xref: /linux/Documentation/networking/ip-sysctl.rst (revision 40e79150c1686263e6a031d7702aec63aff31332)
1.. SPDX-License-Identifier: GPL-2.0
2
3=========
4IP Sysctl
5=========
6
7/proc/sys/net/ipv4/* Variables
8==============================
9
10ip_forward - BOOLEAN
11	- 0 - disabled (default)
12	- not 0 - enabled
13
14	Forward Packets between interfaces.
15
16	This variable is special, its change resets all configuration
17	parameters to their default state (RFC1122 for hosts, RFC1812
18	for routers)
19
20ip_default_ttl - INTEGER
21	Default value of TTL field (Time To Live) for outgoing (but not
22	forwarded) IP packets. Should be between 1 and 255 inclusive.
23	Default: 64 (as recommended by RFC1700)
24
25ip_no_pmtu_disc - INTEGER
26	Disable Path MTU Discovery. If enabled in mode 1 and a
27	fragmentation-required ICMP is received, the PMTU to this
28	destination will be set to min_pmtu (see below). You will need
29	to raise min_pmtu to the smallest interface MTU on your system
30	manually if you want to avoid locally generated fragments.
31
32	In mode 2 incoming Path MTU Discovery messages will be
33	discarded. Outgoing frames are handled the same as in mode 1,
34	implicitly setting IP_PMTUDISC_DONT on every created socket.
35
36	Mode 3 is a hardened pmtu discover mode. The kernel will only
37	accept fragmentation-needed errors if the underlying protocol
38	can verify them besides a plain socket lookup. Current
39	protocols for which pmtu events will be honored are TCP, SCTP
40	and DCCP as they verify e.g. the sequence number or the
41	association. This mode should not be enabled globally but is
42	only intended to secure e.g. name servers in namespaces where
43	TCP path mtu must still work but path MTU information of other
44	protocols should be discarded. If enabled globally this mode
45	could break other protocols.
46
47	Possible values: 0-3
48
49	Default: FALSE
50
51min_pmtu - INTEGER
52	default 552 - minimum discovered Path MTU
53
54ip_forward_use_pmtu - BOOLEAN
55	By default we don't trust protocol path MTUs while forwarding
56	because they could be easily forged and can lead to unwanted
57	fragmentation by the router.
58	You only need to enable this if you have user-space software
59	which tries to discover path mtus by itself and depends on the
60	kernel honoring this information. This is normally not the
61	case.
62
63	Default: 0 (disabled)
64
65	Possible values:
66
67	- 0 - disabled
68	- 1 - enabled
69
70fwmark_reflect - BOOLEAN
71	Controls the fwmark of kernel-generated IPv4 reply packets that are not
72	associated with a socket for example, TCP RSTs or ICMP echo replies).
73	If unset, these packets have a fwmark of zero. If set, they have the
74	fwmark of the packet they are replying to.
75
76	Default: 0
77
78fib_multipath_use_neigh - BOOLEAN
79	Use status of existing neighbor entry when determining nexthop for
80	multipath routes. If disabled, neighbor information is not used and
81	packets could be directed to a failed nexthop. Only valid for kernels
82	built with CONFIG_IP_ROUTE_MULTIPATH enabled.
83
84	Default: 0 (disabled)
85
86	Possible values:
87
88	- 0 - disabled
89	- 1 - enabled
90
91fib_multipath_hash_policy - INTEGER
92	Controls which hash policy to use for multipath routes. Only valid
93	for kernels built with CONFIG_IP_ROUTE_MULTIPATH enabled.
94
95	Default: 0 (Layer 3)
96
97	Possible values:
98
99	- 0 - Layer 3
100	- 1 - Layer 4
101	- 2 - Layer 3 or inner Layer 3 if present
102
103fib_sync_mem - UNSIGNED INTEGER
104	Amount of dirty memory from fib entries that can be backlogged before
105	synchronize_rcu is forced.
106
107	Default: 512kB   Minimum: 64kB   Maximum: 64MB
108
109ip_forward_update_priority - INTEGER
110	Whether to update SKB priority from "TOS" field in IPv4 header after it
111	is forwarded. The new SKB priority is mapped from TOS field value
112	according to an rt_tos2priority table (see e.g. man tc-prio).
113
114	Default: 1 (Update priority.)
115
116	Possible values:
117
118	- 0 - Do not update priority.
119	- 1 - Update priority.
120
121route/max_size - INTEGER
122	Maximum number of routes allowed in the kernel.  Increase
123	this when using large numbers of interfaces and/or routes.
124
125	From linux kernel 3.6 onwards, this is deprecated for ipv4
126	as route cache is no longer used.
127
128neigh/default/gc_thresh1 - INTEGER
129	Minimum number of entries to keep.  Garbage collector will not
130	purge entries if there are fewer than this number.
131
132	Default: 128
133
134neigh/default/gc_thresh2 - INTEGER
135	Threshold when garbage collector becomes more aggressive about
136	purging entries. Entries older than 5 seconds will be cleared
137	when over this number.
138
139	Default: 512
140
141neigh/default/gc_thresh3 - INTEGER
142	Maximum number of non-PERMANENT neighbor entries allowed.  Increase
143	this when using large numbers of interfaces and when communicating
144	with large numbers of directly-connected peers.
145
146	Default: 1024
147
148neigh/default/unres_qlen_bytes - INTEGER
149	The maximum number of bytes which may be used by packets
150	queued for each	unresolved address by other network layers.
151	(added in linux 3.3)
152
153	Setting negative value is meaningless and will return error.
154
155	Default: SK_WMEM_MAX, (same as net.core.wmem_default).
156
157		Exact value depends on architecture and kernel options,
158		but should be enough to allow queuing 256 packets
159		of medium size.
160
161neigh/default/unres_qlen - INTEGER
162	The maximum number of packets which may be queued for each
163	unresolved address by other network layers.
164
165	(deprecated in linux 3.3) : use unres_qlen_bytes instead.
166
167	Prior to linux 3.3, the default value is 3 which may cause
168	unexpected packet loss. The current default value is calculated
169	according to default value of unres_qlen_bytes and true size of
170	packet.
171
172	Default: 101
173
174mtu_expires - INTEGER
175	Time, in seconds, that cached PMTU information is kept.
176
177min_adv_mss - INTEGER
178	The advertised MSS depends on the first hop route MTU, but will
179	never be lower than this setting.
180
181IP Fragmentation:
182
183ipfrag_high_thresh - LONG INTEGER
184	Maximum memory used to reassemble IP fragments.
185
186ipfrag_low_thresh - LONG INTEGER
187	(Obsolete since linux-4.17)
188	Maximum memory used to reassemble IP fragments before the kernel
189	begins to remove incomplete fragment queues to free up resources.
190	The kernel still accepts new fragments for defragmentation.
191
192ipfrag_time - INTEGER
193	Time in seconds to keep an IP fragment in memory.
194
195ipfrag_max_dist - INTEGER
196	ipfrag_max_dist is a non-negative integer value which defines the
197	maximum "disorder" which is allowed among fragments which share a
198	common IP source address. Note that reordering of packets is
199	not unusual, but if a large number of fragments arrive from a source
200	IP address while a particular fragment queue remains incomplete, it
201	probably indicates that one or more fragments belonging to that queue
202	have been lost. When ipfrag_max_dist is positive, an additional check
203	is done on fragments before they are added to a reassembly queue - if
204	ipfrag_max_dist (or more) fragments have arrived from a particular IP
205	address between additions to any IP fragment queue using that source
206	address, it's presumed that one or more fragments in the queue are
207	lost. The existing fragment queue will be dropped, and a new one
208	started. An ipfrag_max_dist value of zero disables this check.
209
210	Using a very small value, e.g. 1 or 2, for ipfrag_max_dist can
211	result in unnecessarily dropping fragment queues when normal
212	reordering of packets occurs, which could lead to poor application
213	performance. Using a very large value, e.g. 50000, increases the
214	likelihood of incorrectly reassembling IP fragments that originate
215	from different IP datagrams, which could result in data corruption.
216	Default: 64
217
218INET peer storage
219=================
220
221inet_peer_threshold - INTEGER
222	The approximate size of the storage.  Starting from this threshold
223	entries will be thrown aggressively.  This threshold also determines
224	entries' time-to-live and time intervals between garbage collection
225	passes.  More entries, less time-to-live, less GC interval.
226
227inet_peer_minttl - INTEGER
228	Minimum time-to-live of entries.  Should be enough to cover fragment
229	time-to-live on the reassembling side.  This minimum time-to-live  is
230	guaranteed if the pool size is less than inet_peer_threshold.
231	Measured in seconds.
232
233inet_peer_maxttl - INTEGER
234	Maximum time-to-live of entries.  Unused entries will expire after
235	this period of time if there is no memory pressure on the pool (i.e.
236	when the number of entries in the pool is very small).
237	Measured in seconds.
238
239TCP variables
240=============
241
242somaxconn - INTEGER
243	Limit of socket listen() backlog, known in userspace as SOMAXCONN.
244	Defaults to 4096. (Was 128 before linux-5.4)
245	See also tcp_max_syn_backlog for additional tuning for TCP sockets.
246
247tcp_abort_on_overflow - BOOLEAN
248	If listening service is too slow to accept new connections,
249	reset them. Default state is FALSE. It means that if overflow
250	occurred due to a burst, connection will recover. Enable this
251	option _only_ if you are really sure that listening daemon
252	cannot be tuned to accept connections faster. Enabling this
253	option can harm clients of your server.
254
255tcp_adv_win_scale - INTEGER
256	Count buffering overhead as bytes/2^tcp_adv_win_scale
257	(if tcp_adv_win_scale > 0) or bytes-bytes/2^(-tcp_adv_win_scale),
258	if it is <= 0.
259
260	Possible values are [-31, 31], inclusive.
261
262	Default: 1
263
264tcp_allowed_congestion_control - STRING
265	Show/set the congestion control choices available to non-privileged
266	processes. The list is a subset of those listed in
267	tcp_available_congestion_control.
268
269	Default is "reno" and the default setting (tcp_congestion_control).
270
271tcp_app_win - INTEGER
272	Reserve max(window/2^tcp_app_win, mss) of window for application
273	buffer. Value 0 is special, it means that nothing is reserved.
274
275	Default: 31
276
277tcp_autocorking - BOOLEAN
278	Enable TCP auto corking :
279	When applications do consecutive small write()/sendmsg() system calls,
280	we try to coalesce these small writes as much as possible, to lower
281	total amount of sent packets. This is done if at least one prior
282	packet for the flow is waiting in Qdisc queues or device transmit
283	queue. Applications can still use TCP_CORK for optimal behavior
284	when they know how/when to uncork their sockets.
285
286	Default : 1
287
288tcp_available_congestion_control - STRING
289	Shows the available congestion control choices that are registered.
290	More congestion control algorithms may be available as modules,
291	but not loaded.
292
293tcp_base_mss - INTEGER
294	The initial value of search_low to be used by the packetization layer
295	Path MTU discovery (MTU probing).  If MTU probing is enabled,
296	this is the initial MSS used by the connection.
297
298tcp_mtu_probe_floor - INTEGER
299	If MTU probing is enabled this caps the minimum MSS used for search_low
300	for the connection.
301
302	Default : 48
303
304tcp_min_snd_mss - INTEGER
305	TCP SYN and SYNACK messages usually advertise an ADVMSS option,
306	as described in RFC 1122 and RFC 6691.
307
308	If this ADVMSS option is smaller than tcp_min_snd_mss,
309	it is silently capped to tcp_min_snd_mss.
310
311	Default : 48 (at least 8 bytes of payload per segment)
312
313tcp_congestion_control - STRING
314	Set the congestion control algorithm to be used for new
315	connections. The algorithm "reno" is always available, but
316	additional choices may be available based on kernel configuration.
317	Default is set as part of kernel configuration.
318	For passive connections, the listener congestion control choice
319	is inherited.
320
321	[see setsockopt(listenfd, SOL_TCP, TCP_CONGESTION, "name" ...) ]
322
323tcp_dsack - BOOLEAN
324	Allows TCP to send "duplicate" SACKs.
325
326tcp_early_retrans - INTEGER
327	Tail loss probe (TLP) converts RTOs occurring due to tail
328	losses into fast recovery (draft-ietf-tcpm-rack). Note that
329	TLP requires RACK to function properly (see tcp_recovery below)
330
331	Possible values:
332
333		- 0 disables TLP
334		- 3 or 4 enables TLP
335
336	Default: 3
337
338tcp_ecn - INTEGER
339	Control use of Explicit Congestion Notification (ECN) by TCP.
340	ECN is used only when both ends of the TCP connection indicate
341	support for it.  This feature is useful in avoiding losses due
342	to congestion by allowing supporting routers to signal
343	congestion before having to drop packets.
