1# 2# Network configuration 3# 4 5menuconfig NET 6 bool "Networking support" 7 select NLATTR 8 ---help--- 9 Unless you really know what you are doing, you should say Y here. 10 The reason is that some programs need kernel networking support even 11 when running on a stand-alone machine that isn't connected to any 12 other computer. 13 14 If you are upgrading from an older kernel, you 15 should consider updating your networking tools too because changes 16 in the kernel and the tools often go hand in hand. The tools are 17 contained in the package net-tools, the location and version number 18 of which are given in <file:Documentation/Changes>. 19 20 For a general introduction to Linux networking, it is highly 21 recommended to read the NET-HOWTO, available from 22 <http://www.tldp.org/docs.html#howto>. 23 24if NET 25 26menu "Networking options" 27 28source "net/packet/Kconfig" 29source "net/unix/Kconfig" 30source "net/xfrm/Kconfig" 31source "net/iucv/Kconfig" 32 33config INET 34 bool "TCP/IP networking" 35 ---help--- 36 These are the protocols used on the Internet and on most local 37 Ethernets. It is highly recommended to say Y here (this will enlarge 38 your kernel by about 400 KB), since some programs (e.g. the X window 39 system) use TCP/IP even if your machine is not connected to any 40 other computer. You will get the so-called loopback device which 41 allows you to ping yourself (great fun, that!). 42 43 For an excellent introduction to Linux networking, please read the 44 Linux Networking HOWTO, available from 45 <http://www.tldp.org/docs.html#howto>. 46 47 If you say Y here and also to "/proc file system support" and 48 "Sysctl support" below, you can change various aspects of the 49 behavior of the TCP/IP code by writing to the (virtual) files in 50 /proc/sys/net/ipv4/*; the options are explained in the file 51 <file:Documentation/networking/ip-sysctl.txt>. 52 53 Short answer: say Y. 54 55if INET 56source "net/ipv4/Kconfig" 57source "net/ipv6/Kconfig" 58source "net/netlabel/Kconfig" 59 60endif # if INET 61 62config NETWORK_SECMARK 63 bool "Security Marking" 64 help 65 This enables security marking of network packets, similar 66 to nfmark, but designated for security purposes. 67 If you are unsure how to answer this question, answer N. 68 69menuconfig NETFILTER 70 bool "Network packet filtering framework (Netfilter)" 71 ---help--- 72 Netfilter is a framework for filtering and mangling network packets 73 that pass through your Linux box. 74 75 The most common use of packet filtering is to run your Linux box as 76 a firewall protecting a local network from the Internet. The type of 77 firewall provided by this kernel support is called a "packet 78 filter", which means that it can reject individual network packets 79 based on type, source, destination etc. The other kind of firewall, 80 a "proxy-based" one, is more secure but more intrusive and more 81 bothersome to set up; it inspects the network traffic much more 82 closely, modifies it and has knowledge about the higher level 83 protocols, which a packet filter lacks. Moreover, proxy-based 84 firewalls often require changes to the programs running on the local 85 clients. Proxy-based firewalls don't need support by the kernel, but 86 they are often combined with a packet filter, which only works if 87 you say Y here. 88 89 You should also say Y here if you intend to use your Linux box as 90 the gateway to the Internet for a local network of machines without 91 globally valid IP addresses. This is called "masquerading": if one 92 of the computers on your local network wants to send something to 93 the outside, your box can "masquerade" as that computer, i.e. it 94 forwards the traffic to the intended outside destination, but 95 modifies the packets to make it look like they came from the 96 firewall box itself. It works both ways: if the outside host 97 replies, the Linux box will silently forward the traffic to the 98 correct local computer. This way, the computers on your local net 99 are completely invisible to the outside world, even though they can 100 reach the outside and can receive replies. It is even possible to 101 run globally visible servers from within a masqueraded local network 102 using a mechanism called portforwarding. Masquerading is also often 103 called NAT (Network Address Translation). 104 105 Another use of Netfilter is in transparent proxying: if a machine on 106 the local network tries to connect to an outside host, your Linux 107 box can transparently forward the traffic to a local server, 108 typically a caching proxy server. 109 110 Yet another use of Netfilter is building a bridging firewall. Using 111 a bridge with Network packet filtering enabled makes iptables "see" 112 the bridged traffic. For filtering on the lower network and Ethernet 113 protocols over the bridge, use ebtables (under bridge netfilter 114 configuration). 