1.\" Copyright (c) 1983, 1991, 1993 2.\" The Regents of the University of California. 3.\" Copyright (c) 2010-2011 The FreeBSD Foundation 4.\" All rights reserved. 5.\" 6.\" Portions of this documentation were written at the Centre for Advanced 7.\" Internet Architectures, Swinburne University of Technology, Melbourne, 8.\" Australia by David Hayes under sponsorship from the FreeBSD Foundation. 9.\" 10.\" Redistribution and use in source and binary forms, with or without 11.\" modification, are permitted provided that the following conditions 12.\" are met: 13.\" 1. Redistributions of source code must retain the above copyright 14.\" notice, this list of conditions and the following disclaimer. 15.\" 2. Redistributions in binary form must reproduce the above copyright 16.\" notice, this list of conditions and the following disclaimer in the 17.\" documentation and/or other materials provided with the distribution. 18.\" 3. Neither the name of the University nor the names of its contributors 19.\" may be used to endorse or promote products derived from this software 20.\" without specific prior written permission. 21.\" 22.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 23.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 26.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32.\" SUCH DAMAGE. 33.\" 34.\" From: @(#)tcp.4 8.1 (Berkeley) 6/5/93 35.\" $FreeBSD$ 36.\" 37.Dd August 1, 2022 38.Dt TCP 4 39.Os 40.Sh NAME 41.Nm tcp 42.Nd Internet Transmission Control Protocol 43.Sh SYNOPSIS 44.In sys/types.h 45.In sys/socket.h 46.In netinet/in.h 47.In netinet/tcp.h 48.Ft int 49.Fn socket AF_INET SOCK_STREAM 0 50.Sh DESCRIPTION 51The 52.Tn TCP 53protocol provides reliable, flow-controlled, two-way 54transmission of data. 55It is a byte-stream protocol used to 56support the 57.Dv SOCK_STREAM 58abstraction. 59.Tn TCP 60uses the standard 61Internet address format and, in addition, provides a per-host 62collection of 63.Dq "port addresses" . 64Thus, each address is composed 65of an Internet address specifying the host and network, 66with a specific 67.Tn TCP 68port on the host identifying the peer entity. 69.Pp 70Sockets utilizing the 71.Tn TCP 72protocol are either 73.Dq active 74or 75.Dq passive . 76Active sockets initiate connections to passive 77sockets. 78By default, 79.Tn TCP 80sockets are created active; to create a 81passive socket, the 82.Xr listen 2 83system call must be used 84after binding the socket with the 85.Xr bind 2 86system call. 87Only passive sockets may use the 88.Xr accept 2 89call to accept incoming connections. 90Only active sockets may use the 91.Xr connect 2 92call to initiate connections. 93.Pp 94Passive sockets may 95.Dq underspecify 96their location to match 97incoming connection requests from multiple networks. 98This technique, termed 99.Dq "wildcard addressing" , 100allows a single 101server to provide service to clients on multiple networks. 102To create a socket which listens on all networks, the Internet 103address 104.Dv INADDR_ANY 105must be bound. 106The 107.Tn TCP 108port may still be specified 109at this time; if the port is not specified, the system will assign one. 110Once a connection has been established, the socket's address is 111fixed by the peer entity's location. 112The address assigned to the 113socket is the address associated with the network interface 114through which packets are being transmitted and received. 115Normally, this address corresponds to the peer entity's network. 116.Pp 117.Tn TCP 118supports a number of socket options which can be set with 119.Xr setsockopt 2 120and tested with 121.Xr getsockopt 2 : 122.Bl -tag -width ".Dv TCP_FUNCTION_BLK" 123.It Dv TCP_INFO 124Information about a socket's underlying TCP session may be retrieved 125by passing the read-only option 126.Dv TCP_INFO 127to 128.Xr getsockopt 2 . 129It accepts a single argument: a pointer to an instance of 130.Vt "struct tcp_info" . 131.Pp 132This API is subject to change; consult the source to determine 133which fields are currently filled out by this option. 134.Fx 135specific additions include 136send window size, 137receive window size, 138and 139bandwidth-controlled window space. 140.It Dv TCP_CCALGOOPT 141Set or query congestion control algorithm specific parameters. 142See 143.Xr mod_cc 4 144for details. 145.It Dv TCP_CONGESTION 146Select or query the congestion control algorithm that TCP will use for the 147connection. 148See 149.Xr mod_cc 4 150for details. 151.It Dv TCP_FASTOPEN 152Enable or disable TCP Fast Open (TFO). 153To use this option, the kernel must be built with the 154.Dv TCP_RFC7413 155option. 156.Pp 157This option can be set on the socket either before or after the 158.Xr listen 2 159is invoked. 