1.. SPDX-License-Identifier: GPL-2.0 2 3=================================== 4Netfilter Conntrack Sysfs variables 5=================================== 6 7/proc/sys/net/netfilter/nf_conntrack_* Variables: 8================================================= 9 10nf_conntrack_acct - BOOLEAN 11 - 0 - disabled (default) 12 - not 0 - enabled 13 14 Enable connection tracking flow accounting. 64-bit byte and packet 15 counters per flow are added. 16 17nf_conntrack_buckets - INTEGER 18 Size of hash table. If not specified as parameter during module 19 loading, the default size is calculated by dividing total memory 20 by 16384 to determine the number of buckets. The hash table will 21 never have fewer than 1024 and never more than 262144 buckets. 22 This sysctl is only writeable in the initial net namespace. 23 24nf_conntrack_checksum - BOOLEAN 25 - 0 - disabled 26 - not 0 - enabled (default) 27 28 Verify checksum of incoming packets. Packets with bad checksums are 29 in INVALID state. If this is enabled, such packets will not be 30 considered for connection tracking. 31 32nf_conntrack_count - INTEGER (read-only) 33 Number of currently allocated flow entries. 34 35nf_conntrack_events - BOOLEAN 36 - 0 - disabled 37 - 1 - enabled 38 - 2 - auto (default) 39 40 If this option is enabled, the connection tracking code will 41 provide userspace with connection tracking events via ctnetlink. 42 The default allocates the extension if a userspace program is 43 listening to ctnetlink events. 44 45nf_conntrack_expect_max - INTEGER 46 Maximum size of expectation table. Default value is 47 nf_conntrack_buckets / 256. Minimum is 1. 48 49nf_conntrack_frag6_high_thresh - INTEGER 50 default 262144 51 52 Maximum memory used to reassemble IPv6 fragments. When 53 nf_conntrack_frag6_high_thresh bytes of memory is allocated for this 54 purpose, the fragment handler will toss packets until 55 nf_conntrack_frag6_low_thresh is reached. 56 57nf_conntrack_frag6_low_thresh - INTEGER 58 (Obsolete since linux-4.17) 59 default 196608 60 61 See nf_conntrack_frag6_low_thresh 62 63nf_conntrack_frag6_timeout - INTEGER (seconds) 64 default 60 65 66 Time to keep an IPv6 fragment in memory. 67 68nf_conntrack_generic_timeout - INTEGER (seconds) 69 default 600 70 71 Default for generic timeout. This refers to layer 4 unknown/unsupported 72 protocols. 73 74nf_conntrack_icmp_timeout - INTEGER (seconds) 75 default 30 76 77 Default for ICMP timeout. 78 79nf_conntrack_icmpv6_timeout - INTEGER (seconds) 80 default 30 81 82 Default for ICMP6 timeout. 83 84nf_conntrack_log_invalid - INTEGER 85 - 0 - disable (default) 86 - 1 - log ICMP packets 87 - 6 - log TCP packets 88 - 17 - log UDP packets 89 - 33 - log DCCP packets 90 - 41 - log ICMPv6 packets 91 - 136 - log UDPLITE packets 92 - 255 - log packets of any protocol 93 94 Log invalid packets of a type specified by value. 95 96nf_conntrack_max - INTEGER 97 Maximum number of allowed connection tracking entries. This value is set 98 to nf_conntrack_buckets by default. 99 Note that connection tracking entries are added to the table twice -- once 100 for the original direction and once for the reply direction (i.e., with 101 the reversed address). This means that with default settings a maxed-out 102 table will have a average hash chain length of 2, not 1. 103 104nf_conntrack_tcp_be_liberal - BOOLEAN 105 - 0 - disabled (default) 106 - not 0 - enabled 107 108 Be conservative in what you do, be liberal in what you accept from others. 109 If it's non-zero, we mark only out of window RST segments as INVALID. 