 546.It Va fastopen.client_enable 547When zero, no new active (i.e., client) TFO connections can be created. 548On the transition from enabled to disabled, the client cookie cache is cleared 549and disabled. 550The transition from enabled to disabled does not affect any active TFO 551connections in progress; it only prevents new ones from being established. 552The default is 0. 553.It Va fastopen.keylen 554The key length in bytes. 555Read-only. 556.It Va fastopen.maxkeys 557The maximum number of keys supported. 558Read-only, 559.It Va fastopen.maxpsks 560The maximum number of pre-shared keys supported. 561Read-only. 562.It Va fastopen.numkeys 563The current number of keys installed. 564Read-only. 565.It Va fastopen.numpsks 566The current number of pre-shared keys installed. 567Read-only. 568.It Va fastopen.path_disable_time 569When a failure occurs while trying to create a new active (i.e., client) TFO 570connection, new active connections on the same path, as determined by the tuple 571.Brq client_ip, server_ip, server_port , 572will be forced to be non-TFO for this many seconds. 573Note that the path disable mechanism relies on state stored in client cookie 574cache entries, so it is possible for the disable time for a given path to be 575reduced if the corresponding client cookie cache entry is reused due to resource 576pressure before the disable period has elapsed. 577The default is 578.Dv TCP_FASTOPEN_PATH_DISABLE_TIME_DEFAULT . 579.It Va fastopen.psk_enable 580When non-zero, pre-shared key (PSK) mode is enabled for all TFO servers. 581On the transition from enabled to disabled, all installed pre-shared keys are 582removed. 583The default is 0. 584.It Va fastopen.server_enable 585When zero, no new passive (i.e., server) TFO connections can be created. 586On the transition from enabled to disabled, all installed keys and pre-shared 587keys are removed. 588On the transition from disabled to enabled, if 589.Va fastopen.autokey 590is non-zero and there are no keys installed, a new key will be generated 591immediately. 592The transition from enabled to disabled does not affect any passive TFO 593connections in progress; it only prevents new ones from being established. 594The default is 0. 595.It Va fastopen.setkey 596Install a new key by writing 597.Va net.inet.tcp.fastopen.keylen 598bytes to this sysctl. 599.It Va fastopen.setpsk 600Install a new pre-shared key by writing 601.Va net.inet.tcp.fastopen.keylen 602bytes to this sysctl. 603.It Va finwait2_timeout 604Timeout to use for fast recycling of 605.Tn TCP 606.Dv FIN_WAIT_2 607connections 608.Pq Va fast_finwait2_recycle . 609Defaults to 60 seconds. 610.It Va functions_available 611List of available TCP function blocks (TCP stacks). 612.It Va functions_default 613The default TCP function block (TCP stack). 614.It Va functions_inherit_listen_socket_stack 615Determines whether to inherit listen socket's TCP stack or use the current 616system default TCP stack, as defined by 617.Va functions_default . 618Default is true. 619.It Va hostcache 620The TCP host cache is used to cache connection details and metrics to 621improve future performance of connections between the same hosts. 622At the completion of a TCP connection, a host will cache information 623for the connection for some defined period of time. 624There are a number of 625.Va hostcache 626variables under this node. 627See 628.Va hostcache.enable . 629.It Va hostcache.bucketlimit 630The maximum number of entries for the same hash. 631Defaults to 30. 632.It Va hostcache.cachelimit 633Overall entry limit for hostcache. 634Defaults to 635.Va hashsize 636* 637.Va bucketlimit . 638.It Va hostcache.count 639The current number of entries in the host cache. 640.It Va hostcache.enable 641Enable/disable the host cache: 642.Bl -tag -compact 643.It 0 644Disable the host cache. 645.It 1 646Enable the host cache. (default) 647.El 648.It Va hostcache.expire 649Time in seconds, how long a entry should be kept in the 650host cache since last accessed. 