344
345	Possible values are:
346
347		=  =====================================================
348		0  Disable ECN.  Neither initiate nor accept ECN.
349		1  Enable ECN when requested by incoming connections and
350		   also request ECN on outgoing connection attempts.
351		2  Enable ECN when requested by incoming connections
352		   but do not request ECN on outgoing connections.
353		=  =====================================================
354
355	Default: 2
356
357tcp_ecn_fallback - BOOLEAN
358	If the kernel detects that ECN connection misbehaves, enable fall
359	back to non-ECN. Currently, this knob implements the fallback
360	from RFC3168, section 6.1.1.1., but we reserve that in future,
361	additional detection mechanisms could be implemented under this
362	knob. The value	is not used, if tcp_ecn or per route (or congestion
363	control) ECN settings are disabled.
364
365	Default: 1 (fallback enabled)
366
367tcp_fack - BOOLEAN
368	This is a legacy option, it has no effect anymore.
369
370tcp_fin_timeout - INTEGER
371	The length of time an orphaned (no longer referenced by any
372	application) connection will remain in the FIN_WAIT_2 state
373	before it is aborted at the local end.  While a perfectly
374	valid "receive only" state for an un-orphaned connection, an
375	orphaned connection in FIN_WAIT_2 state could otherwise wait
376	forever for the remote to close its end of the connection.
377
378	Cf. tcp_max_orphans
379
380	Default: 60 seconds
381
382tcp_frto - INTEGER
383	Enables Forward RTO-Recovery (F-RTO) defined in RFC5682.
384	F-RTO is an enhanced recovery algorithm for TCP retransmission
385	timeouts.  It is particularly beneficial in networks where the
386	RTT fluctuates (e.g., wireless). F-RTO is sender-side only
387	modification. It does not require any support from the peer.
388
389	By default it's enabled with a non-zero value. 0 disables F-RTO.
390
391tcp_fwmark_accept - BOOLEAN
392	If set, incoming connections to listening sockets that do not have a
393	socket mark will set the mark of the accepting socket to the fwmark of
394	the incoming SYN packet. This will cause all packets on that connection
395	(starting from the first SYNACK) to be sent with that fwmark. The
396	listening socket's mark is unchanged. Listening sockets that already
397	have a fwmark set via setsockopt(SOL_SOCKET, SO_MARK, ...) are
398	unaffected.
399
400	Default: 0
401
402tcp_invalid_ratelimit - INTEGER
403	Limit the maximal rate for sending duplicate acknowledgments
404	in response to incoming TCP packets that are for an existing
405	connection but that are invalid due to any of these reasons:
406
407	  (a) out-of-window sequence number,
408	  (b) out-of-window acknowledgment number, or
409	  (c) PAWS (Protection Against Wrapped Sequence numbers) check failure
410
411	This can help mitigate simple "ack loop" DoS attacks, wherein
412	a buggy or malicious middlebox or man-in-the-middle can
413	rewrite TCP header fields in manner that causes each endpoint
414	to think that the other is sending invalid TCP segments, thus
415	causing each side to send an unterminating stream of duplicate
416	acknowledgments for invalid segments.
417
418	Using 0 disables rate-limiting of dupacks in response to
419	invalid segments; otherwise this value specifies the minimal
420	space between sending such dupacks, in milliseconds.
421
422	Default: 500 (milliseconds).
423
424tcp_keepalive_time - INTEGER
425	How often TCP sends out keepalive messages when keepalive is enabled.
426	Default: 2hours.
427
428tcp_keepalive_probes - INTEGER
429	How many keepalive probes TCP sends out, until it decides that the
430	connection is broken. Default value: 9.
431
432tcp_keepalive_intvl - INTEGER
433	How frequently the probes are send out. Multiplied by
434	tcp_keepalive_probes it is time to kill not responding connection,
435	after probes started. Default value: 75sec i.e. connection
436	will be aborted after ~11 minutes of retries.
437
438tcp_l3mdev_accept - BOOLEAN
439	Enables child sockets to inherit the L3 master device index.
440	Enabling this option allows a "global" listen socket to work
441	across L3 master domains (e.g., VRFs) with connected sockets
442	derived from the listen socket to be bound to the L3 domain in
443	which the packets originated. Only valid when the kernel was
444	compiled with CONFIG_NET_L3_MASTER_DEV.
445
446	Default: 0 (disabled)
447
448tcp_low_latency - BOOLEAN
449	This is a legacy option, it has no effect anymore.
450
451tcp_max_orphans - INTEGER
452	Maximal number of TCP sockets not attached to any user file handle,
453	held by system.	If this number is exceeded orphaned connections are
454	reset immediately and warning is printed. This limit exists
455	only to prevent simple DoS attacks, you _must_ not rely on this
456	or lower the limit artificially, but rather increase it
457	(probably, after increasing installed memory),
458	if network conditions require more than default value,
459	and tune network services to linger and kill such states
460	more aggressively. Let me to remind again: each orphan eats
461	up to ~64K of unswappable memory.
462
463tcp_max_syn_backlog - INTEGER
464	Maximal number of remembered connection requests (SYN_RECV),
465	which have not received an acknowledgment from connecting client.
466
467	This is a per-listener limit.
468
469	The minimal value is 128 for low memory machines, and it will
470	increase in proportion to the memory of machine.
471
472	If server suffers from overload, try increasing this number.
473
474	Remember to also check /proc/sys/net/core/somaxconn
475	A SYN_RECV request socket consumes about 304 bytes of memory.
476
477tcp_max_tw_buckets - INTEGER
478	Maximal number of timewait sockets held by system simultaneously.
479	If this number is exceeded time-wait socket is immediately destroyed
480	and warning is printed. This limit exists only to prevent
481	simple DoS attacks, you _must_ not lower the limit artificially,
482	but rather increase it (probably, after increasing installed memory),
483	if network conditions require more than default value.
484
485tcp_mem - vector of 3 INTEGERs: min, pressure, max
486	min: below this number of pages TCP is not bothered about its
487	memory appetite.
488
489	pressure: when amount of memory allocated by TCP exceeds this number
490	of pages, TCP moderates its memory consumption and enters memory
491	pressure mode, which is exited when memory consumption falls
492	under "min".
493
494	max: number of pages allowed for queueing by all TCP sockets.
495
496	Defaults are calculated at boot time from amount of available
497	memory.
498
499tcp_min_rtt_wlen - INTEGER
500	The window length of the windowed min filter to track the minimum RTT.
501	A shorter window lets a flow more quickly pick up new (higher)
502	minimum RTT when it is moved to a longer path (e.g., due to traffic
503	engineering). A longer window makes the filter more resistant to RTT
504	inflations such as transient congestion. The unit is seconds.
505
506	Possible values: 0 - 86400 (1 day)
507
508	Default: 300
509
510tcp_moderate_rcvbuf - BOOLEAN
511	If set, TCP performs receive buffer auto-tuning, attempting to
512	automatically size the buffer (no greater than tcp_rmem[2]) to
513	match the size required by the path for full throughput.  Enabled by
514	default.
515
516tcp_mtu_probing - INTEGER
517	Controls TCP Packetization-Layer Path MTU Discovery.  Takes three
518	values:
519
520	- 0 - Disabled
521	- 1 - Disabled by default, enabled when an ICMP black hole detected
522	- 2 - Always enabled, use initial MSS of tcp_base_mss.
523
524tcp_probe_interval - UNSIGNED INTEGER
525	Controls how often to start TCP Packetization-Layer Path MTU
526	Discovery reprobe. The default is reprobing every 10 minutes as
527	per RFC4821.
528
529tcp_probe_threshold - INTEGER
530	Controls when TCP Packetization-Layer Path MTU Discovery probing
531	will stop in respect to the width of search range in bytes. Default
532	is 8 bytes.
533
534tcp_no_metrics_save - BOOLEAN
535	By default, TCP saves various connection metrics in the route cache
536	when the connection closes, so that connections established in the
537	near future can use these to set initial conditions.  Usually, this
538	increases overall performance, but may sometimes cause performance
539	degradation.  If set, TCP will not cache metrics on closing
540	connections.
541
542tcp_no_ssthresh_metrics_save - BOOLEAN
543	Controls whether TCP saves ssthresh metrics in the route cache.
544
545	Default is 1, which disables ssthresh metrics.
546
547tcp_orphan_retries - INTEGER
548	This value influences the timeout of a locally closed TCP connection,
549	when RTO retransmissions remain unacknowledged.
550	See tcp_retries2 for more details.
551
552	The default value is 8.
553
554	If your machine is a loaded WEB server,
555	you should think about lowering this value, such sockets
556	may consume significant resources. Cf. tcp_max_orphans.
557
558tcp_recovery - INTEGER
559	This value is a bitmap to enable various experimental loss recovery
560	features.
561
562	=========   =============================================================
563	RACK: 0x1   enables the RACK loss detection for fast detection of lost
564		    retransmissions and tail drops. It also subsumes and disables
565		    RFC6675 recovery for SACK connections.
566
567	RACK: 0x2   makes RACK's reordering window static (min_rtt/4).
568
569	RACK: 0x4   disables RACK's DUPACK threshold heuristic
570	=========   =============================================================
571
572	Default: 0x1
573
574tcp_reordering - INTEGER
575	Initial reordering level of packets in a TCP stream.
576	TCP stack can then dynamically adjust flow reordering level
577	between this initial value and tcp_max_reordering
578
579	Default: 3
580
581tcp_max_reordering - INTEGER
582	Maximal reordering level of packets in a TCP stream.
583	300 is a fairly conservative value, but you might increase it
584	if paths are using per packet load balancing (like bonding rr mode)
585
586	Default: 300
587
588tcp_retrans_collapse - BOOLEAN
589	Bug-to-bug compatibility with some broken printers.
590	On retransmit try to send bigger packets to work around bugs in
591	certain TCP stacks.
592
593tcp_retries1 - INTEGER
594	This value influences the time, after which TCP decides, that
595	something is wrong due to unacknowledged RTO retransmissions,
596	and reports this suspicion to the network layer.
597	See tcp_retries2 for more details.
598
599	RFC 1122 recommends at least 3 retransmissions, which is the
600	default.
601
602tcp_retries2 - INTEGER
603	This value influences the timeout of an alive TCP connection,
604	when RTO retransmissions remain unacknowledged.
605	Given a value of N, a hypothetical TCP connection following
606	exponential backoff with an initial RTO of TCP_RTO_MIN would
607	retransmit N times before killing the connection at the (N+1)th RTO.
608
609	The default value of 15 yields a hypothetical timeout of 924.6
610	seconds and is a lower bound for the effective timeout.
611	TCP will effectively time out at the first RTO which exceeds the
612	hypothetical timeout.
613
614	RFC 1122 recommends at least 100 seconds for the timeout,
615	which corresponds to a value of at least 8.
616
617tcp_rfc1337 - BOOLEAN
618	If set, the TCP stack behaves conforming to RFC1337. If unset,
619	we are not conforming to RFC, but prevent TCP TIME_WAIT
620	assassination.
621
622	Default: 0
623
624tcp_rmem - vector of 3 INTEGERs: min, default, max
625	min: Minimal size of receive buffer used by TCP sockets.
626	It is guaranteed to each TCP socket, even under moderate memory
627	pressure.
628
629	Default: 4K
630
631	default: initial size of receive buffer used by TCP sockets.
632	This value overrides net.core.rmem_default used by other protocols.
633	Default: 87380 bytes. This value results in window of 65535 with
634	default setting of tcp_adv_win_scale and tcp_app_win:0 and a bit
635	less for default tcp_app_win. See below about these variables.
636
637	max: maximal size of receive buffer allowed for automatically
638	selected receiver buffers for TCP socket. This value does not override
639	net.core.rmem_max.  Calling setsockopt() with SO_RCVBUF disables
640	automatic tuning of that socket's receive buffer size, in which
641	case this value is ignored.
642	Default: between 87380B and 6MB, depending on RAM size.
643
644tcp_sack - BOOLEAN
645	Enable select acknowledgments (SACKS).
646
647tcp_comp_sack_delay_ns - LONG INTEGER
648	TCP tries to reduce number of SACK sent, using a timer
649	based on 5% of SRTT, capped by this sysctl, in nano seconds.