110 111nf_conntrack_tcp_ignore_invalid_rst - BOOLEAN 112 - 0 - disabled (default) 113 - 1 - enabled 114 115 If it's 1, we don't mark out of window RST segments as INVALID. 116 117nf_conntrack_tcp_loose - BOOLEAN 118 - 0 - disabled 119 - not 0 - enabled (default) 120 121 If it is set to zero, we disable picking up already established 122 connections. 123 124nf_conntrack_tcp_max_retrans - INTEGER 125 default 3 126 127 Maximum number of packets that can be retransmitted without 128 received an (acceptable) ACK from the destination. If this number 129 is reached, a shorter timer will be started. 130 131nf_conntrack_tcp_timeout_close - INTEGER (seconds) 132 default 10 133 134nf_conntrack_tcp_timeout_close_wait - INTEGER (seconds) 135 default 60 136 137nf_conntrack_tcp_timeout_established - INTEGER (seconds) 138 default 432000 (5 days) 139 140nf_conntrack_tcp_timeout_fin_wait - INTEGER (seconds) 141 default 120 142 143nf_conntrack_tcp_timeout_last_ack - INTEGER (seconds) 144 default 30 145 146nf_conntrack_tcp_timeout_max_retrans - INTEGER (seconds) 147 default 300 148 149nf_conntrack_tcp_timeout_syn_recv - INTEGER (seconds) 150 default 60 151 152nf_conntrack_tcp_timeout_syn_sent - INTEGER (seconds) 153 default 120 154 155nf_conntrack_tcp_timeout_time_wait - INTEGER (seconds) 156 default 120 157 158nf_conntrack_tcp_timeout_unacknowledged - INTEGER (seconds) 159 default 300 160 161nf_conntrack_timestamp - BOOLEAN 162 - 0 - disabled (default) 163 - not 0 - enabled 164 165 Enable connection tracking flow timestamping. 166 167nf_conntrack_sctp_timeout_closed - INTEGER (seconds) 168 default 10 169 170nf_conntrack_sctp_timeout_cookie_wait - INTEGER (seconds) 171 default 3 172 173nf_conntrack_sctp_timeout_cookie_echoed - INTEGER (seconds) 174 default 3 175 176nf_conntrack_sctp_timeout_established - INTEGER (seconds) 177 default 210 178 179 Default is set to (hb_interval * path_max_retrans + rto_max) 180 181nf_conntrack_sctp_timeout_shutdown_sent - INTEGER (seconds) 182 default 0.3 183 184nf_conntrack_sctp_timeout_shutdown_recd - INTEGER (seconds) 185 default 0.3 186 187nf_conntrack_sctp_timeout_shutdown_ack_sent - INTEGER (seconds) 188 default 3 189 190nf_conntrack_sctp_timeout_heartbeat_sent - INTEGER (seconds) 191 default 30 192 193 This timeout is used to setup conntrack entry on secondary paths. 194 Default is set to hb_interval. 195 196nf_conntrack_udp_timeout - INTEGER (seconds) 197 default 30 198 199nf_conntrack_udp_timeout_stream - INTEGER (seconds) 200 default 120 201 202 This extended timeout will be used in case there is an UDP stream 203 detected. 204 205nf_conntrack_gre_timeout - INTEGER (seconds) 206 default 30 207 208nf_conntrack_gre_timeout_stream - INTEGER (seconds) 209 default 180 210 211 This extended timeout will be used in case there is an GRE stream 212 detected. 213 214nf_hooks_lwtunnel - BOOLEAN 215 - 0 - disabled (default) 216 - not 0 - enabled 217 218 If this option is enabled, the lightweight tunnel netfilter hooks are 219 enabled. This option cannot be disabled once it is enabled. 220 221nf_flowtable_tcp_timeout - INTEGER (seconds) 222 default 30 223 224 Control offload timeout for tcp connections. 225 TCP connections may be offloaded from nf conntrack to nf flow table. 226 Once aged, the connection is returned to nf conntrack with tcp pickup timeout. 227 228nf_flowtable_udp_timeout - INTEGER (seconds) 229 default 30 230 231 Control offload timeout for udp connections. 232 UDP connections may be offloaded from nf conntrack to nf flow table. 233 Once aged, the connection is returned to nf conntrack with udp pickup timeout. 234