651Defaults to 3600 (1 hour). 652.It Va hostcache.hashsize 653Size of TCP hostcache hashtable. 654This number has to be a power of two, or will be rejected. 655Defaults to 512. 656.It Va hostcache.histo 657Provide a Histogram of the hostcache hash utilization. 658.It Va hostcache.list 659Provide a complete list of all current entries in the host 660cache. 661.It Va hostcache.prune 662Time in seconds between pruning expired host cache entries. 663Defaults to 300 (5 minutes). 664.It Va hostcache.purge 665Expire all entries on next pruning of host cache entries. 666Any non-zero setting will be reset to zero, once the purge 667is running. 668.Bl -tag -compact 669.It 0 670Do not purge all entries when pruning the host cache (default). 671.It 1 672Purge all entries when doing the next pruning. 673.It 2 674Purge all entries and also reseed the hash salt. 675.El 676.It Va hostcache.purgenow 677Immediately purge all entries once set to any value. 678Setting this to 2 will also reseed the hash salt. 679.It Va icmp_may_rst 680Certain 681.Tn ICMP 682unreachable messages may abort connections in 683.Tn SYN-SENT 684state. 685.It Va initcwnd_segments 686Enable the ability to specify initial congestion window in number of segments. 687The default value is 10 as suggested by RFC 6928. 688Changing the value on the fly would not affect connections 689using congestion window from the hostcache. 690Caution: 691This regulates the burst of packets allowed to be sent in the first RTT. 692The value should be relative to the link capacity. 693Start with small values for lower-capacity links. 694Large bursts can cause buffer overruns and packet drops if routers have small 695buffers or the link is experiencing congestion. 696.It Va insecure_rst 697Use criteria defined in RFC793 instead of RFC5961 for accepting RST segments. 698Default is false. 699.It Va insecure_syn 700Use criteria defined in RFC793 instead of RFC5961 for accepting SYN segments. 701Default is false. 702.It Va isn_reseed_interval 703The interval (in seconds) specifying how often the secret data used in 704RFC 1948 initial sequence number calculations should be reseeded. 705By default, this variable is set to zero, indicating that 706no reseeding will occur. 707Reseeding should not be necessary, and will break 708.Dv TIME_WAIT 709recycling for a few minutes. 710.It Va keepcnt 711Number of keepalive probes sent, with no response, before a connection 712is dropped. 713The default is 8 packets. 714.It Va keepidle 715Amount of time, in milliseconds, that the connection must be idle 716before sending keepalive probes (if enabled). 717The default is 7200000 msec (7.2M msec, 2 hours). 718.It Va keepinit 719Timeout, in milliseconds, for new, non-established 720.Tn TCP 721connections. 722The default is 75000 msec (75K msec, 75 sec). 723.It Va keepintvl 724The interval, in milliseconds, between keepalive probes sent to remote 725machines, when no response is received on a 726.Va keepidle 727probe. 728The default is 75000 msec (75K msec, 75 sec). 729.It Va log_in_vain 730Log any connection attempts to ports where there is no socket 731accepting connections. 732The value of 1 limits the logging to 733.Tn SYN 734(connection establishment) packets only. 735A value of 2 results in any 736.Tn TCP 737packets to closed ports being logged. 738Any value not listed above disables the logging 739(default is 0, i.e., the logging is disabled). 740.It Va minmss 741Minimum TCP Maximum Segment Size; used to prevent a denial of service attack 742from an unreasonably low MSS. 743.It Va msl 744The Maximum Segment Lifetime, in milliseconds, for a packet. 745.It Va mssdflt 746The default value used for the TCP Maximum Segment Size 747.Pq Dq MSS 748for IPv4 when no advice to the contrary is received from MSS negotiation. 749.It Va newcwd 750Enable the New Congestion Window Validation mechanism as described in RFC 7661. 