160Clearing this option on a listen socket after it has been set has no effect on 161existing TFO connections or TFO connections in progress; it only prevents new 162TFO connections from being established. 163.Pp 164For passively-created sockets, the 165.Dv TCP_FASTOPEN 166socket option can be queried to determine whether the connection was established 167using TFO. 168Note that connections that are established via a TFO 169.Tn SYN , 170but that fall back to using a non-TFO 171.Tn SYN|ACK 172will have the 173.Dv TCP_FASTOPEN 174socket option set. 175.Pp 176In addition to the facilities defined in RFC7413, this implementation supports a 177pre-shared key (PSK) mode of operation in which the TFO server requires the 178client to be in posession of a shared secret in order for the client to be able 179to successfully open TFO connections with the server. 180This is useful, for example, in environments where TFO servers are exposed to 181both internal and external clients and only wish to allow TFO connections from 182internal clients. 183.Pp 184In the PSK mode of operation, the server generates and sends TFO cookies to 185requesting clients as usual. 186However, when validating cookies received in TFO SYNs from clients, the server 187requires the client-supplied cookie to equal 188.Bd -literal -offset left 189SipHash24(key=\fI16-byte-psk\fP, msg=\fIcookie-sent-to-client\fP) 190.Ed 191.Pp 192Multiple concurrent valid pre-shared keys are supported so that time-based 193rolling PSK invalidation policies can be implemented in the system. 194The default number of concurrent pre-shared keys is 2. 195.Pp 196This can be adjusted with the 197.Dv TCP_RFC7413_MAX_PSKS 198kernel option. 199.It Dv TCP_FUNCTION_BLK 200Select or query the set of functions that TCP will use for this connection. 201This allows a user to select an alternate TCP stack. 202The alternate TCP stack must already be loaded in the kernel. 203To list the available TCP stacks, see 204.Va functions_available 205in the 206.Sx MIB (sysctl) Variables 207section further down. 208To list the default TCP stack, see 209.Va functions_default 210in the 211.Sx MIB (sysctl) Variables 212section. 213.It Dv TCP_KEEPINIT 214This 215.Xr setsockopt 2 216option accepts a per-socket timeout argument of 217.Vt "u_int" 218in seconds, for new, non-established 219.Tn TCP 220connections. 221For the global default in milliseconds see 222.Va keepinit 223in the 224.Sx MIB (sysctl) Variables 225section further down. 226.It Dv TCP_KEEPIDLE 227This 228.Xr setsockopt 2 229option accepts an argument of 230.Vt "u_int" 231for the amount of time, in seconds, that the connection must be idle 232before keepalive probes (if enabled) are sent for the connection of this 233socket. 234If set on a listening socket, the value is inherited by the newly created 235socket upon 236.Xr accept 2 . 237For the global default in milliseconds see 238.Va keepidle 239in the 240.Sx MIB (sysctl) Variables 241section further down. 242.It Dv TCP_KEEPINTVL 243This 244.Xr setsockopt 2 245option accepts an argument of 246.Vt "u_int" 247to set the per-socket interval, in seconds, between keepalive probes sent 248to a peer. 249If set on a listening socket, the value is inherited by the newly created 250socket upon 251.Xr accept 2 . 252For the global default in milliseconds see 253.Va keepintvl 254in the 255.Sx MIB (sysctl) Variables 256section further down. 257.It Dv TCP_KEEPCNT 258This 259.Xr setsockopt 2 260option accepts an argument of 261.Vt "u_int" 262and allows a per-socket tuning of the number of probes sent, with no response, 263before the connection will be dropped. 264If set on a listening socket, the value is inherited by the newly created 265socket upon 266.Xr accept 2 . 267For the global default see the 268.Va keepcnt 269in the 270.Sx MIB (sysctl) Variables 271section further down. 272.It Dv TCP_NODELAY 273Under most circumstances, 274.Tn TCP 275sends data when it is presented; 276when outstanding data has not yet been acknowledged, it gathers 277small amounts of output to be sent in a single packet once 278an acknowledgement is received. 279For a small number of clients, such as window systems 280that send a stream of mouse events which receive no replies, 281this packetization may cause significant delays. 282The boolean option 283.Dv TCP_NODELAY 284defeats this algorithm. 285.It Dv TCP_MAXSEG 286By default, a sender- and 287.No receiver- Ns Tn TCP 288will negotiate among themselves to determine the maximum segment size 289to be used for each connection. 290The 291.Dv TCP_MAXSEG 292option allows the user to determine the result of this negotiation, 293and to reduce it if desired. 