1/proc/sys/net/ipv4/* Variables:
   3ip_forward - BOOLEAN
   4        0 - disabled (default)
   5        not 0 - enabled
   7        Forward Packets between interfaces.
   9        This variable is special, its change resets all configuration
  10        parameters to their default state (RFC1122 for hosts, RFC1812
  11        for routers)
  13ip_default_ttl - INTEGER
  14        Default value of TTL field (Time To Live) for outgoing (but not
  15        forwarded) IP packets. Should be between 1 and 255 inclusive.
  16        Default: 64 (as recommended by RFC1700)
  18ip_no_pmtu_disc - INTEGER
  19        Disable Path MTU Discovery. If enabled in mode 1 and a
  20        fragmentation-required ICMP is received, the PMTU to this
  21        destination will be set to min_pmtu (see below). You will need
  22        to raise min_pmtu to the smallest interface MTU on your system
  23        manually if you want to avoid locally generated fragments.
  25        In mode 2 incoming Path MTU Discovery messages will be
  26        discarded. Outgoing frames are handled the same as in mode 1,
  27        implicitly setting IP_PMTUDISC_DONT on every created socket.
  29        Mode 3 is a hardend pmtu discover mode. The kernel will only
  30        accept fragmentation-needed errors if the underlying protocol
  31        can verify them besides a plain socket lookup. Current
  32        protocols for which pmtu events will be honored are TCP, SCTP
  33        and DCCP as they verify e.g. the sequence number or the
  34        association. This mode should not be enabled globally but is
  35        only intended to secure e.g. name servers in namespaces where
  36        TCP path mtu must still work but path MTU information of other
  37        protocols should be discarded. If enabled globally this mode
  38        could break other protocols.
  40        Possible values: 0-3
  41        Default: FALSE
  43min_pmtu - INTEGER
  44        default 552 - minimum discovered Path MTU
  46ip_forward_use_pmtu - BOOLEAN
  47        By default we don't trust protocol path MTUs while forwarding
  48        because they could be easily forged and can lead to unwanted
  49        fragmentation by the router.
  50        You only need to enable this if you have user-space software
  51        which tries to discover path mtus by itself and depends on the
  52        kernel honoring this information. This is normally not the
  53        case.
  54        Default: 0 (disabled)
  55        Possible values:
  56        0 - disabled
  57        1 - enabled
  59fwmark_reflect - BOOLEAN
  60        Controls the fwmark of kernel-generated IPv4 reply packets that are not
  61        associated with a socket for example, TCP RSTs or ICMP echo replies).
  62        If unset, these packets have a fwmark of zero. If set, they have the
  63        fwmark of the packet they are replying to.
  64        Default: 0
  66route/max_size - INTEGER
  67        Maximum number of routes allowed in the kernel.  Increase
  68        this when using large numbers of interfaces and/or routes.
  69        From linux kernel 3.6 onwards, this is deprecated for ipv4
  70        as route cache is no longer used.
  72neigh/default/gc_thresh1 - INTEGER
  73        Minimum number of entries to keep.  Garbage collector will not
  74        purge entries if there are fewer than this number.
  75        Default: 128
  77neigh/default/gc_thresh2 - INTEGER
  78        Threshold when garbage collector becomes more aggressive about
  79        purging entries. Entries older than 5 seconds will be cleared
  80        when over this number.
  81        Default: 512
  83neigh/default/gc_thresh3 - INTEGER
  84        Maximum number of neighbor entries allowed.  Increase this
  85        when using large numbers of interfaces and when communicating
  86        with large numbers of directly-connected peers.
  87        Default: 1024
  89neigh/default/unres_qlen_bytes - INTEGER
  90        The maximum number of bytes which may be used by packets
  91        queued for each unresolved address by other network layers.
  92        (added in linux 3.3)
  93        Setting negative value is meaningless and will return error.
  94        Default: 65536 Bytes(64KB)
  96neigh/default/unres_qlen - INTEGER
  97        The maximum number of packets which may be queued for each
  98        unresolved address by other network layers.
  99        (deprecated in linux 3.3) : use unres_qlen_bytes instead.
 100        Prior to linux 3.3, the default value is 3 which may cause
 101        unexpected packet loss. The current default value is calculated
 102        according to default value of unres_qlen_bytes and true size of
 103        packet.
 104        Default: 31
 106mtu_expires - INTEGER
 107        Time, in seconds, that cached PMTU information is kept.
 109min_adv_mss - INTEGER
 110        The advertised MSS depends on the first hop route MTU, but will
 111        never be lower than this setting.
 113IP Fragmentation:
 115ipfrag_high_thresh - INTEGER
 116        Maximum memory used to reassemble IP fragments. When
 117        ipfrag_high_thresh bytes of memory is allocated for this purpose,
 118        the fragment handler will toss packets until ipfrag_low_thresh
 119        is reached. This also serves as a maximum limit to namespaces
 120        different from the initial one.
 122ipfrag_low_thresh - INTEGER
 123        Maximum memory used to reassemble IP fragments before the kernel
 124        begins to remove incomplete fragment queues to free up resources.
 125        The kernel still accepts new fragments for defragmentation.
 127ipfrag_time - INTEGER
 128        Time in seconds to keep an IP fragment in memory.
 130ipfrag_max_dist - INTEGER
 131        ipfrag_max_dist is a non-negative integer value which defines the
 132        maximum "disorder" which is allowed among fragments which share a
 133        common IP source address. Note that reordering of packets is
 134        not unusual, but if a large number of fragments arrive from a source
 135        IP address while a particular fragment queue remains incomplete, it
 136        probably indicates that one or more fragments belonging to that queue
 137        have been lost. When ipfrag_max_dist is positive, an additional check
 138        is done on fragments before they are added to a reassembly queue - if
 139        ipfrag_max_dist (or more) fragments have arrived from a particular IP
 140        address between additions to any IP fragment queue using that source
 141        address, it's presumed that one or more fragments in the queue are
 142        lost. The existing fragment queue will be dropped, and a new one
 143        started. An ipfrag_max_dist value of zero disables this check.