115 116 Various modules exist for netfilter which replace the previous 117 masquerading (ipmasqadm), packet filtering (ipchains), transparent 118 proxying, and portforwarding mechanisms. Please see 119 <file:Documentation/Changes> under "iptables" for the location of 120 these packages. 121 122 Make sure to say N to "Fast switching" below if you intend to say Y 123 here, as Fast switching currently bypasses netfilter. 124 125 Chances are that you should say Y here if you compile a kernel which 126 will run as a router and N for regular hosts. If unsure, say N. 127 128if NETFILTER 129 130config NETFILTER_DEBUG 131 bool "Network packet filtering debugging" 132 depends on NETFILTER 133 help 134 You can say Y here if you want to get additional messages useful in 135 debugging the netfilter code. 136 137config NETFILTER_ADVANCED 138 bool "Advanced netfilter configuration" 139 depends on NETFILTER 140 default y 141 help 142 If you say Y here you can select between all the netfilter modules. 143 If you say N the more ununsual ones will not be shown and the 144 basic ones needed by most people will default to 'M'. 145 146 If unsure, say Y. 147 148config BRIDGE_NETFILTER 149 bool "Bridged IP/ARP packets filtering" 150 depends on BRIDGE && NETFILTER && INET 151 depends on NETFILTER_ADVANCED 152 default y 153 ---help--- 154 Enabling this option will let arptables resp. iptables see bridged 155 ARP resp. IP traffic. If you want a bridging firewall, you probably 156 want this option enabled. 157 Enabling or disabling this option doesn't enable or disable 158 ebtables. 159 160 If unsure, say N. 161 162source "net/netfilter/Kconfig" 163source "net/ipv4/netfilter/Kconfig" 164source "net/ipv6/netfilter/Kconfig" 165source "net/decnet/netfilter/Kconfig" 166source "net/bridge/netfilter/Kconfig" 167 168endif 169 170source "net/dccp/Kconfig" 171source "net/sctp/Kconfig" 172source "net/rds/Kconfig" 173source "net/tipc/Kconfig" 174source "net/atm/Kconfig" 175source "net/802/Kconfig" 176source "net/bridge/Kconfig" 177source "net/dsa/Kconfig" 178source "net/8021q/Kconfig" 179source "net/decnet/Kconfig" 180source "net/llc/Kconfig" 181source "net/ipx/Kconfig" 182source "drivers/net/appletalk/Kconfig" 183source "net/x25/Kconfig" 184source "net/lapb/Kconfig" 185source "net/econet/Kconfig" 186source "net/wanrouter/Kconfig" 187source "net/phonet/Kconfig" 188source "net/sched/Kconfig" 189source "net/dcb/Kconfig" 190 191menu "Network testing" 192 193config NET_PKTGEN 194 tristate "Packet Generator (USE WITH CAUTION)" 195 depends on PROC_FS 196 ---help--- 197 This module will inject preconfigured packets, at a configurable 198 rate, out of a given interface. It is used for network interface 199 stress testing and performance analysis. If you don't understand 200 what was just said, you don't need it: say N. 201 202 Documentation on how to use the packet generator can be found 203 at <file:Documentation/networking/pktgen.txt>. 204 205 To compile this code as a module, choose M here: the 206 module will be called pktgen. 207 208config NET_TCPPROBE 209 tristate "TCP connection probing" 210 depends on INET && EXPERIMENTAL && PROC_FS && KPROBES 211 ---help--- 212 This module allows for capturing the changes to TCP connection 213 state in response to incoming packets. It is used for debugging 214 TCP congestion avoidance modules. If you don't understand 215 what was just said, you don't need it: say N. 216 217 Documentation on how to use TCP connection probing can be found 218 at http://linux-net.osdl.org/index.php/TcpProbe 219 220 To compile this code as a module, choose M here: the 221 module will be called tcp_probe. 222 223config NET_DROP_MONITOR 224 boolean "Network packet drop alerting service" 225 depends on INET && EXPERIMENTAL && TRACEPOINTS 226 ---help--- 227 This feature provides an alerting service to userspace in the 228 event that packets are discarded in the network stack. Alerts 229 are broadcast via netlink socket to any listening user space 230 process. If you don't need network drop alerts, or if you are ok 231 just checking the various proc files and other utilities for 232 drop statistics, say N here. 233 234endmenu 235 236endmenu 237 238source "net/ax25/Kconfig" 239source "net/can/Kconfig" 240source "net/irda/Kconfig" 241source "net/bluetooth/Kconfig" 242source "net/rxrpc/Kconfig" 243 244config FIB_RULES 245 bool 246 247menuconfig WIRELESS 248 bool "Wireless" 249 depends on !S390 250 default y 251 252if WIRELESS 253 254source "net/wireless/Kconfig" 255source "net/mac80211/Kconfig" 256 257endif # WIRELESS 258 259source "net/wimax/Kconfig" 260 261source "net/rfkill/Kconfig" 262source "net/9p/Kconfig" 263 264endif # if NET 265