650	The default is 1ms, based on TSO autosizing period.
651
652	Default : 1,000,000 ns (1 ms)
653
654tcp_comp_sack_nr - INTEGER
655	Max number of SACK that can be compressed.
656	Using 0 disables SACK compression.
657
658	Default : 44
659
660tcp_slow_start_after_idle - BOOLEAN
661	If set, provide RFC2861 behavior and time out the congestion
662	window after an idle period.  An idle period is defined at
663	the current RTO.  If unset, the congestion window will not
664	be timed out after an idle period.
665
666	Default: 1
667
668tcp_stdurg - BOOLEAN
669	Use the Host requirements interpretation of the TCP urgent pointer field.
670	Most hosts use the older BSD interpretation, so if you turn this on
671	Linux might not communicate correctly with them.
672
673	Default: FALSE
674
675tcp_synack_retries - INTEGER
676	Number of times SYNACKs for a passive TCP connection attempt will
677	be retransmitted. Should not be higher than 255. Default value
678	is 5, which corresponds to 31seconds till the last retransmission
679	with the current initial RTO of 1second. With this the final timeout
680	for a passive TCP connection will happen after 63seconds.
681
682tcp_syncookies - INTEGER
683	Only valid when the kernel was compiled with CONFIG_SYN_COOKIES
684	Send out syncookies when the syn backlog queue of a socket
685	overflows. This is to prevent against the common 'SYN flood attack'
686	Default: 1
687
688	Note, that syncookies is fallback facility.
689	It MUST NOT be used to help highly loaded servers to stand
690	against legal connection rate. If you see SYN flood warnings
691	in your logs, but investigation	shows that they occur
692	because of overload with legal connections, you should tune
693	another parameters until this warning disappear.
694	See: tcp_max_syn_backlog, tcp_synack_retries, tcp_abort_on_overflow.
695
696	syncookies seriously violate TCP protocol, do not allow
697	to use TCP extensions, can result in serious degradation
698	of some services (f.e. SMTP relaying), visible not by you,
699	but your clients and relays, contacting you. While you see
700	SYN flood warnings in logs not being really flooded, your server
701	is seriously misconfigured.
702
703	If you want to test which effects syncookies have to your
704	network connections you can set this knob to 2 to enable
705	unconditionally generation of syncookies.
706
707tcp_fastopen - INTEGER
708	Enable TCP Fast Open (RFC7413) to send and accept data in the opening
709	SYN packet.
710
711	The client support is enabled by flag 0x1 (on by default). The client
712	then must use sendmsg() or sendto() with the MSG_FASTOPEN flag,
713	rather than connect() to send data in SYN.
714
715	The server support is enabled by flag 0x2 (off by default). Then
716	either enable for all listeners with another flag (0x400) or
717	enable individual listeners via TCP_FASTOPEN socket option with
718	the option value being the length of the syn-data backlog.
719
720	The values (bitmap) are
721
722	=====  ======== ======================================================
723	  0x1  (client) enables sending data in the opening SYN on the client.
724	  0x2  (server) enables the server support, i.e., allowing data in
725			a SYN packet to be accepted and passed to the
726			application before 3-way handshake finishes.
727	  0x4  (client) send data in the opening SYN regardless of cookie
728			availability and without a cookie option.
729	0x200  (server) accept data-in-SYN w/o any cookie option present.
730	0x400  (server) enable all listeners to support Fast Open by
731			default without explicit TCP_FASTOPEN socket option.
732	=====  ======== ======================================================
733
734	Default: 0x1
735
736	Note that that additional client or server features are only
737	effective if the basic support (0x1 and 0x2) are enabled respectively.
738
739tcp_fastopen_blackhole_timeout_sec - INTEGER
740	Initial time period in second to disable Fastopen on active TCP sockets
741	when a TFO firewall blackhole issue happens.
742	This time period will grow exponentially when more blackhole issues
743	get detected right after Fastopen is re-enabled and will reset to
744	initial value when the blackhole issue goes away.
745	0 to disable the blackhole detection.
746
747	By default, it is set to 1hr.
748
749tcp_fastopen_key - list of comma separated 32-digit hexadecimal INTEGERs
750	The list consists of a primary key and an optional backup key. The
751	primary key is used for both creating and validating cookies, while the
752	optional backup key is only used for validating cookies. The purpose of
753	the backup key is to maximize TFO validation when keys are rotated.
754
755	A randomly chosen primary key may be configured by the kernel if
756	the tcp_fastopen sysctl is set to 0x400 (see above), or if the
757	TCP_FASTOPEN setsockopt() optname is set and a key has not been
758	previously configured via sysctl. If keys are configured via
759	setsockopt() by using the TCP_FASTOPEN_KEY optname, then those
760	per-socket keys will be used instead of any keys that are specified via
761	sysctl.
762
763	A key is specified as 4 8-digit hexadecimal integers which are separated
764	by a '-' as: xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx. Leading zeros may be
765	omitted. A primary and a backup key may be specified by separating them
766	by a comma. If only one key is specified, it becomes the primary key and
767	any previously configured backup keys are removed.
768
769tcp_syn_retries - INTEGER
770	Number of times initial SYNs for an active TCP connection attempt
771	will be retransmitted. Should not be higher than 127. Default value
772	is 6, which corresponds to 63seconds till the last retransmission
773	with the current initial RTO of 1second. With this the final timeout
774	for an active TCP connection attempt will happen after 127seconds.
775
776tcp_timestamps - INTEGER
777	Enable timestamps as defined in RFC1323.
778
779	- 0: Disabled.
780	- 1: Enable timestamps as defined in RFC1323 and use random offset for
781	  each connection rather than only using the current time.
782	- 2: Like 1, but without random offsets.
783
784	Default: 1
785
786tcp_min_tso_segs - INTEGER
787	Minimal number of segments per TSO frame.
788
789	Since linux-3.12, TCP does an automatic sizing of TSO frames,
790	depending on flow rate, instead of filling 64Kbytes packets.
791	For specific usages, it's possible to force TCP to build big
792	TSO frames. Note that TCP stack might split too big TSO packets
793	if available window is too small.
794
795	Default: 2
796
797tcp_pacing_ss_ratio - INTEGER
798	sk->sk_pacing_rate is set by TCP stack using a ratio applied
799	to current rate. (current_rate = cwnd * mss / srtt)
800	If TCP is in slow start, tcp_pacing_ss_ratio is applied
801	to let TCP probe for bigger speeds, assuming cwnd can be
802	doubled every other RTT.
803
804	Default: 200
805
806tcp_pacing_ca_ratio - INTEGER
807	sk->sk_pacing_rate is set by TCP stack using a ratio applied
808	to current rate. (current_rate = cwnd * mss / srtt)
809	If TCP is in congestion avoidance phase, tcp_pacing_ca_ratio
810	is applied to conservatively probe for bigger throughput.
811
812	Default: 120
813
814tcp_tso_win_divisor - INTEGER
815	This allows control over what percentage of the congestion window
816	can be consumed by a single TSO frame.
817	The setting of this parameter is a choice between burstiness and
818	building larger TSO frames.
819
820	Default: 3
821
822tcp_tw_reuse - INTEGER
823	Enable reuse of TIME-WAIT sockets for new connections when it is
824	safe from protocol viewpoint.
825
826	- 0 - disable
827	- 1 - global enable
828	- 2 - enable for loopback traffic only
829
830	It should not be changed without advice/request of technical
831	experts.
832
833	Default: 2
834
835tcp_window_scaling - BOOLEAN
836	Enable window scaling as defined in RFC1323.
837
838tcp_wmem - vector of 3 INTEGERs: min, default, max
839	min: Amount of memory reserved for send buffers for TCP sockets.
840	Each TCP socket has rights to use it due to fact of its birth.
841
842	Default: 4K
843
844	default: initial size of send buffer used by TCP sockets.  This
845	value overrides net.core.wmem_default used by other protocols.
846
847	It is usually lower than net.core.wmem_default.
848
849	Default: 16K
850
851	max: Maximal amount of memory allowed for automatically tuned
852	send buffers for TCP sockets. This value does not override
853	net.core.wmem_max.  Calling setsockopt() with SO_SNDBUF disables
854	automatic tuning of that socket's send buffer size, in which case
855	this value is ignored.
856
857	Default: between 64K and 4MB, depending on RAM size.
858
859tcp_notsent_lowat - UNSIGNED INTEGER
860	A TCP socket can control the amount of unsent bytes in its write queue,
861	thanks to TCP_NOTSENT_LOWAT socket option. poll()/select()/epoll()
862	reports POLLOUT events if the amount of unsent bytes is below a per
863	socket value, and if the write queue is not full. sendmsg() will
864	also not add new buffers if the limit is hit.
865
866	This global variable controls the amount of unsent data for
867	sockets not using TCP_NOTSENT_LOWAT. For these sockets, a change
868	to the global variable has immediate effect.
869
870	Default: UINT_MAX (0xFFFFFFFF)
871
872tcp_workaround_signed_windows - BOOLEAN
873	If set, assume no receipt of a window scaling option means the
874	remote TCP is broken and treats the window as a signed quantity.
875	If unset, assume the remote TCP is not broken even if we do
876	not receive a window scaling option from them.
877
878	Default: 0
879
880tcp_thin_linear_timeouts - BOOLEAN
881	Enable dynamic triggering of linear timeouts for thin streams.
882	If set, a check is performed upon retransmission by timeout to
883	determine if the stream is thin (less than 4 packets in flight).
884	As long as the stream is found to be thin, up to 6 linear
885	timeouts may be performed before exponential backoff mode is
886	initiated. This improves retransmission latency for
887	non-aggressive thin streams, often found to be time-dependent.
888	For more information on thin streams, see
889	Documentation/networking/tcp-thin.txt
890
891	Default: 0
892
893tcp_limit_output_bytes - INTEGER
894	Controls TCP Small Queue limit per tcp socket.
895	TCP bulk sender tends to increase packets in flight until it
896	gets losses notifications. With SNDBUF autotuning, this can
897	result in a large amount of packets queued on the local machine
898	(e.g.: qdiscs, CPU backlog, or device) hurting latency of other
899	flows, for typical pfifo_fast qdiscs.  tcp_limit_output_bytes
900	limits the number of bytes on qdisc or device to reduce artificial
901	RTT/cwnd and reduce bufferbloat.
902
903	Default: 1048576 (16 * 65536)
904
905tcp_challenge_ack_limit - INTEGER
906	Limits number of Challenge ACK sent per second, as recommended
907	in RFC 5961 (Improving TCP's Robustness to Blind In-Window Attacks)
908	Default: 1000
909
910tcp_rx_skb_cache - BOOLEAN
911	Controls a per TCP socket cache of one skb, that might help
912	performance of some workloads. This might be dangerous
913	on systems with a lot of TCP sockets, since it increases
914	memory usage.
915
916	Default: 0 (disabled)
917
918UDP variables
919=============
920
921udp_l3mdev_accept - BOOLEAN
922	Enabling this option allows a "global" bound socket to work
923	across L3 master domains (e.g., VRFs) with packets capable of
924	being received regardless of the L3 domain in which they
925	originated. Only valid when the kernel was compiled with
926	CONFIG_NET_L3_MASTER_DEV.
927
928	Default: 0 (disabled)
929
930udp_mem - vector of 3 INTEGERs: min, pressure, max
931	Number of pages allowed for queueing by all UDP sockets.
932
933	min: Below this number of pages UDP is not bothered about its
934	memory appetite. When amount of memory allocated by UDP exceeds
935	this number, UDP starts to moderate memory usage.
936
937	pressure: This value was introduced to follow format of tcp_mem.
938
939	max: Number of pages allowed for queueing by all UDP sockets.
940
941	Default is calculated at boot time from amount of available memory.
942
943udp_rmem_min - INTEGER
944	Minimal size of receive buffer used by UDP sockets in moderation.
945	Each UDP socket is able to use the size for receiving data, even if
946	total pages of UDP sockets exceed udp_mem pressure. The unit is byte.
947
948	Default: 4K
949
950udp_wmem_min - INTEGER
951	Minimal size of send buffer used by UDP sockets in moderation.
952	Each UDP socket is able to use the size for sending data, even if
953	total pages of UDP sockets exceed udp_mem pressure. The unit is byte.