751This gently reduces the congestion window during periods, where TCP is 752application limited and the network bandwidth is not utilized completely. 753That prevents self-inflicted packet losses once the application starts to 754transmit data at a higher speed. 755.It Va nolocaltimewait 756Suppress creation of TCP 757.Dv TIME_WAIT 758states for connections in 759which both endpoints are local. 760.It Va path_mtu_discovery 761Enable Path MTU Discovery. 762.It Va pcbcount 763Number of active protocol control blocks 764(read-only). 765.It Va perconn_stats_enable 766Controls the default collection of statistics for all connections using the 767.Xr stats 3 768framework. 7690 disables, 1 enables, 2 enables random sampling across log id connection 770groups with all connections in a group receiving the same setting. 771.It Va perconn_stats_sample_rates 772A CSV list of template_spec=percent key-value pairs which controls the per 773template sampling rates when 774.Xr stats 3 775sampling is enabled. 776.It Va persmax 777Maximum persistence interval, msec. 778.It Va persmin 779Minimum persistence interval, msec. 780.It Va pmtud_blackhole_detection 781Enable automatic path MTU blackhole detection. 782In case of retransmits of MSS sized segments, 783the OS will lower the MSS to check if it's an MTU problem. 784If the current MSS is greater than the configured value to try 785.Po Va net.inet.tcp.pmtud_blackhole_mss 786and 787.Va net.inet.tcp.v6pmtud_blackhole_mss 788.Pc , 789it will be set to this value, otherwise, 790the MSS will be set to the default values 791.Po Va net.inet.tcp.mssdflt 792and 793.Va net.inet.tcp.v6mssdflt 794.Pc . 795Settings: 796.Bl -tag -compact 797.It 0 798Disable path MTU blackhole detection. 799.It 1 800Enable path MTU blackhole detection for IPv4 and IPv6. 801.It 2 802Enable path MTU blackhole detection only for IPv4. 803.It 3 804Enable path MTU blackhole detection only for IPv6. 805.El 806.It Va pmtud_blackhole_mss 807MSS to try for IPv4 if PMTU blackhole detection is turned on. 808.It Va reass.cursegments 809The current total number of segments present in all reassembly queues. 810.It Va reass.maxqueuelen 811The maximum number of segments allowed in each reassembly queue. 812By default, the system chooses a limit based on each TCP connection's 813receive buffer size and maximum segment size (MSS). 814The actual limit applied to a session's reassembly queue will be the lower of 815the system-calculated automatic limit and the user-specified 816.Va reass.maxqueuelen 817limit. 818.It Va reass.maxsegments 819The maximum limit on the total number of segments across all reassembly 820queues. 821The limit can be adjusted as a tunable. 822.It Va recvbuf_auto 823Enable automatic receive buffer sizing as a connection progresses. 824.It Va recvbuf_max 825Maximum size of automatic receive buffer. 826.It Va recvspace 827Initial 828.Tn TCP 829receive window (buffer size). 830.It Va retries 831Maximum number of consecutive timer based retransmits sent after a data 832segment is lost (default and maximum is 12). 833.It Va rexmit_drop_options 834Drop TCP options from third and later retransmitted SYN segments 835of a connection. 836.It Va rexmit_initial , rexmit_min , rexmit_slop 837Adjust the retransmit timer calculation for 838.Tn TCP . 839The slop is 840typically added to the raw calculation to take into account 841occasional variances that the 842.Tn SRTT 843(smoothed round-trip time) 844is unable to accommodate, while the minimum specifies an 845absolute minimum. 846While a number of 847.Tn TCP 848RFCs suggest a 1 849second minimum, these RFCs tend to focus on streaming behavior, 850and fail to deal with the fact that a 1 second minimum has severe 851detrimental effects over lossy interactive connections, such 852as a 802.11b wireless link, and over very fast but lossy 853connections for those cases not covered by the fast retransmit 854code. 855For this reason, we use 200ms of slop and a near-0 856minimum, which gives us an effective minimum of 200ms (similar to 857.Tn Linux ) . 