294.It Dv TCP_NOOPT 295.Tn TCP 296usually sends a number of options in each packet, corresponding to 297various 298.Tn TCP 299extensions which are provided in this implementation. 300The boolean option 301.Dv TCP_NOOPT 302is provided to disable 303.Tn TCP 304option use on a per-connection basis. 305.It Dv TCP_NOPUSH 306By convention, the 307.No sender- Ns Tn TCP 308will set the 309.Dq push 310bit, and begin transmission immediately (if permitted) at the end of 311every user call to 312.Xr write 2 313or 314.Xr writev 2 . 315When this option is set to a non-zero value, 316.Tn TCP 317will delay sending any data at all until either the socket is closed, 318or the internal send buffer is filled. 319.It Dv TCP_MD5SIG 320This option enables the use of MD5 digests (also known as TCP-MD5) 321on writes to the specified socket. 322Outgoing traffic is digested; 323digests on incoming traffic are verified. 324When this option is enabled on a socket, all inbound and outgoing 325TCP segments must be signed with MD5 digests. 326.Pp 327One common use for this in a 328.Fx 329router deployment is to enable 330based routers to interwork with Cisco equipment at peering points. 331Support for this feature conforms to RFC 2385. 332.Pp 333In order for this option to function correctly, it is necessary for the 334administrator to add a tcp-md5 key entry to the system's security 335associations database (SADB) using the 336.Xr setkey 8 337utility. 338This entry can only be specified on a per-host basis at this time. 339.Pp 340If an SADB entry cannot be found for the destination, 341the system does not send any outgoing segments and drops any inbound segments. 342However, during connection negotiation, a non-signed segment will be accepted if 343an SADB entry does not exist between hosts. 344When a non-signed segment is accepted, the established connection is not 345protected with MD5 digests. 346.It Dv TCP_STATS 347Manage collection of connection level statistics using the 348.Xr stats 3 349framework. 350.Pp 351Each dropped segment is taken into account in the TCP protocol statistics. 352.It Dv TCP_TXTLS_ENABLE 353Enable in-kernel Transport Layer Security (TLS) for data written to this 354socket. 355See 356.Xr ktls 4 357for more details. 358.It Dv TCP_TXTLS_MODE 359The integer argument can be used to get or set the current TLS transmit mode 360of a socket. 361See 362.Xr ktls 4 363for more details. 364.It Dv TCP_RXTLS_ENABLE 365Enable in-kernel TLS for data read from this socket. 366See 367.Xr ktls 4 368for more details. 369.It Dv TCP_REUSPORT_LB_NUMA 370Changes NUMA affinity filtering for an established TCP listen 371socket. 372This option takes a single integer argument which specifies 373the NUMA domain to filter on for this listen socket. 374The argument can also have the follwing special values: 375.Bl -tag -width "Dv TCP_REUSPORT_LB_NUMA" 376.It Dv TCP_REUSPORT_LB_NUMA_NODOM 377Remove NUMA filtering for this listen socket. 378.It Dv TCP_REUSPORT_LB_NUMA_CURDOM 379Filter traffic associated with the domain where the calling thread is 380currently executing. 381This is typically used after a process or thread inherits a listen 382socket from its parent, and sets its CPU affinity to a particular core. 383.El 384.It Dv TCP_REMOTE_UDP_ENCAPS_PORT 385Set and get the remote UDP encapsulation port. 386It can only be set on a closed TCP socket. 387.El 388.Pp 389The option level for the 390.Xr setsockopt 2 391call is the protocol number for 392.Tn TCP , 393available from 394.Xr getprotobyname 3 , 395or 396.Dv IPPROTO_TCP . 397All options are declared in 398.In netinet/tcp.h . 399.Pp 400Options at the 401.Tn IP 402transport level may be used with 403.Tn TCP ; 404see 405.Xr ip 4 . 406Incoming connection requests that are source-routed are noted, 407and the reverse source route is used in responding. 408.Pp 409The default congestion control algorithm for 410.Tn TCP 411is 412.Xr cc_newreno 4 . 413Other congestion control algorithms can be made available using the 414.Xr mod_cc 4 415framework. 416.Ss MIB (sysctl) Variables 417The 418.Tn TCP 419protocol implements a number of variables in the 420.Va net.inet.tcp 421branch of the 422.Xr sysctl 3 423MIB, which can also be read or modified with 424.Xr sysctl 8 . 425.Bl -tag -width ".Va v6pmtud_blackhole_mss" 426.It Va always_keepalive 427Assume that 428.Dv SO_KEEPALIVE 429is set on all 430.Tn TCP 431connections, the kernel will 432periodically send a packet to the remote host to verify the connection 433is still up. 434.It Va blackhole 435If enabled, disable sending of RST when a connection is attempted 436to a port where there is no socket accepting connections. 437See 438.Xr blackhole 4 . 