954
955	Default: 4K
956
957RAW variables
958=============
959
960raw_l3mdev_accept - BOOLEAN
961	Enabling this option allows a "global" bound socket to work
962	across L3 master domains (e.g., VRFs) with packets capable of
963	being received regardless of the L3 domain in which they
964	originated. Only valid when the kernel was compiled with
965	CONFIG_NET_L3_MASTER_DEV.
966
967	Default: 1 (enabled)
968
969CIPSOv4 Variables
970=================
971
972cipso_cache_enable - BOOLEAN
973	If set, enable additions to and lookups from the CIPSO label mapping
974	cache.  If unset, additions are ignored and lookups always result in a
975	miss.  However, regardless of the setting the cache is still
976	invalidated when required when means you can safely toggle this on and
977	off and the cache will always be "safe".
978
979	Default: 1
980
981cipso_cache_bucket_size - INTEGER
982	The CIPSO label cache consists of a fixed size hash table with each
983	hash bucket containing a number of cache entries.  This variable limits
984	the number of entries in each hash bucket; the larger the value the
985	more CIPSO label mappings that can be cached.  When the number of
986	entries in a given hash bucket reaches this limit adding new entries
987	causes the oldest entry in the bucket to be removed to make room.
988
989	Default: 10
990
991cipso_rbm_optfmt - BOOLEAN
992	Enable the "Optimized Tag 1 Format" as defined in section 3.4.2.6 of
993	the CIPSO draft specification (see Documentation/netlabel for details).
994	This means that when set the CIPSO tag will be padded with empty
995	categories in order to make the packet data 32-bit aligned.
996
997	Default: 0
998
999cipso_rbm_structvalid - BOOLEAN
1000	If set, do a very strict check of the CIPSO option when
1001	ip_options_compile() is called.  If unset, relax the checks done during
1002	ip_options_compile().  Either way is "safe" as errors are caught else
1003	where in the CIPSO processing code but setting this to 0 (False) should
1004	result in less work (i.e. it should be faster) but could cause problems
1005	with other implementations that require strict checking.
1006
1007	Default: 0
1008
1009IP Variables
1010============
1011
1012ip_local_port_range - 2 INTEGERS
1013	Defines the local port range that is used by TCP and UDP to
1014	choose the local port. The first number is the first, the
1015	second the last local port number.
1016	If possible, it is better these numbers have different parity
1017	(one even and one odd value).
1018	Must be greater than or equal to ip_unprivileged_port_start.
1019	The default values are 32768 and 60999 respectively.
1020
1021ip_local_reserved_ports - list of comma separated ranges
1022	Specify the ports which are reserved for known third-party
1023	applications. These ports will not be used by automatic port
1024	assignments (e.g. when calling connect() or bind() with port
1025	number 0). Explicit port allocation behavior is unchanged.
1026
1027	The format used for both input and output is a comma separated
1028	list of ranges (e.g. "1,2-4,10-10" for ports 1, 2, 3, 4 and
1029	10). Writing to the file will clear all previously reserved
1030	ports and update the current list with the one given in the
1031	input.
1032
1033	Note that ip_local_port_range and ip_local_reserved_ports
1034	settings are independent and both are considered by the kernel
1035	when determining which ports are available for automatic port
1036	assignments.
1037
1038	You can reserve ports which are not in the current
1039	ip_local_port_range, e.g.::
1040
1041	    $ cat /proc/sys/net/ipv4/ip_local_port_range
1042	    32000	60999
1043	    $ cat /proc/sys/net/ipv4/ip_local_reserved_ports
1044	    8080,9148
1045
1046	although this is redundant. However such a setting is useful
1047	if later the port range is changed to a value that will
1048	include the reserved ports.
1049
1050	Default: Empty
1051
1052ip_unprivileged_port_start - INTEGER
1053	This is a per-namespace sysctl.  It defines the first
1054	unprivileged port in the network namespace.  Privileged ports
1055	require root or CAP_NET_BIND_SERVICE in order to bind to them.
1056	To disable all privileged ports, set this to 0.  They must not
1057	overlap with the ip_local_port_range.
1058
1059	Default: 1024
1060
1061ip_nonlocal_bind - BOOLEAN
1062	If set, allows processes to bind() to non-local IP addresses,
1063	which can be quite useful - but may break some applications.
1064
1065	Default: 0
1066
1067ip_autobind_reuse - BOOLEAN
1068	By default, bind() does not select the ports automatically even if
1069	the new socket and all sockets bound to the port have SO_REUSEADDR.
1070	ip_autobind_reuse allows bind() to reuse the port and this is useful
1071	when you use bind()+connect(), but may break some applications.
1072	The preferred solution is to use IP_BIND_ADDRESS_NO_PORT and this
1073	option should only be set by experts.
1074	Default: 0
1075
1076ip_dynaddr - BOOLEAN
1077	If set non-zero, enables support for dynamic addresses.
1078	If set to a non-zero value larger than 1, a kernel log
1079	message will be printed when dynamic address rewriting
1080	occurs.
1081
1082	Default: 0
1083
1084ip_early_demux - BOOLEAN
1085	Optimize input packet processing down to one demux for
1086	certain kinds of local sockets.  Currently we only do this
1087	for established TCP and connected UDP sockets.
1088
1089	It may add an additional cost for pure routing workloads that
1090	reduces overall throughput, in such case you should disable it.
1091
1092	Default: 1
1093
1094ping_group_range - 2 INTEGERS
1095	Restrict ICMP_PROTO datagram sockets to users in the group range.
1096	The default is "1 0", meaning, that nobody (not even root) may
1097	create ping sockets.  Setting it to "100 100" would grant permissions
1098	to the single group. "0 4294967295" would enable it for the world, "100
1099	4294967295" would enable it for the users, but not daemons.
1100
1101tcp_early_demux - BOOLEAN
1102	Enable early demux for established TCP sockets.
1103
1104	Default: 1
1105
1106udp_early_demux - BOOLEAN
1107	Enable early demux for connected UDP sockets. Disable this if
1108	your system could experience more unconnected load.
1109
1110	Default: 1
1111
1112icmp_echo_ignore_all - BOOLEAN
1113	If set non-zero, then the kernel will ignore all ICMP ECHO
1114	requests sent to it.
1115
1116	Default: 0
1117
1118icmp_echo_ignore_broadcasts - BOOLEAN
1119	If set non-zero, then the kernel will ignore all ICMP ECHO and
1120	TIMESTAMP requests sent to it via broadcast/multicast.
1121
1122	Default: 1
1123
1124icmp_ratelimit - INTEGER
1125	Limit the maximal rates for sending ICMP packets whose type matches
1126	icmp_ratemask (see below) to specific targets.
1127	0 to disable any limiting,
1128	otherwise the minimal space between responses in milliseconds.
1129	Note that another sysctl, icmp_msgs_per_sec limits the number
1130	of ICMP packets	sent on all targets.
1131
1132	Default: 1000
1133
1134icmp_msgs_per_sec - INTEGER
1135	Limit maximal number of ICMP packets sent per second from this host.
1136	Only messages whose type matches icmp_ratemask (see below) are
1137	controlled by this limit.
1138
1139	Default: 1000
1140
1141icmp_msgs_burst - INTEGER
1142	icmp_msgs_per_sec controls number of ICMP packets sent per second,
1143	while icmp_msgs_burst controls the burst size of these packets.
1144
1145	Default: 50
1146
1147icmp_ratemask - INTEGER
1148	Mask made of ICMP types for which rates are being limited.
1149
1150	Significant bits: IHGFEDCBA9876543210
1151
1152	Default mask:     0000001100000011000 (6168)
1153
1154	Bit definitions (see include/linux/icmp.h):
1155
1156		= =========================
1157		0 Echo Reply
1158		3 Destination Unreachable [1]_
1159		4 Source Quench [1]_
1160		5 Redirect
1161		8 Echo Request
1162		B Time Exceeded [1]_
1163		C Parameter Problem [1]_
1164		D Timestamp Request
1165		E Timestamp Reply
1166		F Info Request
1167		G Info Reply
1168		H Address Mask Request
1169		I Address Mask Reply
1170		= =========================
1171
1172	.. [1] These are rate limited by default (see default mask above)
1173
1174icmp_ignore_bogus_error_responses - BOOLEAN
1175	Some routers violate RFC1122 by sending bogus responses to broadcast
1176	frames.  Such violations are normally logged via a kernel warning.
1177	If this is set to TRUE, the kernel will not give such warnings, which
1178	will avoid log file clutter.
1179
1180	Default: 1
1181
1182icmp_errors_use_inbound_ifaddr - BOOLEAN
1183
1184	If zero, icmp error messages are sent with the primary address of
1185	the exiting interface.
1186
1187	If non-zero, the message will be sent with the primary address of
1188	the interface that received the packet that caused the icmp error.
1189	This is the behaviour network many administrators will expect from
1190	a router. And it can make debugging complicated network layouts
1191	much easier.
1192
1193	Note that if no primary address exists for the interface selected,
1194	then the primary address of the first non-loopback interface that
1195	has one will be used regardless of this setting.
1196
1197	Default: 0
1198
1199igmp_max_memberships - INTEGER
1200	Change the maximum number of multicast groups we can subscribe to.
1201	Default: 20
1202
1203	Theoretical maximum value is bounded by having to send a membership
1204	report in a single datagram (i.e. the report can't span multiple
1205	datagrams, or risk confusing the switch and leaving groups you don't
1206	intend to).
1207
1208	The number of supported groups 'M' is bounded by the number of group
1209	report entries you can fit into a single datagram of 65535 bytes.
1210
1211	M = 65536-sizeof (ip header)/(sizeof(Group record))
1212
1213	Group records are variable length, with a minimum of 12 bytes.
1214	So net.ipv4.igmp_max_memberships should not be set higher than:
1215
1216	(65536-24) / 12 = 5459
1217
1218	The value 5459 assumes no IP header options, so in practice
1219	this number may be lower.
1220
1221igmp_max_msf - INTEGER
1222	Maximum number of addresses allowed in the source filter list for a
1223	multicast group.
1224
1225	Default: 10
1226
1227igmp_qrv - INTEGER
1228	Controls the IGMP query robustness variable (see RFC2236 8.1).
1229
1230	Default: 2 (as specified by RFC2236 8.1)
1231
1232	Minimum: 1 (as specified by RFC6636 4.5)
1233
1234force_igmp_version - INTEGER
1235	- 0 - (default) No enforcement of a IGMP version, IGMPv1/v2 fallback
1236	  allowed. Will back to IGMPv3 mode again if all IGMPv1/v2 Querier
1237	  Present timer expires.
1238	- 1 - Enforce to use IGMP version 1. Will also reply IGMPv1 report if
1239	  receive IGMPv2/v3 query.
1240	- 2 - Enforce to use IGMP version 2. Will fallback to IGMPv1 if receive
1241	  IGMPv1 query message. Will reply report if receive IGMPv3 query.
1242	- 3 - Enforce to use IGMP version 3. The same react with default 0.
1243
1244	.. note::
1245
1246	   this is not the same with force_mld_version because IGMPv3 RFC3376
1247	   Security Considerations does not have clear description that we could
1248	   ignore other version messages completely as MLDv2 RFC3810. So make
1249	   this value as default 0 is recommended.
1250
1251``conf/interface/*``
1252	changes special settings per interface (where
1253	interface" is the name of your network interface)
1254
1255``conf/all/*``
1256	  is special, changes the settings for all interfaces
1257
1258log_martians - BOOLEAN
1259	Log packets with impossible addresses to kernel log.
1260	log_martians for the interface will be enabled if at least one of
1261	conf/{all,interface}/log_martians is set to TRUE,
1262	it will be disabled otherwise
1263
1264accept_redirects - BOOLEAN
1265	Accept ICMP redirect messages.
1266	accept_redirects for the interface will be enabled if:
1267
1268	- both conf/{all,interface}/accept_redirects are TRUE in the case
1269	  forwarding for the interface is enabled
1270
1271	or
1272
1273	- at least one of conf/{all,interface}/accept_redirects is TRUE in the
1274	  case forwarding for the interface is disabled
1275
1276	accept_redirects for the interface will be disabled otherwise
1277
1278	default:
1279
1280		- TRUE (host)
1281		- FALSE (router)
1282
1283forwarding - BOOLEAN
1284	Enable IP forwarding on this interface.  This controls whether packets
1285	received _on_ this interface can be forwarded.
1286
1287mc_forwarding - BOOLEAN
1288	Do multicast routing. The kernel needs to be compiled with CONFIG_MROUTE
1289	and a multicast routing daemon is required.
1290	conf/all/mc_forwarding must also be set to TRUE to enable multicast
1291	routing	for the interface
1292
1293medium_id - INTEGER
1294	Integer value used to differentiate the devices by the medium they
1295	are attached to. Two devices can have different id values when
1296	the broadcast packets are received only on one of them.