 145        Using a very small value, e.g. 1 or 2, for ipfrag_max_dist can
 146        result in unnecessarily dropping fragment queues when normal
 147        reordering of packets occurs, which could lead to poor application
 148        performance. Using a very large value, e.g. 50000, increases the
 149        likelihood of incorrectly reassembling IP fragments that originate
 150        from different IP datagrams, which could result in data corruption.
 151        Default: 64
 153INET peer storage:
 155inet_peer_threshold - INTEGER
 156        The approximate size of the storage.  Starting from this threshold
 157        entries will be thrown aggressively.  This threshold also determines
 158        entries' time-to-live and time intervals between garbage collection
 159        passes.  More entries, less time-to-live, less GC interval.
 161inet_peer_minttl - INTEGER
 162        Minimum time-to-live of entries.  Should be enough to cover fragment
 163        time-to-live on the reassembling side.  This minimum time-to-live  is
 164        guaranteed if the pool size is less than inet_peer_threshold.
 165        Measured in seconds.
 167inet_peer_maxttl - INTEGER
 168        Maximum time-to-live of entries.  Unused entries will expire after
 169        this period of time if there is no memory pressure on the pool (i.e.
 170        when the number of entries in the pool is very small).
 171        Measured in seconds.
 173TCP variables:
 175somaxconn - INTEGER
 176        Limit of socket listen() backlog, known in userspace as SOMAXCONN.
 177        Defaults to 128.  See also tcp_max_syn_backlog for additional tuning
 178        for TCP sockets.
 180tcp_abort_on_overflow - BOOLEAN
 181        If listening service is too slow to accept new connections,
 182        reset them. Default state is FALSE. It means that if overflow
 183        occurred due to a burst, connection will recover. Enable this
 184        option _only_ if you are really sure that listening daemon
 185        cannot be tuned to accept connections faster. Enabling this
 186        option can harm clients of your server.
 188tcp_adv_win_scale - INTEGER
 189        Count buffering overhead as bytes/2^tcp_adv_win_scale
 190        (if tcp_adv_win_scale > 0) or bytes-bytes/2^(-tcp_adv_win_scale),
 191        if it is <= 0.
 192        Possible values are [-31, 31], inclusive.
 193        Default: 1
 195tcp_allowed_congestion_control - STRING
 196        Show/set the congestion control choices available to non-privileged
 197        processes. The list is a subset of those listed in
 198        tcp_available_congestion_control.
 199        Default is "reno" and the default setting (tcp_congestion_control).
 201tcp_app_win - INTEGER
 202        Reserve max(window/2^tcp_app_win, mss) of window for application
 203        buffer. Value 0 is special, it means that nothing is reserved.
 204        Default: 31
 206tcp_autocorking - BOOLEAN
 207        Enable TCP auto corking :
 208        When applications do consecutive small write()/sendmsg() system calls,
 209        we try to coalesce these small writes as much as possible, to lower
 210        total amount of sent packets. This is done if at least one prior
 211        packet for the flow is waiting in Qdisc queues or device transmit
 212        queue. Applications can still use TCP_CORK for optimal behavior
 213        when they know how/when to uncork their sockets.
 214        Default : 1
 216tcp_available_congestion_control - STRING
 217        Shows the available congestion control choices that are registered.
 218        More congestion control algorithms may be available as modules,
 219        but not loaded.
 221tcp_base_mss - INTEGER
 222        The initial value of search_low to be used by the packetization layer
 223        Path MTU discovery (MTU probing).  If MTU probing is enabled,
 224        this is the initial MSS used by the connection.
 226tcp_congestion_control - STRING
 227        Set the congestion control algorithm to be used for new
 228        connections. The algorithm "reno" is always available, but
 229        additional choices may be available based on kernel configuration.
 230        Default is set as part of kernel configuration.
 231        For passive connections, the listener congestion control choice
 232        is inherited.
 233        [see setsockopt(listenfd, SOL_TCP, TCP_CONGESTION, "name" ...) ]
 235tcp_dsack - BOOLEAN
 236        Allows TCP to send "duplicate" SACKs.
 238tcp_early_retrans - INTEGER
 239        Enable Early Retransmit (ER), per RFC 5827. ER lowers the threshold
 240        for triggering fast retransmit when the amount of outstanding data is
 241        small and when no previously unsent data can be transmitted (such
 242        that limited transmit could be used). Also controls the use of
 243        Tail loss probe (TLP) that converts RTOs occurring due to tail
 244        losses into fast recovery (draft-dukkipati-tcpm-tcp-loss-probe-01).
 245        Possible values:
 246                0 disables ER
 247                1 enables ER
 248                2 enables ER but delays fast recovery and fast retransmit
 249                  by a fourth of RTT. This mitigates connection falsely
 250                  recovers when network has a small degree of reordering
 251                  (less than 3 packets).
 252                3 enables delayed ER and TLP.
 253                4 enables TLP only.
 254        Default: 3
 256tcp_ecn - INTEGER
 257        Control use of Explicit Congestion Notification (ECN) by TCP.
 258        ECN is used only when both ends of the TCP connection indicate
 259        support for it.  This feature is useful in avoiding losses due
 260        to congestion by allowing supporting routers to signal
 261        congestion before having to drop packets.
 262        Possible values are:
 263                0 Disable ECN.  Neither initiate nor accept ECN.
 264                1 Enable ECN when requested by incoming connections and
 265                  also request ECN on outgoing connection attempts.
 266                2 Enable ECN when requested by incoming connections
 267                  but do not request ECN on outgoing connections.
 268        Default: 2
 270tcp_fack - BOOLEAN
 271        Enable FACK congestion avoidance and fast retransmission.
 272        The value is not used, if tcp_sack is not enabled.
 274tcp_fin_timeout - INTEGER
 275        The length of time an orphaned (no longer referenced by any
 276        application) connection will remain in the FIN_WAIT_2 state
 277        before it is aborted at the local end.  While a perfectly
 278        valid "receive only" state for an un-orphaned connection, an
 279        orphaned connection in FIN_WAIT_2 state could otherwise wait
 280        forever for the remote to close its end of the connection.