439.It Va blackhole_local 440See 441.Xr blackhole 4 . 442.It Va cc 443A number of variables for congestion control are under the 444.Va net.inet.tcp.cc 445node. 446See 447.Xr mod_cc 4 . 448.It Va cc.newreno 449Variables for NewReno congestion control are under the 450.Va net.inet.tcp.cc.newreno 451node. 452See 453.Xr cc_newreno 4 . 454.It Va delacktime 455Maximum amount of time, in milliseconds, before a delayed ACK is sent. 456.It Va delayed_ack 457Delay ACK to try and piggyback it onto a data packet or another ACK. 458.It Va do_lrd 459Enable Lost Retransmission Detection for SACK-enabled sessions, disabled by 460default. 461Under severe congestion, a retransmission can be lost which then leads to a 462mandatory Retransmission Timeout (RTO), followed by slow-start. 463LRD will try to resend the repeatedly lost packet, preventing the time-consuming 464RTO and performance reducing slow-start. 465.It Va do_prr 466Perform SACK loss recovery using the Proportional Rate Reduction (PRR) algorithm 467described in RFC6937. 468This improves the effectiveness of retransmissions particular in environments 469with ACK thinning or burst loss events, as chances to run out of the ACK clock 470are reduced, preventing lengthy and performance reducing RTO based loss recovery 471(default is true). 472.It Va do_prr_conservative 473While doing Proportional Rate Reduction, remain strictly in a packet conserving 474mode, sending only one new packet for each ACK received. 475Helpful when a misconfigured token bucket traffic policer causes persistent 476high losses leading to RTO, but reduces PRR effectiveness in more common settings 477(default is false). 478.It Va do_tcpdrain 479Flush packets in the 480.Tn TCP 481reassembly queue if the system is low on mbufs. 482.It Va drop_synfin 483Drop TCP packets with both SYN and FIN set. 484.It Va ecn.enable 485Enable support for TCP Explicit Congestion Notification (ECN). 486ECN allows a TCP sender to reduce the transmission rate in order to 487avoid packet drops. 488.Bl -tag -compact 489.It 0 490Disable ECN. 491.It 1 492Allow incoming connections to request ECN. 493Outgoing connections will request ECN. 494.It 2 495Allow incoming connections to request ECN. 496Outgoing connections will not request ECN. 497(default) 498.El 499.It Va ecn.maxretries 500Number of retries (SYN or SYN/ACK retransmits) before disabling ECN on a 501specific connection. 502This is needed to help with connection establishment 503when a broken firewall is in the network path. 504.It Va fast_finwait2_recycle 505Recycle 506.Tn TCP 507.Dv FIN_WAIT_2 508connections faster when the socket is marked as 509.Dv SBS_CANTRCVMORE 510(no user process has the socket open, data received on 511the socket cannot be read). 512The timeout used here is 513.Va finwait2_timeout . 514.It Va fastopen.acceptany 515When non-zero, all client-supplied TFO cookies will be considered to be valid. 516The default is 0. 517.It Va fastopen.autokey 518When this and 519.Va net.inet.tcp.fastopen.server_enable 520are non-zero, a new key will be automatically generated after this specified 521seconds. 522The default is 120. 523.It Va fastopen.ccache_bucket_limit 524The maximum number of entries in a client cookie cache bucket. 525The default value can be tuned with the 526.Dv TCP_FASTOPEN_CCACHE_BUCKET_LIMIT_DEFAULT 527kernel option or by setting 528.Va net.inet.tcp.fastopen_ccache_bucket_limit 529in the 530.Xr loader 8 . 531.It Va fastopen.ccache_buckets 532The number of client cookie cache buckets. 533Read-only. 534The value can be tuned with the 535.Dv TCP_FASTOPEN_CCACHE_BUCKETS_DEFAULT 536kernel option or by setting 537.Va fastopen.ccache_buckets 538in the 539.Xr loader 8 . 540.It Va fastopen.ccache_list 541Print the client cookie cache. 542Read-only. 543.It Va fastopen.client_enable 544When zero, no new active (i.e., client) TFO connections can be created. 545On the transition from enabled to disabled, the client cookie cache is cleared 546and disabled. 547The transition from enabled to disabled does not affect any active TFO 548connections in progress; it only prevents new ones from being established. 549The default is 0. 550.It Va fastopen.keylen 551The key length in bytes. 552Read-only. 553.It Va fastopen.maxkeys 554The maximum number of keys supported. 555Read-only, 556.It Va fastopen.maxpsks 557The maximum number of pre-shared keys supported. 558Read-only. 559.It Va fastopen.numkeys 560The current number of keys installed. 561Read-only. 562.It Va fastopen.numpsks 563The current number of pre-shared keys installed. 564Read-only. 565.It Va fastopen.path_disable_time 566When a failure occurs while trying to create a new active (i.e., client) TFO 567connection, new active connections on the same path, as determined by the tuple 568.Brq client_ip, server_ip, server_port , 569will be forced to be non-TFO for this many seconds. 