1297	The default value 0 means that the device is the only interface
1298	to its medium, value of -1 means that medium is not known.
1299
1300	Currently, it is used to change the proxy_arp behavior:
1301	the proxy_arp feature is enabled for packets forwarded between
1302	two devices attached to different media.
1303
1304proxy_arp - BOOLEAN
1305	Do proxy arp.
1306
1307	proxy_arp for the interface will be enabled if at least one of
1308	conf/{all,interface}/proxy_arp is set to TRUE,
1309	it will be disabled otherwise
1310
1311proxy_arp_pvlan - BOOLEAN
1312	Private VLAN proxy arp.
1313
1314	Basically allow proxy arp replies back to the same interface
1315	(from which the ARP request/solicitation was received).
1316
1317	This is done to support (ethernet) switch features, like RFC
1318	3069, where the individual ports are NOT allowed to
1319	communicate with each other, but they are allowed to talk to
1320	the upstream router.  As described in RFC 3069, it is possible
1321	to allow these hosts to communicate through the upstream
1322	router by proxy_arp'ing. Don't need to be used together with
1323	proxy_arp.
1324
1325	This technology is known by different names:
1326
1327	  In RFC 3069 it is called VLAN Aggregation.
1328	  Cisco and Allied Telesyn call it Private VLAN.
1329	  Hewlett-Packard call it Source-Port filtering or port-isolation.
1330	  Ericsson call it MAC-Forced Forwarding (RFC Draft).
1331
1332shared_media - BOOLEAN
1333	Send(router) or accept(host) RFC1620 shared media redirects.
1334	Overrides secure_redirects.
1335
1336	shared_media for the interface will be enabled if at least one of
1337	conf/{all,interface}/shared_media is set to TRUE,
1338	it will be disabled otherwise
1339
1340	default TRUE
1341
1342secure_redirects - BOOLEAN
1343	Accept ICMP redirect messages only to gateways listed in the
1344	interface's current gateway list. Even if disabled, RFC1122 redirect
1345	rules still apply.
1346
1347	Overridden by shared_media.
1348
1349	secure_redirects for the interface will be enabled if at least one of
1350	conf/{all,interface}/secure_redirects is set to TRUE,
1351	it will be disabled otherwise
1352
1353	default TRUE
1354
1355send_redirects - BOOLEAN
1356	Send redirects, if router.
1357
1358	send_redirects for the interface will be enabled if at least one of
1359	conf/{all,interface}/send_redirects is set to TRUE,
1360	it will be disabled otherwise
1361
1362	Default: TRUE
1363
1364bootp_relay - BOOLEAN
1365	Accept packets with source address 0.b.c.d destined
1366	not to this host as local ones. It is supposed, that
1367	BOOTP relay daemon will catch and forward such packets.
1368	conf/all/bootp_relay must also be set to TRUE to enable BOOTP relay
1369	for the interface
1370
1371	default FALSE
1372
1373	Not Implemented Yet.
1374
1375accept_source_route - BOOLEAN
1376	Accept packets with SRR option.
1377	conf/all/accept_source_route must also be set to TRUE to accept packets
1378	with SRR option on the interface
1379
1380	default
1381
1382		- TRUE (router)
1383		- FALSE (host)
1384
1385accept_local - BOOLEAN
1386	Accept packets with local source addresses. In combination with
1387	suitable routing, this can be used to direct packets between two
1388	local interfaces over the wire and have them accepted properly.
1389	default FALSE
1390
1391route_localnet - BOOLEAN
1392	Do not consider loopback addresses as martian source or destination
1393	while routing. This enables the use of 127/8 for local routing purposes.
1394
1395	default FALSE
1396
1397rp_filter - INTEGER
1398	- 0 - No source validation.
1399	- 1 - Strict mode as defined in RFC3704 Strict Reverse Path
1400	  Each incoming packet is tested against the FIB and if the interface
1401	  is not the best reverse path the packet check will fail.
1402	  By default failed packets are discarded.
1403	- 2 - Loose mode as defined in RFC3704 Loose Reverse Path
1404	  Each incoming packet's source address is also tested against the FIB
1405	  and if the source address is not reachable via any interface
1406	  the packet check will fail.
1407
1408	Current recommended practice in RFC3704 is to enable strict mode
1409	to prevent IP spoofing from DDos attacks. If using asymmetric routing
1410	or other complicated routing, then loose mode is recommended.
1411
1412	The max value from conf/{all,interface}/rp_filter is used
1413	when doing source validation on the {interface}.
1414
1415	Default value is 0. Note that some distributions enable it
1416	in startup scripts.
1417
1418arp_filter - BOOLEAN
1419	- 1 - Allows you to have multiple network interfaces on the same
1420	  subnet, and have the ARPs for each interface be answered
1421	  based on whether or not the kernel would route a packet from
1422	  the ARP'd IP out that interface (therefore you must use source
1423	  based routing for this to work). In other words it allows control
1424	  of which cards (usually 1) will respond to an arp request.
1425
1426	- 0 - (default) The kernel can respond to arp requests with addresses
1427	  from other interfaces. This may seem wrong but it usually makes
1428	  sense, because it increases the chance of successful communication.
1429	  IP addresses are owned by the complete host on Linux, not by
1430	  particular interfaces. Only for more complex setups like load-
1431	  balancing, does this behaviour cause problems.
1432
1433	arp_filter for the interface will be enabled if at least one of
1434	conf/{all,interface}/arp_filter is set to TRUE,
1435	it will be disabled otherwise
1436
1437arp_announce - INTEGER
1438	Define different restriction levels for announcing the local
1439	source IP address from IP packets in ARP requests sent on
1440	interface:
1441
1442	- 0 - (default) Use any local address, configured on any interface
1443	- 1 - Try to avoid local addresses that are not in the target's
1444	  subnet for this interface. This mode is useful when target
1445	  hosts reachable via this interface require the source IP
1446	  address in ARP requests to be part of their logical network
1447	  configured on the receiving interface. When we generate the
1448	  request we will check all our subnets that include the
1449	  target IP and will preserve the source address if it is from
1450	  such subnet. If there is no such subnet we select source
1451	  address according to the rules for level 2.
1452	- 2 - Always use the best local address for this target.
1453	  In this mode we ignore the source address in the IP packet
1454	  and try to select local address that we prefer for talks with
1455	  the target host. Such local address is selected by looking
1456	  for primary IP addresses on all our subnets on the outgoing
1457	  interface that include the target IP address. If no suitable
1458	  local address is found we select the first local address
1459	  we have on the outgoing interface or on all other interfaces,
1460	  with the hope we will receive reply for our request and
1461	  even sometimes no matter the source IP address we announce.
1462
1463	The max value from conf/{all,interface}/arp_announce is used.
1464
1465	Increasing the restriction level gives more chance for
1466	receiving answer from the resolved target while decreasing
1467	the level announces more valid sender's information.
1468
1469arp_ignore - INTEGER
1470	Define different modes for sending replies in response to
1471	received ARP requests that resolve local target IP addresses:
1472
1473	- 0 - (default): reply for any local target IP address, configured
1474	  on any interface
1475	- 1 - reply only if the target IP address is local address
1476	  configured on the incoming interface
1477	- 2 - reply only if the target IP address is local address
1478	  configured on the incoming interface and both with the
1479	  sender's IP address are part from same subnet on this interface
1480	- 3 - do not reply for local addresses configured with scope host,
1481	  only resolutions for global and link addresses are replied
1482	- 4-7 - reserved
1483	- 8 - do not reply for all local addresses
1484
1485	The max value from conf/{all,interface}/arp_ignore is used
1486	when ARP request is received on the {interface}
1487
1488arp_notify - BOOLEAN
1489	Define mode for notification of address and device changes.
1490
1491	 ==  ==========================================================
1492	  0  (default): do nothing
1493	  1  Generate gratuitous arp requests when device is brought up
1494	     or hardware address changes.
1495	 ==  ==========================================================
1496
1497arp_accept - BOOLEAN
1498	Define behavior for gratuitous ARP frames who's IP is not
1499	already present in the ARP table:
1500
1501	- 0 - don't create new entries in the ARP table
1502	- 1 - create new entries in the ARP table
1503
1504	Both replies and requests type gratuitous arp will trigger the
1505	ARP table to be updated, if this setting is on.
1506
1507	If the ARP table already contains the IP address of the
1508	gratuitous arp frame, the arp table will be updated regardless
1509	if this setting is on or off.
1510
1511mcast_solicit - INTEGER
1512	The maximum number of multicast probes in INCOMPLETE state,
1513	when the associated hardware address is unknown.  Defaults
1514	to 3.
1515
1516ucast_solicit - INTEGER
1517	The maximum number of unicast probes in PROBE state, when
1518	the hardware address is being reconfirmed.  Defaults to 3.
1519
1520app_solicit - INTEGER
1521	The maximum number of probes to send to the user space ARP daemon
1522	via netlink before dropping back to multicast probes (see
1523	mcast_resolicit).  Defaults to 0.
1524
1525mcast_resolicit - INTEGER
1526	The maximum number of multicast probes after unicast and
1527	app probes in PROBE state.  Defaults to 0.
1528
1529disable_policy - BOOLEAN
1530	Disable IPSEC policy (SPD) for this interface
1531
1532disable_xfrm - BOOLEAN
1533	Disable IPSEC encryption on this interface, whatever the policy
1534
1535igmpv2_unsolicited_report_interval - INTEGER
1536	The interval in milliseconds in which the next unsolicited
1537	IGMPv1 or IGMPv2 report retransmit will take place.
1538
1539	Default: 10000 (10 seconds)
1540
1541igmpv3_unsolicited_report_interval - INTEGER
1542	The interval in milliseconds in which the next unsolicited
1543	IGMPv3 report retransmit will take place.
1544
1545	Default: 1000 (1 seconds)
1546
1547promote_secondaries - BOOLEAN
1548	When a primary IP address is removed from this interface
1549	promote a corresponding secondary IP address instead of
1550	removing all the corresponding secondary IP addresses.
1551
1552drop_unicast_in_l2_multicast - BOOLEAN
1553	Drop any unicast IP packets that are received in link-layer
1554	multicast (or broadcast) frames.
1555
1556	This behavior (for multicast) is actually a SHOULD in RFC
1557	1122, but is disabled by default for compatibility reasons.
1558
1559	Default: off (0)
1560
1561drop_gratuitous_arp - BOOLEAN
1562	Drop all gratuitous ARP frames, for example if there's a known
1563	good ARP proxy on the network and such frames need not be used
1564	(or in the case of 802.11, must not be used to prevent attacks.)
1565
1566	Default: off (0)
1567
1568
1569tag - INTEGER
1570	Allows you to write a number, which can be used as required.
1571
1572	Default value is 0.
1573
1574xfrm4_gc_thresh - INTEGER
1575	(Obsolete since linux-4.14)
1576	The threshold at which we will start garbage collecting for IPv4
1577	destination cache entries.  At twice this value the system will
1578	refuse new allocations.
1579
1580igmp_link_local_mcast_reports - BOOLEAN
1581	Enable IGMP reports for link local multicast groups in the
1582	224.0.0.X range.
1583
1584	Default TRUE
1585
1586Alexey Kuznetsov.
1587kuznet@ms2.inr.ac.ru
1588
1589Updated by:
1590
1591- Andi Kleen
1592  ak@muc.de
1593- Nicolas Delon
1594  delon.nicolas@wanadoo.fr
1595
1596
1597
1598
1599/proc/sys/net/ipv6/* Variables
1600==============================
1601
1602IPv6 has no global variables such as tcp_*.  tcp_* settings under ipv4/ also
1603apply to IPv6 [XXX?].
1604
1605bindv6only - BOOLEAN
1606	Default value for IPV6_V6ONLY socket option,
1607	which restricts use of the IPv6 socket to IPv6 communication
1608	only.
1609
1610		- TRUE: disable IPv4-mapped address feature
1611		- FALSE: enable IPv4-mapped address feature
1612
1613	Default: FALSE (as specified in RFC3493)
1614
1615flowlabel_consistency - BOOLEAN
1616	Protect the consistency (and unicity) of flow label.
1617	You have to disable it to use IPV6_FL_F_REFLECT flag on the
1618	flow label manager.