 281        Cf. tcp_max_orphans
 282        Default: 60 seconds
 284tcp_frto - INTEGER
 285        Enables Forward RTO-Recovery (F-RTO) defined in RFC5682.
 286        F-RTO is an enhanced recovery algorithm for TCP retransmission
 287        timeouts.  It is particularly beneficial in networks where the
 288        RTT fluctuates (e.g., wireless). F-RTO is sender-side only
 289        modification. It does not require any support from the peer.
 291        By default it's enabled with a non-zero value. 0 disables F-RTO.
 293tcp_keepalive_time - INTEGER
 294        How often TCP sends out keepalive messages when keepalive is enabled.
 295        Default: 2hours.
 297tcp_keepalive_probes - INTEGER
 298        How many keepalive probes TCP sends out, until it decides that the
 299        connection is broken. Default value: 9.
 301tcp_keepalive_intvl - INTEGER
 302        How frequently the probes are send out. Multiplied by
 303        tcp_keepalive_probes it is time to kill not responding connection,
 304        after probes started. Default value: 75sec i.e. connection
 305        will be aborted after ~11 minutes of retries.
 307tcp_low_latency - BOOLEAN
 308        If set, the TCP stack makes decisions that prefer lower
 309        latency as opposed to higher throughput.  By default, this
 310        option is not set meaning that higher throughput is preferred.
 311        An example of an application where this default should be
 312        changed would be a Beowulf compute cluster.
 313        Default: 0
 315tcp_max_orphans - INTEGER
 316        Maximal number of TCP sockets not attached to any user file handle,
 317        held by system. If this number is exceeded orphaned connections are
 318        reset immediately and warning is printed. This limit exists
 319        only to prevent simple DoS attacks, you _must_ not rely on this
 320        or lower the limit artificially, but rather increase it
 321        (probably, after increasing installed memory),
 322        if network conditions require more than default value,
 323        and tune network services to linger and kill such states
 324        more aggressively. Let me to remind again: each orphan eats
 325        up to ~64K of unswappable memory.
 327tcp_max_syn_backlog - INTEGER
 328        Maximal number of remembered connection requests, which have not
 329        received an acknowledgment from connecting client.
 330        The minimal value is 128 for low memory machines, and it will
 331        increase in proportion to the memory of machine.
 332        If server suffers from overload, try increasing this number.
 334tcp_max_tw_buckets - INTEGER
 335        Maximal number of timewait sockets held by system simultaneously.
 336        If this number is exceeded time-wait socket is immediately destroyed
 337        and warning is printed. This limit exists only to prevent
 338        simple DoS attacks, you _must_ not lower the limit artificially,
 339        but rather increase it (probably, after increasing installed memory),
 340        if network conditions require more than default value.
 342tcp_mem - vector of 3 INTEGERs: min, pressure, max
 343        min: below this number of pages TCP is not bothered about its
 344        memory appetite.
 346        pressure: when amount of memory allocated by TCP exceeds this number
 347        of pages, TCP moderates its memory consumption and enters memory
 348        pressure mode, which is exited when memory consumption falls
 349        under "min".
 351        max: number of pages allowed for queueing by all TCP sockets.
 353        Defaults are calculated at boot time from amount of available
 354        memory.
 356tcp_moderate_rcvbuf - BOOLEAN
 357        If set, TCP performs receive buffer auto-tuning, attempting to
 358        automatically size the buffer (no greater than tcp_rmem[2]) to
 359        match the size required by the path for full throughput.  Enabled by
 360        default.
 362tcp_mtu_probing - INTEGER
 363        Controls TCP Packetization-Layer Path MTU Discovery.  Takes three
 364        values:
 365          0 - Disabled
 366          1 - Disabled by default, enabled when an ICMP black hole detected
 367          2 - Always enabled, use initial MSS of tcp_base_mss.
 369tcp_no_metrics_save - BOOLEAN
 370        By default, TCP saves various connection metrics in the route cache
 371        when the connection closes, so that connections established in the
 372        near future can use these to set initial conditions.  Usually, this
 373        increases overall performance, but may sometimes cause performance
 374        degradation.  If set, TCP will not cache metrics on closing
 375        connections.
 377tcp_orphan_retries - INTEGER
 378        This value influences the timeout of a locally closed TCP connection,
 379        when RTO retransmissions remain unacknowledged.
 380        See tcp_retries2 for more details.
 382        The default value is 8.
 383        If your machine is a loaded WEB server,
 384        you should think about lowering this value, such sockets
 385        may consume significant resources. Cf. tcp_max_orphans.
 387tcp_reordering - INTEGER
 388        Initial reordering level of packets in a TCP stream.
 389        TCP stack can then dynamically adjust flow reordering level
 390        between this initial value and tcp_max_reordering
 391        Default: 3
 393tcp_max_reordering - INTEGER
 394        Maximal reordering level of packets in a TCP stream.
 395        300 is a fairly conservative value, but you might increase it
 396        if paths are using per packet load balancing (like bonding rr mode)
 397        Default: 300
 399tcp_retrans_collapse - BOOLEAN
 400        Bug-to-bug compatibility with some broken printers.
 401        On retransmit try to send bigger packets to work around bugs in
 402        certain TCP stacks.
 404tcp_retries1 - INTEGER
 405        This value influences the time, after which TCP decides, that
 406        something is wrong due to unacknowledged RTO retransmissions,
 407        and reports this suspicion to the network layer.
 408        See tcp_retries2 for more details.
 410        RFC 1122 recommends at least 3 retransmissions, which is the
 411        default.
 413tcp_retries2 - INTEGER
 414        This value influences the timeout of an alive TCP connection,
 415        when RTO retransmissions remain unacknowledged.
 416        Given a value of N, a hypothetical TCP connection following
 417        exponential backoff with an initial RTO of TCP_RTO_MIN would
 418        retransmit N times before killing the connection at the (N+1)th RTO.
 420        The default value of 15 yields a hypothetical timeout of 924.6
 421        seconds and is a lower bound for the effective timeout.