570Note that the path disable mechanism relies on state stored in client cookie 571cache entries, so it is possible for the disable time for a given path to be 572reduced if the corresponding client cookie cache entry is reused due to resource 573pressure before the disable period has elapsed. 574The default is 575.Dv TCP_FASTOPEN_PATH_DISABLE_TIME_DEFAULT . 576.It Va fastopen.psk_enable 577When non-zero, pre-shared key (PSK) mode is enabled for all TFO servers. 578On the transition from enabled to disabled, all installed pre-shared keys are 579removed. 580The default is 0. 581.It Va fastopen.server_enable 582When zero, no new passive (i.e., server) TFO connections can be created. 583On the transition from enabled to disabled, all installed keys and pre-shared 584keys are removed. 585On the transition from disabled to enabled, if 586.Va fastopen.autokey 587is non-zero and there are no keys installed, a new key will be generated 588immediately. 589The transition from enabled to disabled does not affect any passive TFO 590connections in progress; it only prevents new ones from being established. 591The default is 0. 592.It Va fastopen.setkey 593Install a new key by writing 594.Va net.inet.tcp.fastopen.keylen 595bytes to this sysctl. 596.It Va fastopen.setpsk 597Install a new pre-shared key by writing 598.Va net.inet.tcp.fastopen.keylen 599bytes to this sysctl. 600.It Va finwait2_timeout 601Timeout to use for fast recycling of 602.Tn TCP 603.Dv FIN_WAIT_2 604connections 605.Pq Va fast_finwait2_recycle . 606Defaults to 60 seconds. 607.It Va functions_available 608List of available TCP function blocks (TCP stacks). 609.It Va functions_default 610The default TCP function block (TCP stack). 611.It Va functions_inherit_listen_socket_stack 612Determines whether to inherit listen socket's TCP stack or use the current 613system default TCP stack, as defined by 614.Va functions_default . 615Default is true. 616.It Va hostcache 617The TCP host cache is used to cache connection details and metrics to 618improve future performance of connections between the same hosts. 619At the completion of a TCP connection, a host will cache information 620for the connection for some defined period of time. 621There are a number of 622.Va hostcache 623variables under this node. 624See 625.Va hostcache.enable . 626.It Va hostcache.bucketlimit 627The maximum number of entries for the same hash. 628Defaults to 30. 629.It Va hostcache.cachelimit 630Overall entry limit for hostcache. 631Defaults to 632.Va hashsize 633* 634.Va bucketlimit . 635.It Va hostcache.count 636The current number of entries in the host cache. 637.It Va hostcache.enable 638Enable/disable the host cache: 639.Bl -tag -compact 640.It 0 641Disable the host cache. 642.It 1 643Enable the host cache. (default) 644.El 645.It Va hostcache.expire 646Time in seconds, how long a entry should be kept in the 647host cache since last accessed. 648Defaults to 3600 (1 hour). 649.It Va hostcache.hashsize 650Size of TCP hostcache hashtable. 651This number has to be a power of two, or will be rejected. 652Defaults to 512. 653.It Va hostcache.histo 654Provide a Histogram of the hostcache hash utilization. 655.It Va hostcache.list 656Provide a complete list of all current entries in the host 657cache. 658.It Va hostcache.prune 659Time in seconds between pruning expired host cache entries. 660Defaults to 300 (5 minutes). 661.It Va hostcache.purge 662Expire all entires on next pruning of host cache entries. 663Any non-zero setting will be reset to zero, once the purge 664is running. 665.Bl -tag -compact 666.It 0 667Do not purge all entries when pruning the host cache (default). 668.It 1 669Purge all entries when doing the next pruning. 670.It 2 671Purge all entries and also reseed the hash salt. 672.El 673.It Va hostcache.purgenow 674Immediately purge all entries once set to any value. 675Setting this to 2 will also reseed the hash salt. 676.It Va icmp_may_rst 677Certain 678.Tn ICMP 679unreachable messages may abort connections in 680.Tn SYN-SENT 681state. 682.It Va initcwnd_segments 683Enable the ability to specify initial congestion window in number of segments. 684The default value is 10 as suggested by RFC 6928. 685Changing the value on the fly would not affect connections 686using congestion window from the hostcache. 687Caution: 688This regulates the burst of packets allowed to be sent in the first RTT. 689The value should be relative to the link capacity. 690Start with small values for lower-capacity links. 