1619
1620	- TRUE: enabled
1621	- FALSE: disabled
1622
1623	Default: TRUE
1624
1625auto_flowlabels - INTEGER
1626	Automatically generate flow labels based on a flow hash of the
1627	packet. This allows intermediate devices, such as routers, to
1628	identify packet flows for mechanisms like Equal Cost Multipath
1629	Routing (see RFC 6438).
1630
1631	=  ===========================================================
1632	0  automatic flow labels are completely disabled
1633	1  automatic flow labels are enabled by default, they can be
1634	   disabled on a per socket basis using the IPV6_AUTOFLOWLABEL
1635	   socket option
1636	2  automatic flow labels are allowed, they may be enabled on a
1637	   per socket basis using the IPV6_AUTOFLOWLABEL socket option
1638	3  automatic flow labels are enabled and enforced, they cannot
1639	   be disabled by the socket option
1640	=  ===========================================================
1641
1642	Default: 1
1643
1644flowlabel_state_ranges - BOOLEAN
1645	Split the flow label number space into two ranges. 0-0x7FFFF is
1646	reserved for the IPv6 flow manager facility, 0x80000-0xFFFFF
1647	is reserved for stateless flow labels as described in RFC6437.
1648
1649	- TRUE: enabled
1650	- FALSE: disabled
1651
1652	Default: true
1653
1654flowlabel_reflect - INTEGER
1655	Control flow label reflection. Needed for Path MTU
1656	Discovery to work with Equal Cost Multipath Routing in anycast
1657	environments. See RFC 7690 and:
1658	https://tools.ietf.org/html/draft-wang-6man-flow-label-reflection-01
1659
1660	This is a bitmask.
1661
1662	- 1: enabled for established flows
1663
1664	  Note that this prevents automatic flowlabel changes, as done
1665	  in "tcp: change IPv6 flow-label upon receiving spurious retransmission"
1666	  and "tcp: Change txhash on every SYN and RTO retransmit"
1667
1668	- 2: enabled for TCP RESET packets (no active listener)
1669	  If set, a RST packet sent in response to a SYN packet on a closed
1670	  port will reflect the incoming flow label.
1671
1672	- 4: enabled for ICMPv6 echo reply messages.
1673
1674	Default: 0
1675
1676fib_multipath_hash_policy - INTEGER
1677	Controls which hash policy to use for multipath routes.
1678
1679	Default: 0 (Layer 3)
1680
1681	Possible values:
1682
1683	- 0 - Layer 3 (source and destination addresses plus flow label)
1684	- 1 - Layer 4 (standard 5-tuple)
1685	- 2 - Layer 3 or inner Layer 3 if present
1686
1687anycast_src_echo_reply - BOOLEAN
1688	Controls the use of anycast addresses as source addresses for ICMPv6
1689	echo reply
1690
1691	- TRUE:  enabled
1692	- FALSE: disabled
1693
1694	Default: FALSE
1695
1696idgen_delay - INTEGER
1697	Controls the delay in seconds after which time to retry
1698	privacy stable address generation if a DAD conflict is
1699	detected.
1700
1701	Default: 1 (as specified in RFC7217)
1702
1703idgen_retries - INTEGER
1704	Controls the number of retries to generate a stable privacy
1705	address if a DAD conflict is detected.
1706
1707	Default: 3 (as specified in RFC7217)
1708
1709mld_qrv - INTEGER
1710	Controls the MLD query robustness variable (see RFC3810 9.1).
1711
1712	Default: 2 (as specified by RFC3810 9.1)
1713
1714	Minimum: 1 (as specified by RFC6636 4.5)
1715
1716max_dst_opts_number - INTEGER
1717	Maximum number of non-padding TLVs allowed in a Destination
1718	options extension header. If this value is less than zero
1719	then unknown options are disallowed and the number of known
1720	TLVs allowed is the absolute value of this number.
1721
1722	Default: 8
1723
1724max_hbh_opts_number - INTEGER
1725	Maximum number of non-padding TLVs allowed in a Hop-by-Hop
1726	options extension header. If this value is less than zero
1727	then unknown options are disallowed and the number of known
1728	TLVs allowed is the absolute value of this number.
1729
1730	Default: 8
1731
1732max_dst_opts_length - INTEGER
1733	Maximum length allowed for a Destination options extension
1734	header.
1735
1736	Default: INT_MAX (unlimited)
1737
1738max_hbh_length - INTEGER
1739	Maximum length allowed for a Hop-by-Hop options extension
1740	header.
1741
1742	Default: INT_MAX (unlimited)
1743
1744skip_notify_on_dev_down - BOOLEAN
1745	Controls whether an RTM_DELROUTE message is generated for routes
1746	removed when a device is taken down or deleted. IPv4 does not
1747	generate this message; IPv6 does by default. Setting this sysctl
1748	to true skips the message, making IPv4 and IPv6 on par in relying
1749	on userspace caches to track link events and evict routes.
1750
1751	Default: false (generate message)
1752
1753nexthop_compat_mode - BOOLEAN
1754	New nexthop API provides a means for managing nexthops independent of
1755	prefixes. Backwards compatibilty with old route format is enabled by
1756	default which means route dumps and notifications contain the new
1757	nexthop attribute but also the full, expanded nexthop definition.
1758	Further, updates or deletes of a nexthop configuration generate route
1759	notifications for each fib entry using the nexthop. Once a system
1760	understands the new API, this sysctl can be disabled to achieve full
1761	performance benefits of the new API by disabling the nexthop expansion
1762	and extraneous notifications.
1763	Default: true (backward compat mode)
1764
1765IPv6 Fragmentation:
1766
1767ip6frag_high_thresh - INTEGER
1768	Maximum memory used to reassemble IPv6 fragments. When
1769	ip6frag_high_thresh bytes of memory is allocated for this purpose,
1770	the fragment handler will toss packets until ip6frag_low_thresh
1771	is reached.
1772
1773ip6frag_low_thresh - INTEGER
1774	See ip6frag_high_thresh
1775
1776ip6frag_time - INTEGER
1777	Time in seconds to keep an IPv6 fragment in memory.
1778
1779IPv6 Segment Routing:
1780
1781seg6_flowlabel - INTEGER
1782	Controls the behaviour of computing the flowlabel of outer
1783	IPv6 header in case of SR T.encaps
1784
1785	 == =======================================================
1786	 -1  set flowlabel to zero.
1787	  0  copy flowlabel from Inner packet in case of Inner IPv6
1788	     (Set flowlabel to 0 in case IPv4/L2)
1789	  1  Compute the flowlabel using seg6_make_flowlabel()
1790	 == =======================================================
1791
1792	Default is 0.
1793
1794``conf/default/*``:
1795	Change the interface-specific default settings.
1796
1797
1798``conf/all/*``:
1799	Change all the interface-specific settings.
1800
1801	[XXX:  Other special features than forwarding?]
1802
1803conf/all/forwarding - BOOLEAN
1804	Enable global IPv6 forwarding between all interfaces.
1805
1806	IPv4 and IPv6 work differently here; e.g. netfilter must be used
1807	to control which interfaces may forward packets and which not.
1808
1809	This also sets all interfaces' Host/Router setting
1810	'forwarding' to the specified value.  See below for details.
1811
1812	This referred to as global forwarding.
1813
1814proxy_ndp - BOOLEAN
1815	Do proxy ndp.
1816
1817fwmark_reflect - BOOLEAN
1818	Controls the fwmark of kernel-generated IPv6 reply packets that are not
1819	associated with a socket for example, TCP RSTs or ICMPv6 echo replies).
1820	If unset, these packets have a fwmark of zero. If set, they have the
1821	fwmark of the packet they are replying to.
1822
1823	Default: 0
1824
1825``conf/interface/*``:
1826	Change special settings per interface.
1827
1828	The functional behaviour for certain settings is different
1829	depending on whether local forwarding is enabled or not.
1830
1831accept_ra - INTEGER
1832	Accept Router Advertisements; autoconfigure using them.
1833
1834	It also determines whether or not to transmit Router
1835	Solicitations. If and only if the functional setting is to
1836	accept Router Advertisements, Router Solicitations will be
1837	transmitted.
1838
1839	Possible values are:
1840
1841		==  ===========================================================
1842		 0  Do not accept Router Advertisements.
1843		 1  Accept Router Advertisements if forwarding is disabled.
1844		 2  Overrule forwarding behaviour. Accept Router Advertisements
1845		    even if forwarding is enabled.
1846		==  ===========================================================
1847
1848	Functional default:
1849
1850		- enabled if local forwarding is disabled.
1851		- disabled if local forwarding is enabled.
1852
1853accept_ra_defrtr - BOOLEAN
1854	Learn default router in Router Advertisement.
1855
1856	Functional default:
1857
1858		- enabled if accept_ra is enabled.
1859		- disabled if accept_ra is disabled.
1860
1861accept_ra_from_local - BOOLEAN
1862	Accept RA with source-address that is found on local machine
1863	if the RA is otherwise proper and able to be accepted.
1864
1865	Default is to NOT accept these as it may be an un-intended
1866	network loop.
1867
1868	Functional default:
1869
1870	   - enabled if accept_ra_from_local is enabled
1871	     on a specific interface.
1872	   - disabled if accept_ra_from_local is disabled
1873	     on a specific interface.
1874
1875accept_ra_min_hop_limit - INTEGER
1876	Minimum hop limit Information in Router Advertisement.
1877
1878	Hop limit Information in Router Advertisement less than this
1879	variable shall be ignored.
1880
1881	Default: 1
1882
1883accept_ra_pinfo - BOOLEAN
1884	Learn Prefix Information in Router Advertisement.
1885
1886	Functional default:
1887
1888		- enabled if accept_ra is enabled.
1889		- disabled if accept_ra is disabled.
1890
1891accept_ra_rt_info_min_plen - INTEGER
1892	Minimum prefix length of Route Information in RA.
1893
1894	Route Information w/ prefix smaller than this variable shall
1895	be ignored.
1896
1897	Functional default:
1898
1899		* 0 if accept_ra_rtr_pref is enabled.
1900		* -1 if accept_ra_rtr_pref is disabled.
1901
1902accept_ra_rt_info_max_plen - INTEGER
1903	Maximum prefix length of Route Information in RA.
1904
1905	Route Information w/ prefix larger than this variable shall
1906	be ignored.
1907
1908	Functional default:
1909
1910		* 0 if accept_ra_rtr_pref is enabled.
1911		* -1 if accept_ra_rtr_pref is disabled.
1912
1913accept_ra_rtr_pref - BOOLEAN
1914	Accept Router Preference in RA.
1915
1916	Functional default:
1917
1918		- enabled if accept_ra is enabled.
1919		- disabled if accept_ra is disabled.
1920
1921accept_ra_mtu - BOOLEAN
1922	Apply the MTU value specified in RA option 5 (RFC4861). If
1923	disabled, the MTU specified in the RA will be ignored.
1924
1925	Functional default:
1926
1927		- enabled if accept_ra is enabled.
1928		- disabled if accept_ra is disabled.
1929
1930accept_redirects - BOOLEAN
1931	Accept Redirects.
1932
1933	Functional default:
1934
1935		- enabled if local forwarding is disabled.
1936		- disabled if local forwarding is enabled.
1937
1938accept_source_route - INTEGER
1939	Accept source routing (routing extension header).
1940
1941	- >= 0: Accept only routing header type 2.
1942	- < 0: Do not accept routing header.
1943
1944	Default: 0
1945
1946autoconf - BOOLEAN
1947	Autoconfigure addresses using Prefix Information in Router
1948	Advertisements.
1949
1950	Functional default:
1951
1952		- enabled if accept_ra_pinfo is enabled.
1953		- disabled if accept_ra_pinfo is disabled.
1954
1955dad_transmits - INTEGER
1956	The amount of Duplicate Address Detection probes to send.
1957
1958	Default: 1
1959
1960forwarding - INTEGER
1961	Configure interface-specific Host/Router behaviour.
1962
1963	.. note::
1964
1965	   It is recommended to have the same setting on all
1966	   interfaces; mixed router/host scenarios are rather uncommon.
1967
1968	Possible values are:
1969
1970		- 0 Forwarding disabled
1971		- 1 Forwarding enabled
1972
1973	**FALSE (0)**:
1974
1975	By default, Host behaviour is assumed.  This means:
1976
1977	1. IsRouter flag is not set in Neighbour Advertisements.
1978	2. If accept_ra is TRUE (default), transmit Router
1979	   Solicitations.
1980	3. If accept_ra is TRUE (default), accept Router
1981	   Advertisements (and do autoconfiguration).
1982	4. If accept_redirects is TRUE (default), accept Redirects.
1983
1984	**TRUE (1)**:
1985
1986	If local forwarding is enabled, Router behaviour is assumed.
1987	This means exactly the reverse from the above:
1988
1989	1. IsRouter flag is set in Neighbour Advertisements.