 422        TCP will effectively time out at the first RTO which exceeds the
 423        hypothetical timeout.
 425        RFC 1122 recommends at least 100 seconds for the timeout,
 426        which corresponds to a value of at least 8.
 428tcp_rfc1337 - BOOLEAN
 429        If set, the TCP stack behaves conforming to RFC1337. If unset,
 430        we are not conforming to RFC, but prevent TCP TIME_WAIT
 431        assassination.
 432        Default: 0
 434tcp_rmem - vector of 3 INTEGERs: min, default, max
 435        min: Minimal size of receive buffer used by TCP sockets.
 436        It is guaranteed to each TCP socket, even under moderate memory
 437        pressure.
 438        Default: 1 page
 440        default: initial size of receive buffer used by TCP sockets.
 441        This value overrides net.core.rmem_default used by other protocols.
 442        Default: 87380 bytes. This value results in window of 65535 with
 443        default setting of tcp_adv_win_scale and tcp_app_win:0 and a bit
 444        less for default tcp_app_win. See below about these variables.
 446        max: maximal size of receive buffer allowed for automatically
 447        selected receiver buffers for TCP socket. This value does not override
 448        net.core.rmem_max.  Calling setsockopt() with SO_RCVBUF disables
 449        automatic tuning of that socket's receive buffer size, in which
 450        case this value is ignored.
 451        Default: between 87380B and 6MB, depending on RAM size.
 453tcp_sack - BOOLEAN
 454        Enable select acknowledgments (SACKS).
 456tcp_slow_start_after_idle - BOOLEAN
 457        If set, provide RFC2861 behavior and time out the congestion
 458        window after an idle period.  An idle period is defined at
 459        the current RTO.  If unset, the congestion window will not
 460        be timed out after an idle period.
 461        Default: 1
 463tcp_stdurg - BOOLEAN
 464        Use the Host requirements interpretation of the TCP urgent pointer field.
 465        Most hosts use the older BSD interpretation, so if you turn this on
 466        Linux might not communicate correctly with them.
 467        Default: FALSE
 469tcp_synack_retries - INTEGER
 470        Number of times SYNACKs for a passive TCP connection attempt will
 471        be retransmitted. Should not be higher than 255. Default value
 472        is 5, which corresponds to 31seconds till the last retransmission
 473        with the current initial RTO of 1second. With this the final timeout
 474        for a passive TCP connection will happen after 63seconds.
 476tcp_syncookies - BOOLEAN
 477        Only valid when the kernel was compiled with CONFIG_SYN_COOKIES
 478        Send out syncookies when the syn backlog queue of a socket
 479        overflows. This is to prevent against the common 'SYN flood attack'
 480        Default: 1
 482        Note, that syncookies is fallback facility.
 483        It MUST NOT be used to help highly loaded servers to stand
 484        against legal connection rate. If you see SYN flood warnings
 485        in your logs, but investigation shows that they occur
 486        because of overload with legal connections, you should tune
 487        another parameters until this warning disappear.
 488        See: tcp_max_syn_backlog, tcp_synack_retries, tcp_abort_on_overflow.
 490        syncookies seriously violate TCP protocol, do not allow
 491        to use TCP extensions, can result in serious degradation
 492        of some services (f.e. SMTP relaying), visible not by you,
 493        but your clients and relays, contacting you. While you see
 494        SYN flood warnings in logs not being really flooded, your server
 495        is seriously misconfigured.
 497        If you want to test which effects syncookies have to your
 498        network connections you can set this knob to 2 to enable
 499        unconditionally generation of syncookies.
 501tcp_fastopen - INTEGER
 502        Enable TCP Fast Open feature (draft-ietf-tcpm-fastopen) to send data
 503        in the opening SYN packet. To use this feature, the client application
 504        must use sendmsg() or sendto() with MSG_FASTOPEN flag rather than
 505        connect() to perform a TCP handshake automatically.
 507        The values (bitmap) are
 508        1: Enables sending data in the opening SYN on the client w/ MSG_FASTOPEN.
 509        2: Enables TCP Fast Open on the server side, i.e., allowing data in
 510           a SYN packet to be accepted and passed to the application before
 511           3-way hand shake finishes.
 512        4: Send data in the opening SYN regardless of cookie availability and
 513           without a cookie option.
 514        0x100: Accept SYN data w/o validating the cookie.
 515        0x200: Accept data-in-SYN w/o any cookie option present.
 516        0x400/0x800: Enable Fast Open on all listeners regardless of the
 517           TCP_FASTOPEN socket option. The two different flags designate two
 518           different ways of setting max_qlen without the TCP_FASTOPEN socket
 519           option.
 521        Default: 1
 523        Note that the client & server side Fast Open flags (1 and 2
 524        respectively) must be also enabled before the rest of flags can take
 525        effect.
 527        See include/net/tcp.h and the code for more details.
 529tcp_syn_retries - INTEGER
 530        Number of times initial SYNs for an active TCP connection attempt
 531        will be retransmitted. Should not be higher than 255. Default value
 532        is 6, which corresponds to 63seconds till the last retransmission
 533        with the current initial RTO of 1second. With this the final timeout
 534        for an active TCP connection attempt will happen after 127seconds.
 536tcp_timestamps - BOOLEAN
 537        Enable timestamps as defined in RFC1323.
 539tcp_min_tso_segs - INTEGER
 540        Minimal number of segments per TSO frame.
 541        Since linux-3.12, TCP does an automatic sizing of TSO frames,
 542        depending on flow rate, instead of filling 64Kbytes packets.
 543        For specific usages, it's possible to force TCP to build big
 544        TSO frames. Note that TCP stack might split too big TSO packets
 545        if available window is too small.
 546        Default: 2
 548tcp_tso_win_divisor - INTEGER
 549        This allows control over what percentage of the congestion window
 550        can be consumed by a single TSO frame.
 551        The setting of this parameter is a choice between burstiness and
 552        building larger TSO frames.
