1.. SPDX-License-Identifier: GPL-2.0 2 3=================================== 4Netfilter Conntrack Sysfs variables 5=================================== 6 7/proc/sys/net/netfilter/nf_conntrack_* Variables: 8================================================= 9 10nf_conntrack_acct - BOOLEAN 11 - 0 - disabled (default) 12 - not 0 - enabled 13 14 Enable connection tracking flow accounting. 64-bit byte and packet 15 counters per flow are added. 16 17nf_conntrack_buckets - INTEGER 18 Size of hash table. If not specified as parameter during module 19 loading, the default size is calculated by dividing total memory 20 by 16384 to determine the number of buckets. The hash table will 21 never have fewer than 1024 and never more than 262144 buckets. 22 This sysctl is only writeable in the initial net namespace. 23 24nf_conntrack_checksum - BOOLEAN 25 - 0 - disabled 26 - not 0 - enabled (default) 27 28 Verify checksum of incoming packets. Packets with bad checksums are 29 in INVALID state. If this is enabled, such packets will not be 30 considered for connection tracking. 31 32nf_conntrack_count - INTEGER (read-only) 33 Number of currently allocated flow entries. 34 35nf_conntrack_events - BOOLEAN 36 - 0 - disabled 37 - 1 - enabled 38 - 2 - auto (default) 39 40 If this option is enabled, the connection tracking code will 41 provide userspace with connection tracking events via ctnetlink. 42 The default allocates the extension if a userspace program is 43 listening to ctnetlink events. 44 45nf_conntrack_expect_max - INTEGER 46 Maximum size of expectation table. Default value is 47 nf_conntrack_buckets / 256. Minimum is 1. 48 49nf_conntrack_frag6_high_thresh - INTEGER 50 default 262144 51 52 Maximum memory used to reassemble IPv6 fragments. When 53 nf_conntrack_frag6_high_thresh bytes of memory is allocated for this 54 purpose, the fragment handler will toss packets until 55 nf_conntrack_frag6_low_thresh is reached. 56 57nf_conntrack_frag6_low_thresh - INTEGER 58 default 196608 59 60 See nf_conntrack_frag6_low_thresh 61 62nf_conntrack_frag6_timeout - INTEGER (seconds) 63 default 60 64 65 Time to keep an IPv6 fragment in memory. 66 67nf_conntrack_generic_timeout - INTEGER (seconds) 68 default 600 69 70 Default for generic timeout. This refers to layer 4 unknown/unsupported 71 protocols. 72 73nf_conntrack_icmp_timeout - INTEGER (seconds) 74 default 30 75 76 Default for ICMP timeout. 77 78nf_conntrack_icmpv6_timeout - INTEGER (seconds) 79 default 30 80 81 Default for ICMP6 timeout. 82 83nf_conntrack_log_invalid - INTEGER 84 - 0 - disable (default) 85 - 1 - log ICMP packets 86 - 6 - log TCP packets 87 - 17 - log UDP packets 88 - 33 - log DCCP packets 89 - 41 - log ICMPv6 packets 90 - 136 - log UDPLITE packets 91 - 255 - log packets of any protocol 92 93 Log invalid packets of a type specified by value. 94 95nf_conntrack_max - INTEGER 96 Maximum number of allowed connection tracking entries. This value is set 97 to nf_conntrack_buckets by default. 98 Note that connection tracking entries are added to the table twice -- once 99 for the original direction and once for the reply direction (i.e., with 100 the reversed address). This means that with default settings a maxed-out 101 table will have a average hash chain length of 2, not 1. 102 103nf_conntrack_tcp_be_liberal - BOOLEAN 104 - 0 - disabled (default) 105 - not 0 - enabled 106 107 Be conservative in what you do, be liberal in what you accept from others. 108 If it's non-zero, we mark only out of window RST segments as INVALID. 109 110nf_conntrack_tcp_ignore_invalid_rst - BOOLEAN 111 - 0 - disabled (default) 112 - 1 - enabled 113 114 If it's 1, we don't mark out of window RST segments as INVALID. 115 116nf_conntrack_tcp_loose - BOOLEAN 117 - 0 - disabled 118 - not 0 - enabled (default) 119 120 If it is set to zero, we disable picking up already established 121 connections. 122 123nf_conntrack_tcp_max_retrans - INTEGER 124 default 3 125 126 Maximum number of packets that can be retransmitted without 127 received an (acceptable) ACK from the destination. If this number 128 is reached, a shorter timer will be started. 129 130nf_conntrack_tcp_timeout_close - INTEGER (seconds) 131 default 10 132 133nf_conntrack_tcp_timeout_close_wait - INTEGER (seconds) 134 default 60 135 136nf_conntrack_tcp_timeout_established - INTEGER (seconds) 137 default 432000 (5 days) 138 139nf_conntrack_tcp_timeout_fin_wait - INTEGER (seconds) 140 default 120 141 142nf_conntrack_tcp_timeout_last_ack - INTEGER (seconds) 143 default 30 144 145nf_conntrack_tcp_timeout_max_retrans - INTEGER (seconds) 146 default 300 147 148nf_conntrack_tcp_timeout_syn_recv - INTEGER (seconds) 149 default 60 150 151nf_conntrack_tcp_timeout_syn_sent - INTEGER (seconds) 152 default 120 153 154nf_conntrack_tcp_timeout_time_wait - INTEGER (seconds) 155 default 120 156 157nf_conntrack_tcp_timeout_unacknowledged - INTEGER (seconds) 158 default 300 159 160nf_conntrack_timestamp - BOOLEAN 161 - 0 - disabled (default) 162 - not 0 - enabled 163 164 Enable connection tracking flow timestamping. 165 166nf_conntrack_udp_timeout - INTEGER (seconds) 167 default 30 168 169nf_conntrack_udp_timeout_stream - INTEGER (seconds) 170 default 120 171 172 This extended timeout will be used in case there is an UDP stream 173 detected. 174 175nf_conntrack_gre_timeout - INTEGER (seconds) 176 default 30 177 178nf_conntrack_gre_timeout_stream - INTEGER (seconds) 179 default 180 180 181 This extended timeout will be used in case there is an GRE stream 182 detected. 183 184nf_hooks_lwtunnel - BOOLEAN 185 - 0 - disabled (default) 186 - not 0 - enabled 187 188 If this option is enabled, the lightweight tunnel netfilter hooks are 189 enabled. This option cannot be disabled once it is enabled. 190 191nf_flowtable_tcp_timeout - INTEGER (seconds) 192 default 30 193 194 Control offload timeout for tcp connections. 195 TCP connections may be offloaded from nf conntrack to nf flow table. 196 Once aged, the connection is returned to nf conntrack with tcp pickup timeout. 197 198nf_flowtable_udp_timeout - INTEGER (seconds) 199 default 30 200 201 Control offload timeout for udp connections. 202 UDP connections may be offloaded from nf conntrack to nf flow table. 203 Once aged, the connection is returned to nf conntrack with udp pickup timeout. 204