1990	2. Router Solicitations are not sent unless accept_ra is 2.
1991	3. Router Advertisements are ignored unless accept_ra is 2.
1992	4. Redirects are ignored.
1993
1994	Default: 0 (disabled) if global forwarding is disabled (default),
1995	otherwise 1 (enabled).
1996
1997hop_limit - INTEGER
1998	Default Hop Limit to set.
1999
2000	Default: 64
2001
2002mtu - INTEGER
2003	Default Maximum Transfer Unit
2004
2005	Default: 1280 (IPv6 required minimum)
2006
2007ip_nonlocal_bind - BOOLEAN
2008	If set, allows processes to bind() to non-local IPv6 addresses,
2009	which can be quite useful - but may break some applications.
2010
2011	Default: 0
2012
2013router_probe_interval - INTEGER
2014	Minimum interval (in seconds) between Router Probing described
2015	in RFC4191.
2016
2017	Default: 60
2018
2019router_solicitation_delay - INTEGER
2020	Number of seconds to wait after interface is brought up
2021	before sending Router Solicitations.
2022
2023	Default: 1
2024
2025router_solicitation_interval - INTEGER
2026	Number of seconds to wait between Router Solicitations.
2027
2028	Default: 4
2029
2030router_solicitations - INTEGER
2031	Number of Router Solicitations to send until assuming no
2032	routers are present.
2033
2034	Default: 3
2035
2036use_oif_addrs_only - BOOLEAN
2037	When enabled, the candidate source addresses for destinations
2038	routed via this interface are restricted to the set of addresses
2039	configured on this interface (vis. RFC 6724, section 4).
2040
2041	Default: false
2042
2043use_tempaddr - INTEGER
2044	Preference for Privacy Extensions (RFC3041).
2045
2046	  * <= 0 : disable Privacy Extensions
2047	  * == 1 : enable Privacy Extensions, but prefer public
2048	    addresses over temporary addresses.
2049	  * >  1 : enable Privacy Extensions and prefer temporary
2050	    addresses over public addresses.
2051
2052	Default:
2053
2054		* 0 (for most devices)
2055		* -1 (for point-to-point devices and loopback devices)
2056
2057temp_valid_lft - INTEGER
2058	valid lifetime (in seconds) for temporary addresses.
2059
2060	Default: 604800 (7 days)
2061
2062temp_prefered_lft - INTEGER
2063	Preferred lifetime (in seconds) for temporary addresses.
2064
2065	Default: 86400 (1 day)
2066
2067keep_addr_on_down - INTEGER
2068	Keep all IPv6 addresses on an interface down event. If set static
2069	global addresses with no expiration time are not flushed.
2070
2071	*   >0 : enabled
2072	*    0 : system default
2073	*   <0 : disabled
2074
2075	Default: 0 (addresses are removed)
2076
2077max_desync_factor - INTEGER
2078	Maximum value for DESYNC_FACTOR, which is a random value
2079	that ensures that clients don't synchronize with each
2080	other and generate new addresses at exactly the same time.
2081	value is in seconds.
2082
2083	Default: 600
2084
2085regen_max_retry - INTEGER
2086	Number of attempts before give up attempting to generate
2087	valid temporary addresses.
2088
2089	Default: 5
2090
2091max_addresses - INTEGER
2092	Maximum number of autoconfigured addresses per interface.  Setting
2093	to zero disables the limitation.  It is not recommended to set this
2094	value too large (or to zero) because it would be an easy way to
2095	crash the kernel by allowing too many addresses to be created.
2096
2097	Default: 16
2098
2099disable_ipv6 - BOOLEAN
2100	Disable IPv6 operation.  If accept_dad is set to 2, this value
2101	will be dynamically set to TRUE if DAD fails for the link-local
2102	address.
2103
2104	Default: FALSE (enable IPv6 operation)
2105
2106	When this value is changed from 1 to 0 (IPv6 is being enabled),
2107	it will dynamically create a link-local address on the given
2108	interface and start Duplicate Address Detection, if necessary.
2109
2110	When this value is changed from 0 to 1 (IPv6 is being disabled),
2111	it will dynamically delete all addresses and routes on the given
2112	interface. From now on it will not possible to add addresses/routes
2113	to the selected interface.
2114
2115accept_dad - INTEGER
2116	Whether to accept DAD (Duplicate Address Detection).
2117
2118	 == ==============================================================
2119	  0  Disable DAD
2120	  1  Enable DAD (default)
2121	  2  Enable DAD, and disable IPv6 operation if MAC-based duplicate
2122	     link-local address has been found.
2123	 == ==============================================================
2124
2125	DAD operation and mode on a given interface will be selected according
2126	to the maximum value of conf/{all,interface}/accept_dad.
2127
2128force_tllao - BOOLEAN
2129	Enable sending the target link-layer address option even when
2130	responding to a unicast neighbor solicitation.
2131
2132	Default: FALSE
2133
2134	Quoting from RFC 2461, section 4.4, Target link-layer address:
2135
2136	"The option MUST be included for multicast solicitations in order to
2137	avoid infinite Neighbor Solicitation "recursion" when the peer node
2138	does not have a cache entry to return a Neighbor Advertisements
2139	message.  When responding to unicast solicitations, the option can be
2140	omitted since the sender of the solicitation has the correct link-
2141	layer address; otherwise it would not have be able to send the unicast
2142	solicitation in the first place. However, including the link-layer
2143	address in this case adds little overhead and eliminates a potential
2144	race condition where the sender deletes the cached link-layer address
2145	prior to receiving a response to a previous solicitation."
2146
2147ndisc_notify - BOOLEAN
2148	Define mode for notification of address and device changes.
2149
2150	* 0 - (default): do nothing
2151	* 1 - Generate unsolicited neighbour advertisements when device is brought
2152	  up or hardware address changes.
2153
2154ndisc_tclass - INTEGER
2155	The IPv6 Traffic Class to use by default when sending IPv6 Neighbor
2156	Discovery (Router Solicitation, Router Advertisement, Neighbor
2157	Solicitation, Neighbor Advertisement, Redirect) messages.
2158	These 8 bits can be interpreted as 6 high order bits holding the DSCP
2159	value and 2 low order bits representing ECN (which you probably want
2160	to leave cleared).
2161
2162	* 0 - (default)
2163
2164mldv1_unsolicited_report_interval - INTEGER
2165	The interval in milliseconds in which the next unsolicited
2166	MLDv1 report retransmit will take place.
2167
2168	Default: 10000 (10 seconds)
2169
2170mldv2_unsolicited_report_interval - INTEGER
2171	The interval in milliseconds in which the next unsolicited
2172	MLDv2 report retransmit will take place.
2173
2174	Default: 1000 (1 second)
2175
2176force_mld_version - INTEGER
2177	* 0 - (default) No enforcement of a MLD version, MLDv1 fallback allowed
2178	* 1 - Enforce to use MLD version 1
2179	* 2 - Enforce to use MLD version 2
2180
2181suppress_frag_ndisc - INTEGER
2182	Control RFC 6980 (Security Implications of IPv6 Fragmentation
2183	with IPv6 Neighbor Discovery) behavior:
2184
2185	* 1 - (default) discard fragmented neighbor discovery packets
2186	* 0 - allow fragmented neighbor discovery packets
2187
2188optimistic_dad - BOOLEAN
2189	Whether to perform Optimistic Duplicate Address Detection (RFC 4429).
2190
2191	* 0: disabled (default)
2192	* 1: enabled
2193
2194	Optimistic Duplicate Address Detection for the interface will be enabled
2195	if at least one of conf/{all,interface}/optimistic_dad is set to 1,
2196	it will be disabled otherwise.
2197
2198use_optimistic - BOOLEAN
2199	If enabled, do not classify optimistic addresses as deprecated during
2200	source address selection.  Preferred addresses will still be chosen
2201	before optimistic addresses, subject to other ranking in the source
2202	address selection algorithm.
2203
2204	* 0: disabled (default)
2205	* 1: enabled
2206
2207	This will be enabled if at least one of
2208	conf/{all,interface}/use_optimistic is set to 1, disabled otherwise.
2209
2210stable_secret - IPv6 address
2211	This IPv6 address will be used as a secret to generate IPv6
2212	addresses for link-local addresses and autoconfigured
2213	ones. All addresses generated after setting this secret will
2214	be stable privacy ones by default. This can be changed via the
2215	addrgenmode ip-link. conf/default/stable_secret is used as the
2216	secret for the namespace, the interface specific ones can
2217	overwrite that. Writes to conf/all/stable_secret are refused.
2218
2219	It is recommended to generate this secret during installation
2220	of a system and keep it stable after that.
2221
2222	By default the stable secret is unset.
2223
2224addr_gen_mode - INTEGER
2225	Defines how link-local and autoconf addresses are generated.
2226
2227	=  =================================================================
2228	0  generate address based on EUI64 (default)
2229	1  do no generate a link-local address, use EUI64 for addresses
2230	   generated from autoconf
2231	2  generate stable privacy addresses, using the secret from
2232	   stable_secret (RFC7217)
2233	3  generate stable privacy addresses, using a random secret if unset
2234	=  =================================================================
2235
2236drop_unicast_in_l2_multicast - BOOLEAN
2237	Drop any unicast IPv6 packets that are received in link-layer
2238	multicast (or broadcast) frames.
2239
2240	By default this is turned off.
2241
2242drop_unsolicited_na - BOOLEAN
2243	Drop all unsolicited neighbor advertisements, for example if there's
2244	a known good NA proxy on the network and such frames need not be used
2245	(or in the case of 802.11, must not be used to prevent attacks.)
2246
2247	By default this is turned off.
2248
2249enhanced_dad - BOOLEAN
2250	Include a nonce option in the IPv6 neighbor solicitation messages used for
2251	duplicate address detection per RFC7527. A received DAD NS will only signal
2252	a duplicate address if the nonce is different. This avoids any false
2253	detection of duplicates due to loopback of the NS messages that we send.
2254	The nonce option will be sent on an interface unless both of
2255	conf/{all,interface}/enhanced_dad are set to FALSE.
2256
2257	Default: TRUE
2258
2259``icmp/*``:
2260===========
2261
2262ratelimit - INTEGER
2263	Limit the maximal rates for sending ICMPv6 messages.
2264
2265	0 to disable any limiting,
2266	otherwise the minimal space between responses in milliseconds.
2267
2268	Default: 1000
2269
2270ratemask - list of comma separated ranges
2271	For ICMPv6 message types matching the ranges in the ratemask, limit
2272	the sending of the message according to ratelimit parameter.
2273
2274	The format used for both input and output is a comma separated
2275	list of ranges (e.g. "0-127,129" for ICMPv6 message type 0 to 127 and
2276	129). Writing to the file will clear all previous ranges of ICMPv6
2277	message types and update the current list with the input.
2278
2279	Refer to: https://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xhtml
2280	for numerical values of ICMPv6 message types, e.g. echo request is 128
2281	and echo reply is 129.
2282
2283	Default: 0-1,3-127 (rate limit ICMPv6 errors except Packet Too Big)
2284
2285echo_ignore_all - BOOLEAN
2286	If set non-zero, then the kernel will ignore all ICMP ECHO
2287	requests sent to it over the IPv6 protocol.
2288
2289	Default: 0
2290
2291echo_ignore_multicast - BOOLEAN
2292	If set non-zero, then the kernel will ignore all ICMP ECHO
2293	requests sent to it over the IPv6 protocol via multicast.
2294
2295	Default: 0
2296
2297echo_ignore_anycast - BOOLEAN
2298	If set non-zero, then the kernel will ignore all ICMP ECHO
2299	requests sent to it over the IPv6 protocol destined to anycast address.
2300
2301	Default: 0
2302
2303xfrm6_gc_thresh - INTEGER
2304	(Obsolete since linux-4.14)
2305	The threshold at which we will start garbage collecting for IPv6
2306	destination cache entries.  At twice this value the system will
2307	refuse new allocations.
2308
2309
2310IPv6 Update by:
2311Pekka Savola <pekkas@netcore.fi>
2312YOSHIFUJI Hideaki / USAGI Project <yoshfuji@linux-ipv6.org>
2313
2314
2315/proc/sys/net/bridge/* Variables:
2316=================================
2317
2318bridge-nf-call-arptables - BOOLEAN
2319	- 1 : pass bridged ARP traffic to arptables' FORWARD chain.
2320	- 0 : disable this.
2321
2322	Default: 1
2323
2324bridge-nf-call-iptables - BOOLEAN
2325	- 1 : pass bridged IPv4 traffic to iptables' chains.