858The initial value is used before an RTT measurement has been performed. 859.It Va rfc1323 860Implement the window scaling and timestamp options of RFC 1323/RFC 7323 861(default is 1). 862Settings: 863.Bl -tag -compact 864.It 0 865Disable window scaling and timestamp option. 866.It 1 867Enable window scaling and timestamp option. 868.It 2 869Enable only window scaling. 870.It 3 871Enable only timestamp option. 872.El 873.It Va rfc3042 874Enable the Limited Transmit algorithm as described in RFC 3042. 875It helps avoid timeouts on lossy links and also when the congestion window 876is small, as happens on short transfers. 877.It Va rfc3390 878Enable support for RFC 3390, which allows for a variable-sized 879starting congestion window on new connections, depending on the 880maximum segment size. 881This helps throughput in general, but 882particularly affects short transfers and high-bandwidth large 883propagation-delay connections. 884.It Va rfc6675_pipe 885Deprecated and superseded by 886.Va sack.revised 887.It Va sack.enable 888Enable support for RFC 2018, TCP Selective Acknowledgment option, 889which allows the receiver to inform the sender about all successfully 890arrived segments, allowing the sender to retransmit the missing segments 891only. 892.It Va sack.globalholes 893Global number of TCP SACK holes currently allocated. 894.It Va sack.globalmaxholes 895Maximum number of SACK holes per system, across all connections. 896Defaults to 65536. 897.It Va sack.lrd 898Enable Lost Retransmission Detection for SACK-enabled sessions, enabled by 899default. 900Under severe congestion, a retransmission can be lost which then leads to a 901mandatory Retransmission Timeout (RTO), followed by slow-start. 902LRD will try to resend the repeatedly lost packet, preventing the time-consuming 903RTO and performance reducing slow-start or purge of the SACK scoreboard. 904.It Va sack.maxholes 905Maximum number of SACK holes per connection. 906Defaults to 128. 907.It Va sack.revised 908Enables three updated mechanisms from RFC6675 (default is true). 909Calculate the bytes in flight using the algorithm described in RFC 6675, and 910is also an improvement when Proportional Rate Reduction is enabled. 911Next, Rescue Retransmission helps timely loss recovery, when the trailing segments 912of a transmission are lost, while no additional data is ready to be sent. 913In case a partial ACK without a SACK block is received during SACK loss 914recovery, the trailing segment is immediately resent, rather than waiting 915for a Retransmission timeout. 916Finally, SACK loss recovery is also engaged, once two segments plus one byte are 917SACKed - even if no traditional duplicate ACKs were observed. 918.It Va sendbuf_auto 919Enable automatic send buffer sizing. 920.It Va sendbuf_auto_lowat 921Modify threshold for auto send buffer growth to account for 922.Dv SO_SNDLOWAT . 923.It Va sendbuf_inc 924Incrementor step size of automatic send buffer. 925.It Va sendbuf_max 926Maximum size of automatic send buffer. 927.It Va sendspace 928Initial 929.Tn TCP 930send window (buffer size). 931.It Va syncache 932Variables under the 933.Va net.inet.tcp.syncache 934node are documented in 935.Xr syncache 4 . 936.It Va syncookies 937Determines whether or not 938.Tn SYN 939cookies should be generated for outbound 940.Tn SYN-ACK 941packets. 942.Tn SYN 943cookies are a great help during 944.Tn SYN 945flood attacks, and are enabled by default. 946(See 947.Xr syncookies 4 . ) 948.It Va syncookies_only 949See 950.Xr syncookies 4 . 951.It Va tcbhashsize 952Size of the 953.Tn TCP 954control-block hash table 955(read-only). 956This is tuned using the kernel option 957.Dv TCBHASHSIZE 958or by setting 959.Va net.inet.tcp.tcbhashsize 960in the 961.Xr loader 8 . 