 553        Default: 3
 555tcp_tw_recycle - BOOLEAN
 556        Enable fast recycling TIME-WAIT sockets. Default value is 0.
 557        It should not be changed without advice/request of technical
 558        experts.
 560tcp_tw_reuse - BOOLEAN
 561        Allow to reuse TIME-WAIT sockets for new connections when it is
 562        safe from protocol viewpoint. Default value is 0.
 563        It should not be changed without advice/request of technical
 564        experts.
 566tcp_window_scaling - BOOLEAN
 567        Enable window scaling as defined in RFC1323.
 569tcp_wmem - vector of 3 INTEGERs: min, default, max
 570        min: Amount of memory reserved for send buffers for TCP sockets.
 571        Each TCP socket has rights to use it due to fact of its birth.
 572        Default: 1 page
 574        default: initial size of send buffer used by TCP sockets.  This
 575        value overrides net.core.wmem_default used by other protocols.
 576        It is usually lower than net.core.wmem_default.
 577        Default: 16K
 579        max: Maximal amount of memory allowed for automatically tuned
 580        send buffers for TCP sockets. This value does not override
 581        net.core.wmem_max.  Calling setsockopt() with SO_SNDBUF disables
 582        automatic tuning of that socket's send buffer size, in which case
 583        this value is ignored.
 584        Default: between 64K and 4MB, depending on RAM size.
 586tcp_notsent_lowat - UNSIGNED INTEGER
 587        A TCP socket can control the amount of unsent bytes in its write queue,
 588        thanks to TCP_NOTSENT_LOWAT socket option. poll()/select()/epoll()
 589        reports POLLOUT events if the amount of unsent bytes is below a per
 590        socket value, and if the write queue is not full. sendmsg() will
 591        also not add new buffers if the limit is hit.
 593        This global variable controls the amount of unsent data for
 594        sockets not using TCP_NOTSENT_LOWAT. For these sockets, a change
 595        to the global variable has immediate effect.
 597        Default: UINT_MAX (0xFFFFFFFF)
 599tcp_workaround_signed_windows - BOOLEAN
 600        If set, assume no receipt of a window scaling option means the
 601        remote TCP is broken and treats the window as a signed quantity.
 602        If unset, assume the remote TCP is not broken even if we do
 603        not receive a window scaling option from them.
 604        Default: 0
 606tcp_thin_linear_timeouts - BOOLEAN
 607        Enable dynamic triggering of linear timeouts for thin streams.
 608        If set, a check is performed upon retransmission by timeout to
 609        determine if the stream is thin (less than 4 packets in flight).
 610        As long as the stream is found to be thin, up to 6 linear
 611        timeouts may be performed before exponential backoff mode is
 612        initiated. This improves retransmission latency for
 613        non-aggressive thin streams, often found to be time-dependent.
 614        For more information on thin streams, see
 615        Documentation/networking/tcp-thin.txt
 616        Default: 0
 618tcp_thin_dupack - BOOLEAN
 619        Enable dynamic triggering of retransmissions after one dupACK
 620        for thin streams. If set, a check is performed upon reception
 621        of a dupACK to determine if the stream is thin (less than 4
 622        packets in flight). As long as the stream is found to be thin,
 623        data is retransmitted on the first received dupACK. This
 624        improves retransmission latency for non-aggressive thin
 625        streams, often found to be time-dependent.
 626        For more information on thin streams, see
 627        Documentation/networking/tcp-thin.txt
 628        Default: 0
 630tcp_limit_output_bytes - INTEGER
 631        Controls TCP Small Queue limit per tcp socket.
 632        TCP bulk sender tends to increase packets in flight until it
 633        gets losses notifications. With SNDBUF autotuning, this can
 634        result in a large amount of packets queued in qdisc/device
 635        on the local machine, hurting latency of other flows, for
 636        typical pfifo_fast qdiscs.
 637        tcp_limit_output_bytes limits the number of bytes on qdisc
 638        or device to reduce artificial RTT/cwnd and reduce bufferbloat.
 639        Default: 131072
 641tcp_challenge_ack_limit - INTEGER
 642        Limits number of Challenge ACK sent per second, as recommended
 643        in RFC 5961 (Improving TCP's Robustness to Blind In-Window Attacks)
 644        Default: 100
 646UDP variables:
 648udp_mem - vector of 3 INTEGERs: min, pressure, max
 649        Number of pages allowed for queueing by all UDP sockets.
 651        min: Below this number of pages UDP is not bothered about its
 652        memory appetite. When amount of memory allocated by UDP exceeds
 653        this number, UDP starts to moderate memory usage.
 655        pressure: This value was introduced to follow format of tcp_mem.
 657        max: Number of pages allowed for queueing by all UDP sockets.
 659        Default is calculated at boot time from amount of available memory.
 661udp_rmem_min - INTEGER
 662        Minimal size of receive buffer used by UDP sockets in moderation.
 663        Each UDP socket is able to use the size for receiving data, even if
 664        total pages of UDP sockets exceed udp_mem pressure. The unit is byte.
 665        Default: 1 page
 667udp_wmem_min - INTEGER
 668        Minimal size of send buffer used by UDP sockets in moderation.
 669        Each UDP socket is able to use the size for sending data, even if
 670        total pages of UDP sockets exceed udp_mem pressure. The unit is byte.
 671        Default: 1 page
 673CIPSOv4 Variables:
 675cipso_cache_enable - BOOLEAN
 676        If set, enable additions to and lookups from the CIPSO label mapping
 677        cache.  If unset, additions are ignored and lookups always result in a
 678        miss.  However, regardless of the setting the cache is still
 679        invalidated when required when means you can safely toggle this on and
 680        off and the cache will always be "safe".
 681        Default: 1
 683cipso_cache_bucket_size - INTEGER
 684        The CIPSO label cache consists of a fixed size hash table with each
 685        hash bucket containing a number of cache entries.  This variable limits
 686        the number of entries in each hash bucket; the larger the value the
 687        more CIPSO label mappings that can be cached.  When the number of
 688        entries in a given hash bucket reaches this limit adding new entries
 689        causes the oldest entry in the bucket to be removed to make room.