691Large bursts can cause buffer overruns and packet drops if routers have small 692buffers or the link is experiencing congestion. 693.It Va insecure_rst 694Use criteria defined in RFC793 instead of RFC5961 for accepting RST segments. 695Default is false. 696.It Va insecure_syn 697Use criteria defined in RFC793 instead of RFC5961 for accepting SYN segments. 698Default is false. 699.It Va isn_reseed_interval 700The interval (in seconds) specifying how often the secret data used in 701RFC 1948 initial sequence number calculations should be reseeded. 702By default, this variable is set to zero, indicating that 703no reseeding will occur. 704Reseeding should not be necessary, and will break 705.Dv TIME_WAIT 706recycling for a few minutes. 707.It Va keepcnt 708Number of keepalive probes sent, with no response, before a connection 709is dropped. 710The default is 8 packets. 711.It Va keepidle 712Amount of time, in milliseconds, that the connection must be idle 713before sending keepalive probes (if enabled). 714The default is 7200000 msec (7.2M msec, 2 hours). 715.It Va keepinit 716Timeout, in milliseconds, for new, non-established 717.Tn TCP 718connections. 719The default is 75000 msec (75K msec, 75 sec). 720.It Va keepintvl 721The interval, in milliseconds, between keepalive probes sent to remote 722machines, when no response is received on a 723.Va keepidle 724probe. 725The default is 75000 msec (75K msec, 75 sec). 726.It Va log_in_vain 727Log any connection attempts to ports where there is no socket 728accepting connections. 729The value of 1 limits the logging to 730.Tn SYN 731(connection establishment) packets only. 732A value of 2 results in any 733.Tn TCP 734packets to closed ports being logged. 735Any value not listed above disables the logging 736(default is 0, i.e., the logging is disabled). 737.It Va maxtcptw 738When a TCP connection enters the 739.Dv TIME_WAIT 740state, its associated socket structure is freed, since it is of 741negligible size and use, and a new structure is allocated to contain a 742minimal amount of information necessary for sustaining a connection in 743this state, called the compressed TCP 744.Dv TIME_WAIT 745state. 746Since this structure is smaller than a socket structure, it can save 747a significant amount of system memory. 748The 749.Va net.inet.tcp.maxtcptw 750MIB variable controls the maximum number of these structures allocated. 751By default, it is initialized to 752.Va kern.ipc.maxsockets 753/ 5. 754.It Va minmss 755Minimum TCP Maximum Segment Size; used to prevent a denial of service attack 756from an unreasonably low MSS. 757.It Va msl 758The Maximum Segment Lifetime, in milliseconds, for a packet. 759.It Va mssdflt 760The default value used for the TCP Maximum Segment Size 761.Pq Dq MSS 762for IPv4 when no advice to the contrary is received from MSS negotiation. 763.It Va newcwd 764Enable the New Congestion Window Validation mechanism as described in RFC 7661. 765This gently reduces the congestion window during periods, where TCP is 766application limited and the network bandwidth is not utilized completely. 767That prevents self-inflicted packet losses once the application starts to 768transmit data at a higher speed. 769.It Va nolocaltimewait 770Suppress creation of compressed TCP 771.Dv TIME_WAIT 772states for connections in 773which both endpoints are local. 774.It Va path_mtu_discovery 775Enable Path MTU Discovery. 776.It Va pcbcount 777Number of active process control blocks 778(read-only). 779.It Va perconn_stats_enable 780Controls the default collection of statistics for all connections using the 781.Xr stats 3 782framework. 7830 disables, 1 enables, 2 enables random sampling across log id connection 784groups with all connections in a group receiving the same setting. 785.It Va perconn_stats_sample_rates 786A CSV list of template_spec=percent key-value pairs which controls the per 787template sampling rates when 788.Xr stats 3 789sampling is enabled. 790.It Va persmax 791Maximum persistence interval, msec. 792.It Va persmin 793Minimum persistence interval, msec. 794.It Va pmtud_blackhole_detection 795Enable automatic path MTU blackhole detection. 796In case of retransmits of MSS sized segments, 797the OS will lower the MSS to check if it's an MTU problem. 798If the current MSS is greater than the configured value to try 799.Po Va net.inet.tcp.pmtud_blackhole_mss 800and 801.Va net.inet.tcp.v6pmtud_blackhole_mss 802.Pc , 803it will be set to this value, otherwise, 804the MSS will be set to the default values 805.Po Va net.inet.tcp.mssdflt 806and 807.Va net.inet.tcp.v6mssdflt 808.Pc . 809Settings: 810.Bl -tag -compact 811.It 0 812Disable path MTU blackhole detection. 813.It 1 814Enable path MTU blackhole detection for IPv4 and IPv6. 