962.It Va tolerate_missing_ts 963Tolerate the missing of timestamps (RFC 1323/RFC 7323) for 964.Tn TCP 965segments belonging to 966.Tn TCP 967connections for which support of 968.Tn TCP 969timestamps has been negotiated. 970As of June 2021, several TCP stacks are known to violate RFC 7323, including 971modern widely deployed ones. 972Therefore the default is 1, i.e., the missing of timestamps is tolerated. 973.It Va ts_offset_per_conn 974When initializing the TCP timestamps, use a per connection offset instead of a 975per host pair offset. 976Default is to use per connection offsets as recommended in RFC 7323. 977.It Va tso 978Enable TCP Segmentation Offload. 979.It Va udp_tunneling_overhead 980The overhead taken into account when using UDP encapsulation. 981Since MSS clamping by middleboxes will most likely not work, values larger than 9828 (the size of the UDP header) are also supported. 983Supported values are between 8 and 1024. 984The default is 8. 985.It Va udp_tunneling_port 986The local UDP encapsulation port. 987A value of 0 indicates that UDP encapsulation is disabled. 988The default is 0. 989.It Va v6mssdflt 990The default value used for the TCP Maximum Segment Size 991.Pq Dq MSS 992for IPv6 when no advice to the contrary is received from MSS negotiation. 993.It Va v6pmtud_blackhole_mss 994MSS to try for IPv6 if PMTU blackhole detection is turned on. 995See 996.Va pmtud_blackhole_detection . 997.El 998.Sh ERRORS 999A socket operation may fail with one of the following errors returned: 1000.Bl -tag -width Er 1001.It Bq Er EISCONN 1002when trying to establish a connection on a socket which 1003already has one; 1004.It Bo Er ENOBUFS Bc or Bo Er ENOMEM Bc 1005when the system runs out of memory for 1006an internal data structure; 1007.It Bq Er ETIMEDOUT 1008when a connection was dropped 1009due to excessive retransmissions; 1010.It Bq Er ECONNRESET 1011when the remote peer 1012forces the connection to be closed; 1013.It Bq Er ECONNREFUSED 1014when the remote 1015peer actively refuses connection establishment (usually because 1016no process is listening to the port); 1017.It Bq Er EADDRINUSE 1018when an attempt 1019is made to create a socket with a port which has already been 1020allocated; 1021.It Bq Er EADDRNOTAVAIL 1022when an attempt is made to create a 1023socket with a network address for which no network interface 1024exists; 1025.It Bq Er EAFNOSUPPORT 1026when an attempt is made to bind or connect a socket to a multicast 1027address. 1028.It Bq Er EINVAL 1029when trying to change TCP function blocks at an invalid point in the session; 1030.It Bq Er ENOENT 1031when trying to use a TCP function block that is not available; 1032.El 1033.Sh SEE ALSO 1034.Xr getsockopt 2 , 1035.Xr socket 2 , 1036.Xr stats 3 , 1037.Xr sysctl 3 , 1038.Xr blackhole 4 , 1039.Xr inet 4 , 1040.Xr intro 4 , 1041.Xr ip 4 , 1042.Xr ktls 4 , 1043.Xr mod_cc 4 , 1044.Xr siftr 4 , 1045.Xr syncache 4 , 1046.Xr tcp_bbr 4 , 1047.Xr tcp_rack 4 , 1048.Xr setkey 8 , 1049.Xr sysctl 8 , 1050.Xr tcp_functions 9 1051.Rs 1052.%A "V. Jacobson" 1053.%A "B. Braden" 1054.%A "D. Borman" 1055.%T "TCP Extensions for High Performance" 1056.%O "RFC 1323" 1057.Re 1058.Rs 1059.%A "D. Borman" 1060.%A "B. Braden" 1061.%A "V. Jacobson" 1062.%A "R. Scheffenegger" 1063.%T "TCP Extensions for High Performance" 1064.%O "RFC 7323" 1065.Re 1066.Rs 1067.%A "A. Heffernan" 1068.%T "Protection of BGP Sessions via the TCP MD5 Signature Option" 1069.%O "RFC 2385" 1070.Re 1071.Rs 1072.%A "K. Ramakrishnan" 1073.%A "S. Floyd" 1074.%A "D. Black" 1075.%T "The Addition of Explicit Congestion Notification (ECN) to IP" 1076.%O "RFC 3168" 1077.Re 1078.Sh HISTORY 1079The 1080.Tn TCP 1081protocol appeared in 1082.Bx 4.2 . 1083The RFC 1323 extensions for window scaling and timestamps were added 1084in 1085.Bx 4.4 . 1086The 1087.Dv TCP_INFO 1088option was introduced in 1089.Tn Linux 2.6 1090and is 1091.Em subject to change . 1092