 690        Default: 10
 692cipso_rbm_optfmt - BOOLEAN
 693        Enable the "Optimized Tag 1 Format" as defined in section of
 694        the CIPSO draft specification (see Documentation/netlabel for details).
 695        This means that when set the CIPSO tag will be padded with empty
 696        categories in order to make the packet data 32-bit aligned.
 697        Default: 0
 699cipso_rbm_structvalid - BOOLEAN
 700        If set, do a very strict check of the CIPSO option when
 701        ip_options_compile() is called.  If unset, relax the checks done during
 702        ip_options_compile().  Either way is "safe" as errors are caught else
 703        where in the CIPSO processing code but setting this to 0 (False) should
 704        result in less work (i.e. it should be faster) but could cause problems
 705        with other implementations that require strict checking.
 706        Default: 0
 708IP Variables:
 710ip_local_port_range - 2 INTEGERS
 711        Defines the local port range that is used by TCP and UDP to
 712        choose the local port. The first number is the first, the
 713        second the last local port number. The default values are
 714        32768 and 61000 respectively.
 716ip_local_reserved_ports - list of comma separated ranges
 717        Specify the ports which are reserved for known third-party
 718        applications. These ports will not be used by automatic port
 719        assignments (e.g. when calling connect() or bind() with port
 720        number 0). Explicit port allocation behavior is unchanged.
 722        The format used for both input and output is a comma separated
 723        list of ranges (e.g. "1,2-4,10-10" for ports 1, 2, 3, 4 and
 724        10). Writing to the file will clear all previously reserved
 725        ports and update the current list with the one given in the
 726        input.
 728        Note that ip_local_port_range and ip_local_reserved_ports
 729        settings are independent and both are considered by the kernel
 730        when determining which ports are available for automatic port
 731        assignments.
 733        You can reserve ports which are not in the current
 734        ip_local_port_range, e.g.:
 736        $ cat /proc/sys/net/ipv4/ip_local_port_range
 737        32000   61000
 738        $ cat /proc/sys/net/ipv4/ip_local_reserved_ports
 739        8080,9148
 741        although this is redundant. However such a setting is useful
 742        if later the port range is changed to a value that will
 743        include the reserved ports.
 745        Default: Empty
 747ip_nonlocal_bind - BOOLEAN
 748        If set, allows processes to bind() to non-local IP addresses,
 749        which can be quite useful - but may break some applications.
 750        Default: 0
 752ip_dynaddr - BOOLEAN
 753        If set non-zero, enables support for dynamic addresses.
 754        If set to a non-zero value larger than 1, a kernel log
 755        message will be printed when dynamic address rewriting
 756        occurs.
 757        Default: 0
 759ip_early_demux - BOOLEAN
 760        Optimize input packet processing down to one demux for
 761        certain kinds of local sockets.  Currently we only do this
 762        for established TCP sockets.
 764        It may add an additional cost for pure routing workloads that
 765        reduces overall throughput, in such case you should disable it.
 766        Default: 1
 768icmp_echo_ignore_all - BOOLEAN
 769        If set non-zero, then the kernel will ignore all ICMP ECHO
 770        requests sent to it.
 771        Default: 0
 773icmp_echo_ignore_broadcasts - BOOLEAN
 774        If set non-zero, then the kernel will ignore all ICMP ECHO and
 775        TIMESTAMP requests sent to it via broadcast/multicast.
 776        Default: 1
 778icmp_ratelimit - INTEGER
 779        Limit the maximal rates for sending ICMP packets whose type matches
 780        icmp_ratemask (see below) to specific targets.
 781        0 to disable any limiting,
 782        otherwise the minimal space between responses in milliseconds.
 783        Note that another sysctl, icmp_msgs_per_sec limits the number
 784        of ICMP packets sent on all targets.
 785        Default: 1000
 787icmp_msgs_per_sec - INTEGER
 788        Limit maximal number of ICMP packets sent per second from this host.
 789        Only messages whose type matches icmp_ratemask (see below) are
 790        controlled by this limit.
 791        Default: 1000
 793icmp_msgs_burst - INTEGER
 794        icmp_msgs_per_sec controls number of ICMP packets sent per second,
 795        while icmp_msgs_burst controls the burst size of these packets.
 796        Default: 50
 798icmp_ratemask - INTEGER
 799        Mask made of ICMP types for which rates are being limited.
 800        Significant bits: IHGFEDCBA9876543210
 801        Default mask:     0000001100000011000 (6168)
 803        Bit definitions (see include/linux/icmp.h):
 804                0 Echo Reply
 805                3 Destination Unreachable *
 806                4 Source Quench *
 807                5 Redirect
 808                8 Echo Request
 809                B Time Exceeded *
 810                C Parameter Problem *
 811                D Timestamp Request
 812                E Timestamp Reply
 813                F Info Request
 814                G Info Reply
 815                H Address Mask Request
 816                I Address Mask Reply
 818        * These are rate limited by default (see default mask above)
 820icmp_ignore_bogus_error_responses - BOOLEAN
 821        Some routers violate RFC1122 by sending bogus responses to broadcast
 822        frames.  Such violations are normally logged via a kernel warning.
 823        If this is set to TRUE, the kernel will not give such warnings, which
 824        will avoid log file clutter.
 825        Default: 1
 827icmp_errors_use_inbound_ifaddr - BOOLEAN
 829        If zero, icmp error messages are sent with the primary address of
 830        the exiting interface.
 832        If non-zero, the message will be sent with the primary address of
 833        the interface that received the packet that caused the icmp error.
 834        This is the behaviour network many administrators will expect from
 835        a router. And it can make debugging complicated network layouts
 836        much easier.
 838        Note that if no primary address exists for the interface selected,
 839        then the primary address of the first non-loopback interface that
 840        has one will be used regardless of this setting.
 842        Default: 0
 844igmp_max_memberships - INTEGER
 845        Change the maximum number of multicast groups we can subscribe to.
 846        Default: 20
 848        Theoretical maximum value is bounded by having to send a membership
 849        report in a single datagram (i.e. the report can't span multiple
 850        datagrams, or risk confusing the switch and leaving groups you don't
 851        intend to).