815.It 2 816Enable path MTU blackhole detection only for IPv4. 817.It 3 818Enable path MTU blackhole detection only for IPv6. 819.El 820.It Va pmtud_blackhole_mss 821MSS to try for IPv4 if PMTU blackhole detection is turned on. 822.It Va reass.cursegments 823The current total number of segments present in all reassembly queues. 824.It Va reass.maxqueuelen 825The maximum number of segments allowed in each reassembly queue. 826By default, the system chooses a limit based on each TCP connection's 827receive buffer size and maximum segment size (MSS). 828The actual limit applied to a session's reassembly queue will be the lower of 829the system-calculated automatic limit and the user-specified 830.Va reass.maxqueuelen 831limit. 832.It Va reass.maxsegments 833The maximum limit on the total number of segments across all reassembly 834queues. 835The limit can be adjusted as a tunable. 836.It Va recvbuf_auto 837Enable automatic receive buffer sizing as a connection progresses. 838.It Va recvbuf_max 839Maximum size of automatic receive buffer. 840.It Va recvspace 841Initial 842.Tn TCP 843receive window (buffer size). 844.It Va require_unique_port 845Require unique ephemeral port for outgoing connections; 846otherwise, the 4-tuple of local and remote ports and addresses must be unique. 847Requiring a unique port limits the number of outgoing connections. 848.It Va rexmit_drop_options 849Drop TCP options from third and later retransmitted SYN segments 850of a connection. 851.It Va rexmit_initial , rexmit_min , rexmit_slop 852Adjust the retransmit timer calculation for 853.Tn TCP . 854The slop is 855typically added to the raw calculation to take into account 856occasional variances that the 857.Tn SRTT 858(smoothed round-trip time) 859is unable to accommodate, while the minimum specifies an 860absolute minimum. 861While a number of 862.Tn TCP 863RFCs suggest a 1 864second minimum, these RFCs tend to focus on streaming behavior, 865and fail to deal with the fact that a 1 second minimum has severe 866detrimental effects over lossy interactive connections, such 867as a 802.11b wireless link, and over very fast but lossy 868connections for those cases not covered by the fast retransmit 869code. 870For this reason, we use 200ms of slop and a near-0 871minimum, which gives us an effective minimum of 200ms (similar to 872.Tn Linux ) . 873The initial value is used before an RTT measurement has been performed. 874.It Va rfc1323 875Implement the window scaling and timestamp options of RFC 1323/RFC 7323 876(default is true). 877.It Va rfc3042 878Enable the Limited Transmit algorithm as described in RFC 3042. 879It helps avoid timeouts on lossy links and also when the congestion window 880is small, as happens on short transfers. 881.It Va rfc3390 882Enable support for RFC 3390, which allows for a variable-sized 883starting congestion window on new connections, depending on the 884maximum segment size. 885This helps throughput in general, but 886particularly affects short transfers and high-bandwidth large 887propagation-delay connections. 888.It Va rfc6675_pipe 889Deprecated and superseded by 890.Va sack.revised 891.It Va sack.enable 892Enable support for RFC 2018, TCP Selective Acknowledgment option, 893which allows the receiver to inform the sender about all successfully 894arrived segments, allowing the sender to retransmit the missing segments 895only. 896.It Va sack.globalholes 897Global number of TCP SACK holes currently allocated. 898.It Va sack.globalmaxholes 899Maximum number of SACK holes per system, across all connections. 900Defaults to 65536. 901.It Va sack.maxholes 902Maximum number of SACK holes per connection. 903Defaults to 128. 904.It Va sack.revised 905Enables three updated mechanisms from RFC6675 (default is true). 906Calculate the bytes in flight using the algorithm described in RFC 6675, and 907is also an improvement when Proportional Rate Reduction is enabled. 908Next, Rescue Retransmission helps timely loss recovery, when the trailing segments 909of a transmission are lost, while no additional data is ready to be sent. 910In case a partial ACK without a SACK block is received during SACK loss 911recovery, the trailing segment is immediately resent, rather than waiting 912for a Retransmission timeout. 913Finally, SACK loss recovery is also engaged, once two segments plus one byte are 914SACKed - even if no traditional duplicate ACKs were observed. 915.It Va sendbuf_auto 916Enable automatic send buffer sizing. 917.It Va sendbuf_auto_lowat 918Modify threshold for auto send buffer growth to account for 919.Dv SO_SNDLOWAT . 920.It Va sendbuf_inc 921Incrementor step size of automatic send buffer. 