2326	- 0 : disable this.
2327
2328	Default: 1
2329
2330bridge-nf-call-ip6tables - BOOLEAN
2331	- 1 : pass bridged IPv6 traffic to ip6tables' chains.
2332	- 0 : disable this.
2333
2334	Default: 1
2335
2336bridge-nf-filter-vlan-tagged - BOOLEAN
2337	- 1 : pass bridged vlan-tagged ARP/IP/IPv6 traffic to {arp,ip,ip6}tables.
2338	- 0 : disable this.
2339
2340	Default: 0
2341
2342bridge-nf-filter-pppoe-tagged - BOOLEAN
2343	- 1 : pass bridged pppoe-tagged IP/IPv6 traffic to {ip,ip6}tables.
2344	- 0 : disable this.
2345
2346	Default: 0
2347
2348bridge-nf-pass-vlan-input-dev - BOOLEAN
2349	- 1: if bridge-nf-filter-vlan-tagged is enabled, try to find a vlan
2350	  interface on the bridge and set the netfilter input device to the
2351	  vlan. This allows use of e.g. "iptables -i br0.1" and makes the
2352	  REDIRECT target work with vlan-on-top-of-bridge interfaces.  When no
2353	  matching vlan interface is found, or this switch is off, the input
2354	  device is set to the bridge interface.
2355
2356	- 0: disable bridge netfilter vlan interface lookup.
2357
2358	Default: 0
2359
2360``proc/sys/net/sctp/*`` Variables:
2361==================================
2362
2363addip_enable - BOOLEAN
2364	Enable or disable extension of  Dynamic Address Reconfiguration
2365	(ADD-IP) functionality specified in RFC5061.  This extension provides
2366	the ability to dynamically add and remove new addresses for the SCTP
2367	associations.
2368
2369	1: Enable extension.
2370
2371	0: Disable extension.
2372
2373	Default: 0
2374
2375pf_enable - INTEGER
2376	Enable or disable pf (pf is short for potentially failed) state. A value
2377	of pf_retrans > path_max_retrans also disables pf state. That is, one of
2378	both pf_enable and pf_retrans > path_max_retrans can disable pf state.
2379	Since pf_retrans and path_max_retrans can be changed by userspace
2380	application, sometimes user expects to disable pf state by the value of
2381	pf_retrans > path_max_retrans, but occasionally the value of pf_retrans
2382	or path_max_retrans is changed by the user application, this pf state is
2383	enabled. As such, it is necessary to add this to dynamically enable
2384	and disable pf state. See:
2385	https://datatracker.ietf.org/doc/draft-ietf-tsvwg-sctp-failover for
2386	details.
2387
2388	1: Enable pf.
2389
2390	0: Disable pf.
2391
2392	Default: 1
2393
2394pf_expose - INTEGER
2395	Unset or enable/disable pf (pf is short for potentially failed) state
2396	exposure.  Applications can control the exposure of the PF path state
2397	in the SCTP_PEER_ADDR_CHANGE event and the SCTP_GET_PEER_ADDR_INFO
2398	sockopt.   When it's unset, no SCTP_PEER_ADDR_CHANGE event with
2399	SCTP_ADDR_PF state will be sent and a SCTP_PF-state transport info
2400	can be got via SCTP_GET_PEER_ADDR_INFO sockopt;  When it's enabled,
2401	a SCTP_PEER_ADDR_CHANGE event will be sent for a transport becoming
2402	SCTP_PF state and a SCTP_PF-state transport info can be got via
2403	SCTP_GET_PEER_ADDR_INFO sockopt;  When it's diabled, no
2404	SCTP_PEER_ADDR_CHANGE event will be sent and it returns -EACCES when
2405	trying to get a SCTP_PF-state transport info via SCTP_GET_PEER_ADDR_INFO
2406	sockopt.
2407
2408	0: Unset pf state exposure, Compatible with old applications.
2409
2410	1: Disable pf state exposure.
2411
2412	2: Enable pf state exposure.
2413
2414	Default: 0
2415
2416addip_noauth_enable - BOOLEAN
2417	Dynamic Address Reconfiguration (ADD-IP) requires the use of
2418	authentication to protect the operations of adding or removing new
2419	addresses.  This requirement is mandated so that unauthorized hosts
2420	would not be able to hijack associations.  However, older
2421	implementations may not have implemented this requirement while
2422	allowing the ADD-IP extension.  For reasons of interoperability,
2423	we provide this variable to control the enforcement of the
2424	authentication requirement.
2425
2426	== ===============================================================
2427	1  Allow ADD-IP extension to be used without authentication.  This
2428	   should only be set in a closed environment for interoperability
2429	   with older implementations.
2430
2431	0  Enforce the authentication requirement
2432	== ===============================================================
2433
2434	Default: 0
2435
2436auth_enable - BOOLEAN
2437	Enable or disable Authenticated Chunks extension.  This extension
2438	provides the ability to send and receive authenticated chunks and is
2439	required for secure operation of Dynamic Address Reconfiguration
2440	(ADD-IP) extension.
2441
2442	- 1: Enable this extension.
2443	- 0: Disable this extension.
2444
2445	Default: 0
2446
2447prsctp_enable - BOOLEAN
2448	Enable or disable the Partial Reliability extension (RFC3758) which
2449	is used to notify peers that a given DATA should no longer be expected.
2450
2451	- 1: Enable extension
2452	- 0: Disable
2453
2454	Default: 1
2455
2456max_burst - INTEGER
2457	The limit of the number of new packets that can be initially sent.  It
2458	controls how bursty the generated traffic can be.
2459
2460	Default: 4
2461
2462association_max_retrans - INTEGER
2463	Set the maximum number for retransmissions that an association can
2464	attempt deciding that the remote end is unreachable.  If this value
2465	is exceeded, the association is terminated.
2466
2467	Default: 10
2468
2469max_init_retransmits - INTEGER
2470	The maximum number of retransmissions of INIT and COOKIE-ECHO chunks
2471	that an association will attempt before declaring the destination
2472	unreachable and terminating.
2473
2474	Default: 8
2475
2476path_max_retrans - INTEGER
2477	The maximum number of retransmissions that will be attempted on a given
2478	path.  Once this threshold is exceeded, the path is considered
2479	unreachable, and new traffic will use a different path when the
2480	association is multihomed.
2481
2482	Default: 5
2483
2484pf_retrans - INTEGER
2485	The number of retransmissions that will be attempted on a given path
2486	before traffic is redirected to an alternate transport (should one
2487	exist).  Note this is distinct from path_max_retrans, as a path that
2488	passes the pf_retrans threshold can still be used.  Its only
2489	deprioritized when a transmission path is selected by the stack.  This
2490	setting is primarily used to enable fast failover mechanisms without
2491	having to reduce path_max_retrans to a very low value.  See:
2492	http://www.ietf.org/id/draft-nishida-tsvwg-sctp-failover-05.txt
2493	for details.  Note also that a value of pf_retrans > path_max_retrans
2494	disables this feature. Since both pf_retrans and path_max_retrans can
2495	be changed by userspace application, a variable pf_enable is used to
2496	disable pf state.
2497
2498	Default: 0
2499
2500ps_retrans - INTEGER
2501	Primary.Switchover.Max.Retrans (PSMR), it's a tunable parameter coming
2502	from section-5 "Primary Path Switchover" in rfc7829.  The primary path
2503	will be changed to another active path when the path error counter on
2504	the old primary path exceeds PSMR, so that "the SCTP sender is allowed
2505	to continue data transmission on a new working path even when the old
2506	primary destination address becomes active again".   Note this feature
2507	is disabled by initializing 'ps_retrans' per netns as 0xffff by default,
2508	and its value can't be less than 'pf_retrans' when changing by sysctl.
2509
2510	Default: 0xffff
2511
2512rto_initial - INTEGER
2513	The initial round trip timeout value in milliseconds that will be used
2514	in calculating round trip times.  This is the initial time interval
2515	for retransmissions.
2516
2517	Default: 3000
2518
2519rto_max - INTEGER
2520	The maximum value (in milliseconds) of the round trip timeout.  This
2521	is the largest time interval that can elapse between retransmissions.
2522
2523	Default: 60000
2524
2525rto_min - INTEGER
2526	The minimum value (in milliseconds) of the round trip timeout.  This
2527	is the smallest time interval the can elapse between retransmissions.
2528
2529	Default: 1000
2530
2531hb_interval - INTEGER
2532	The interval (in milliseconds) between HEARTBEAT chunks.  These chunks
2533	are sent at the specified interval on idle paths to probe the state of
2534	a given path between 2 associations.
2535
2536	Default: 30000
2537
2538sack_timeout - INTEGER
2539	The amount of time (in milliseconds) that the implementation will wait
2540	to send a SACK.
2541
2542	Default: 200
2543
2544valid_cookie_life - INTEGER
2545	The default lifetime of the SCTP cookie (in milliseconds).  The cookie
2546	is used during association establishment.
2547
2548	Default: 60000
2549
2550cookie_preserve_enable - BOOLEAN
2551	Enable or disable the ability to extend the lifetime of the SCTP cookie
2552	that is used during the establishment phase of SCTP association
2553
2554	- 1: Enable cookie lifetime extension.
2555	- 0: Disable
2556
2557	Default: 1
2558
2559cookie_hmac_alg - STRING
2560	Select the hmac algorithm used when generating the cookie value sent by
2561	a listening sctp socket to a connecting client in the INIT-ACK chunk.
2562	Valid values are:
2563
2564	* md5
2565	* sha1
2566	* none
2567
2568	Ability to assign md5 or sha1 as the selected alg is predicated on the
2569	configuration of those algorithms at build time (CONFIG_CRYPTO_MD5 and
2570	CONFIG_CRYPTO_SHA1).
2571
2572	Default: Dependent on configuration.  MD5 if available, else SHA1 if
2573	available, else none.
2574
2575rcvbuf_policy - INTEGER
2576	Determines if the receive buffer is attributed to the socket or to
2577	association.   SCTP supports the capability to create multiple
2578	associations on a single socket.  When using this capability, it is
2579	possible that a single stalled association that's buffering a lot
2580	of data may block other associations from delivering their data by
2581	consuming all of the receive buffer space.  To work around this,
2582	the rcvbuf_policy could be set to attribute the receiver buffer space
2583	to each association instead of the socket.  This prevents the described
2584	blocking.
2585
2586	- 1: rcvbuf space is per association
2587	- 0: rcvbuf space is per socket
2588
2589	Default: 0
2590
2591sndbuf_policy - INTEGER
2592	Similar to rcvbuf_policy above, this applies to send buffer space.
2593
2594	- 1: Send buffer is tracked per association
2595	- 0: Send buffer is tracked per socket.
2596
2597	Default: 0
2598
2599sctp_mem - vector of 3 INTEGERs: min, pressure, max
2600	Number of pages allowed for queueing by all SCTP sockets.
2601
2602	min: Below this number of pages SCTP is not bothered about its
2603	memory appetite. When amount of memory allocated by SCTP exceeds
2604	this number, SCTP starts to moderate memory usage.
2605
2606	pressure: This value was introduced to follow format of tcp_mem.
2607
2608	max: Number of pages allowed for queueing by all SCTP sockets.
2609
2610	Default is calculated at boot time from amount of available memory.
2611
2612sctp_rmem - vector of 3 INTEGERs: min, default, max
2613	Only the first value ("min") is used, "default" and "max" are
2614	ignored.
2615
2616	min: Minimal size of receive buffer used by SCTP socket.
2617	It is guaranteed to each SCTP socket (but not association) even
2618	under moderate memory pressure.
2619
2620	Default: 4K
2621
2622sctp_wmem  - vector of 3 INTEGERs: min, default, max
2623	Currently this tunable has no effect.
2624
2625addr_scope_policy - INTEGER
2626	Control IPv4 address scoping - draft-stewart-tsvwg-sctp-ipv4-00
2627
2628	- 0   - Disable IPv4 address scoping
2629	- 1   - Enable IPv4 address scoping
2630	- 2   - Follow draft but allow IPv4 private addresses
2631	- 3   - Follow draft but allow IPv4 link local addresses
2632
2633	Default: 1
2634
2635
2636``/proc/sys/net/core/*``
2637========================
2638
2639	Please see: Documentation/admin-guide/sysctl/net.rst for descriptions of these entries.
2640
2641
2642``/proc/sys/net/unix/*``
2643========================
2644
2645max_dgram_qlen - INTEGER
2646	The maximum length of dgram socket receive queue
2647
2648	Default: 10
2649
2650