 853        The number of supported groups 'M' is bounded by the number of group
 854        report entries you can fit into a single datagram of 65535 bytes.
 856        M = 65536-sizeof (ip header)/(sizeof(Group record))
 858        Group records are variable length, with a minimum of 12 bytes.
 859        So net.ipv4.igmp_max_memberships should not be set higher than:
 861        (65536-24) / 12 = 5459
 863        The value 5459 assumes no IP header options, so in practice
 864        this number may be lower.
 866        conf/interface/*  changes special settings per interface (where
 867        "interface" is the name of your network interface)
 869        conf/all/*        is special, changes the settings for all interfaces
 871igmp_qrv - INTEGER
 872         Controls the IGMP query robustness variable (see RFC2236 8.1).
 873         Default: 2 (as specified by RFC2236 8.1)
 874         Minimum: 1 (as specified by RFC6636 4.5)
 876log_martians - BOOLEAN
 877        Log packets with impossible addresses to kernel log.
 878        log_martians for the interface will be enabled if at least one of
 879        conf/{all,interface}/log_martians is set to TRUE,
 880        it will be disabled otherwise
 882accept_redirects - BOOLEAN
 883        Accept ICMP redirect messages.
 884        accept_redirects for the interface will be enabled if:
 885        - both conf/{all,interface}/accept_redirects are TRUE in the case
 886          forwarding for the interface is enabled
 887        or
 888        - at least one of conf/{all,interface}/accept_redirects is TRUE in the
 889          case forwarding for the interface is disabled
 890        accept_redirects for the interface will be disabled otherwise
 891        default TRUE (host)
 892                FALSE (router)
 894forwarding - BOOLEAN
 895        Enable IP forwarding on this interface.
 897mc_forwarding - BOOLEAN
 898        Do multicast routing. The kernel needs to be compiled with CONFIG_MROUTE
 899        and a multicast routing daemon is required.
 900        conf/all/mc_forwarding must also be set to TRUE to enable multicast
 901        routing for the interface
 903medium_id - INTEGER
 904        Integer value used to differentiate the devices by the medium they
 905        are attached to. Two devices can have different id values when
 906        the broadcast packets are received only on one of them.
 907        The default value 0 means that the device is the only interface
 908        to its medium, value of -1 means that medium is not known.
 910        Currently, it is used to change the proxy_arp behavior:
 911        the proxy_arp feature is enabled for packets forwarded between
 912        two devices attached to different media.
 914proxy_arp - BOOLEAN
 915        Do proxy arp.
 916        proxy_arp for the interface will be enabled if at least one of
 917        conf/{all,interface}/proxy_arp is set to TRUE,
 918        it will be disabled otherwise
 920proxy_arp_pvlan - BOOLEAN
 921        Private VLAN proxy arp.
 922        Basically allow proxy arp replies back to the same interface
 923        (from which the ARP request/solicitation was received).
 925        This is done to support (ethernet) switch features, like RFC
 926        3069, where the individual ports are NOT allowed to
 927        communicate with each other, but they are allowed to talk to
 928        the upstream router.  As described in RFC 3069, it is possible
 929        to allow these hosts to communicate through the upstream
 930        router by proxy_arp'ing. Don't need to be used together with
 931        proxy_arp.
 933        This technology is known by different names:
 934          In RFC 3069 it is called VLAN Aggregation.
 935          Cisco and Allied Telesyn call it Private VLAN.
 936          Hewlett-Packard call it Source-Port filtering or port-isolation.
 937          Ericsson call it MAC-Forced Forwarding (RFC Draft).
 939shared_media - BOOLEAN
 940        Send(router) or accept(host) RFC1620 shared media redirects.
 941        Overrides ip_secure_redirects.
 942        shared_media for the interface will be enabled if at least one of
 943        conf/{all,interface}/shared_media is set to TRUE,
 944        it will be disabled otherwise
 945        default TRUE
 947secure_redirects - BOOLEAN
 948        Accept ICMP redirect messages only for gateways,
 949        listed in default gateway list.
 950        secure_redirects for the interface will be enabled if at least one of
 951        conf/{all,interface}/secure_redirects is set to TRUE,
 952        it will be disabled otherwise
 953        default TRUE
 955send_redirects - BOOLEAN
 956        Send redirects, if router.
 957        send_redirects for the interface will be enabled if at least one of
 958        conf/{all,interface}/send_redirects is set to TRUE,
 959        it will be disabled otherwise
 960        Default: TRUE
 962bootp_relay - BOOLEAN
 963        Accept packets with source address 0.b.c.d destined
 964        not to this host as local ones. It is supposed, that
 965        BOOTP relay daemon will catch and forward such packets.
 966        conf/all/bootp_relay must also be set to TRUE to enable BOOTP relay
 967        for the interface
 968        default FALSE
 969        Not Implemented Yet.
 971accept_source_route - BOOLEAN
 972        Accept packets with SRR option.
 973        conf/all/accept_source_route must also be set to TRUE to accept packets
 974        with SRR option on the interface
 975        default TRUE (router)
 976                FALSE (host)
 978accept_local - BOOLEAN
 979        Accept packets with local source addresses. In combination with
 980        suitable routing, this can be used to direct packets between two
 981        local interfaces over the wire and have them accepted properly.
 982        default FALSE
 984route_localnet - BOOLEAN
 985        Do not consider loopback addresses as martian source or destination
 986        while routing. This enables the use of 127/8 for local routing purposes.
 987        default FALSE
 989rp_filter - INTEGER
 990        0 - No source validation.
 991        1 - Strict mode as defined in RFC3704 Strict Reverse Path
 992            Each incoming packet is tested against the FIB and if the interface
 993            is not the best reverse path the packet check will fail.
 994            By default failed packets are discarded.
 995        2 - Loose mode as defined in RFC3704 Loose Reverse Path
 996            Each incoming packet's source address is also tested against the FIB
 997            and if the source address is not reachable via any interface
 998            the packet check will fail.