922.It Va sendbuf_max 923Maximum size of automatic send buffer. 924.It Va sendspace 925Initial 926.Tn TCP 927send window (buffer size). 928.It Va syncache 929Variables under the 930.Va net.inet.tcp.syncache 931node are documented in 932.Xr syncache 4 . 933.It Va syncookies 934Determines whether or not 935.Tn SYN 936cookies should be generated for outbound 937.Tn SYN-ACK 938packets. 939.Tn SYN 940cookies are a great help during 941.Tn SYN 942flood attacks, and are enabled by default. 943(See 944.Xr syncookies 4 . ) 945.It Va syncookies_only 946See 947.Xr syncookies 4 . 948.It Va tcbhashsize 949Size of the 950.Tn TCP 951control-block hash table 952(read-only). 953This is tuned using the kernel option 954.Dv TCBHASHSIZE 955or by setting 956.Va net.inet.tcp.tcbhashsize 957in the 958.Xr loader 8 . 959.It Va tolerate_missing_ts 960Tolerate the missing of timestamps (RFC 1323/RFC 7323) for 961.Tn TCP 962segments belonging to 963.Tn TCP 964connections for which support of 965.Tn TCP 966timestamps has been negotiated. 967As of June 2021, several TCP stacks are known to violate RFC 7323, including 968modern widely deployed ones. 969Therefore the default is 1, i.e., the missing of timestamps is tolerated. 970.It Va ts_offset_per_conn 971When initializing the TCP timestamps, use a per connection offset instead of a 972per host pair offset. 973Default is to use per connection offsets as recommended in RFC 7323. 974.It Va tso 975Enable TCP Segmentation Offload. 976.It Va udp_tunneling_overhead 977The overhead taken into account when using UDP encapsulation. 978Since MSS clamping by middleboxes will most likely not work, values larger than 9798 (the size of the UDP header) are also supported. 980Supported values are between 8 and 1024. 981The default is 8. 982.It Va udp_tunneling_port 983The local UDP encapsulation port. 984A value of 0 indicates that UDP encapsulation is disabled. 985The default is 0. 986.It Va v6mssdflt 987The default value used for the TCP Maximum Segment Size 988.Pq Dq MSS 989for IPv6 when no advice to the contrary is received from MSS negotiation. 990.It Va v6pmtud_blackhole_mss 991MSS to try for IPv6 if PMTU blackhole detection is turned on. 992See 993.Va pmtud_blackhole_detection . 994.El 995.Sh ERRORS 996A socket operation may fail with one of the following errors returned: 997.Bl -tag -width Er 998.It Bq Er EISCONN 999when trying to establish a connection on a socket which 1000already has one; 1001.It Bo Er ENOBUFS Bc or Bo Er ENOMEM Bc 1002when the system runs out of memory for 1003an internal data structure; 1004.It Bq Er ETIMEDOUT 1005when a connection was dropped 1006due to excessive retransmissions; 1007.It Bq Er ECONNRESET 1008when the remote peer 1009forces the connection to be closed; 1010.It Bq Er ECONNREFUSED 1011when the remote 1012peer actively refuses connection establishment (usually because 1013no process is listening to the port); 1014.It Bq Er EADDRINUSE 1015when an attempt 1016is made to create a socket with a port which has already been 1017allocated; 1018.It Bq Er EADDRNOTAVAIL 1019when an attempt is made to create a 1020socket with a network address for which no network interface 1021exists; 1022.It Bq Er EAFNOSUPPORT 1023when an attempt is made to bind or connect a socket to a multicast 1024address. 1025.It Bq Er EINVAL 1026when trying to change TCP function blocks at an invalid point in the session; 1027.It Bq Er ENOENT 1028when trying to use a TCP function block that is not available; 1029.El 1030.Sh SEE ALSO 1031.Xr getsockopt 2 , 1032.Xr socket 2 , 1033.Xr stats 3 , 1034.Xr sysctl 3 , 1035.Xr blackhole 4 , 1036.Xr inet 4 , 1037.Xr intro 4 , 1038.Xr ip 4 , 1039.Xr ktls 4 , 1040.Xr mod_cc 4 , 1041.Xr siftr 4 , 1042.Xr syncache 4 , 1043.Xr tcp_bbr 4 , 1044.Xr setkey 8 , 1045.Xr sysctl 8 , 1046.Xr tcp_functions 9 1047.Rs 1048.%A "V. Jacobson" 1049.%A "B. Braden" 1050.%A "D. Borman" 1051.%T "TCP Extensions for High Performance" 1052.%O "RFC 1323" 1053.Re 1054.Rs 1055.%A "D. Borman" 1056.%A "B. Braden" 1057.%A "V. Jacobson" 1058.%A "R. Scheffenegger" 1059.%T "TCP Extensions for High Performance" 1060.%O "RFC 7323" 1061.Re 1062.Rs 1063.%A "A. Heffernan" 1064.%T "Protection of BGP Sessions via the TCP MD5 Signature Option" 1065.%O "RFC 2385" 1066.Re 1067.Rs 1068.%A "K. Ramakrishnan" 1069.%A "S. Floyd" 1070.%A "D. Black" 1071.%T "The Addition of Explicit Congestion Notification (ECN) to IP" 1072.%O "RFC 3168" 1073.Re 1074.Sh HISTORY 1075The 1076.Tn TCP 1077protocol appeared in 1078.Bx 4.2 . 1079The RFC 1323 extensions for window scaling and timestamps were added 1080in 1081.Bx 4.4 . 1082The 1083.Dv TCP_INFO 1084option was introduced in 1085.Tn Linux 2.6 1086and is 1087.Em subject to change . 1088