1000        Current recommended practice in RFC3704 is to enable strict mode
1001        to prevent IP spoofing from DDos attacks. If using asymmetric routing
1002        or other complicated routing, then loose mode is recommended.
1004        The max value from conf/{all,interface}/rp_filter is used
1005        when doing source validation on the {interface}.
1007        Default value is 0. Note that some distributions enable it
1008        in startup scripts.
1010arp_filter - BOOLEAN
1011        1 - Allows you to have multiple network interfaces on the same
1012        subnet, and have the ARPs for each interface be answered
1013        based on whether or not the kernel would route a packet from
1014        the ARP'd IP out that interface (therefore you must use source
1015        based routing for this to work). In other words it allows control
1016        of which cards (usually 1) will respond to an arp request.
1018        0 - (default) The kernel can respond to arp requests with addresses
1019        from other interfaces. This may seem wrong but it usually makes
1020        sense, because it increases the chance of successful communication.
1021        IP addresses are owned by the complete host on Linux, not by
1022        particular interfaces. Only for more complex setups like load-
1023        balancing, does this behaviour cause problems.
1025        arp_filter for the interface will be enabled if at least one of
1026        conf/{all,interface}/arp_filter is set to TRUE,
1027        it will be disabled otherwise
1029arp_announce - INTEGER
1030        Define different restriction levels for announcing the local
1031        source IP address from IP packets in ARP requests sent on
1032        interface:
1033        0 - (default) Use any local address, configured on any interface
1034        1 - Try to avoid local addresses that are not in the target's
1035        subnet for this interface. This mode is useful when target
1036        hosts reachable via this interface require the source IP
1037        address in ARP requests to be part of their logical network
1038        configured on the receiving interface. When we generate the
1039        request we will check all our subnets that include the
1040        target IP and will preserve the source address if it is from
1041        such subnet. If there is no such subnet we select source
1042        address according to the rules for level 2.
1043        2 - Always use the best local address for this target.
1044        In this mode we ignore the source address in the IP packet
1045        and try to select local address that we prefer for talks with
1046        the target host. Such local address is selected by looking
1047        for primary IP addresses on all our subnets on the outgoing
1048        interface that include the target IP address. If no suitable
1049        local address is found we select the first local address
1050        we have on the outgoing interface or on all other interfaces,
1051        with the hope we will receive reply for our request and
1052        even sometimes no matter the source IP address we announce.
1054        The max value from conf/{all,interface}/arp_announce is used.
1056        Increasing the restriction level gives more chance for
1057        receiving answer from the resolved target while decreasing
1058        the level announces more valid sender's information.
1060arp_ignore - INTEGER
1061        Define different modes for sending replies in response to
1062        received ARP requests that resolve local target IP addresses:
1063        0 - (default): reply for any local target IP address, configured
1064        on any interface
1065        1 - reply only if the target IP address is local address
1066        configured on the incoming interface
1067        2 - reply only if the target IP address is local address
1068        configured on the incoming interface and both with the
1069        sender's IP address are part from same subnet on this interface
1070        3 - do not reply for local addresses configured with scope host,
1071        only resolutions for global and link addresses are replied
1072        4-7 - reserved
1073        8 - do not reply for all local addresses
1075        The max value from conf/{all,interface}/arp_ignore is used
1076        when ARP request is received on the {interface}
1078arp_notify - BOOLEAN
1079        Define mode for notification of address and device changes.
1080        0 - (default): do nothing
1081        1 - Generate gratuitous arp requests when device is brought up
1082            or hardware address changes.
1084arp_accept - BOOLEAN
1085        Define behavior for gratuitous ARP frames who's IP is not
1086        already present in the ARP table:
1087        0 - don't create new entries in the ARP table
1088        1 - create new entries in the ARP table
1090        Both replies and requests type gratuitous arp will trigger the
1091        ARP table to be updated, if this setting is on.
1093        If the ARP table already contains the IP address of the
1094        gratuitous arp frame, the arp table will be updated regardless
1095        if this setting is on or off.
1098app_solicit - INTEGER
1099        The maximum number of probes to send to the user space ARP daemon
1100        via netlink before dropping back to multicast probes (see
1101        mcast_solicit).  Defaults to 0.
1103disable_policy - BOOLEAN
1104        Disable IPSEC policy (SPD) for this interface
1106disable_xfrm - BOOLEAN
1107        Disable IPSEC encryption on this interface, whatever the policy
1109igmpv2_unsolicited_report_interval - INTEGER
1110        The interval in milliseconds in which the next unsolicited
1111        IGMPv1 or IGMPv2 report retransmit will take place.
1112        Default: 10000 (10 seconds)
1114igmpv3_unsolicited_report_interval - INTEGER
1115        The interval in milliseconds in which the next unsolicited
1116        IGMPv3 report retransmit will take place.
1117        Default: 1000 (1 seconds)
1119promote_secondaries - BOOLEAN
1120        When a primary IP address is removed from this interface
1121        promote a corresponding secondary IP address instead of
1122        removing all the corresponding secondary IP addresses.
1125tag - INTEGER
1126        Allows you to write a number, which can be used as required.
1127        Default value is 0.
1129Alexey Kuznetsov.
1132Updated by:
1133Andi Kleen
1135Nicolas Delon
1141/proc/sys/net/ipv6/* Variables:
1143IPv6 has no global variables such as tcp_*.  tcp_* settings under ipv4/ also
1144apply to IPv6 [XXX?].
1146bindv6only - BOOLEAN
1147        Default value for IPV6_V6ONLY socket option,
1148        which restricts use of the IPv6 socket to IPv6 communication
1149        only.
1150                TRUE: disable IPv4-mapped address feature
1151                FALSE: enable IPv4-mapped address feature
1153        Default: FALSE (as specified in RFC3493)
1155flowlabel_consistency - BOOLEAN
1156        Protect the consistency (and unicity) of flow label.
1157        You have to disable it to use IPV6_FL_F_REFLECT flag on the
1158        flow label manager.
1159        TRUE: enabled
1160        FALSE: disabled
1161        Default: TRUE
1163auto_flowlabels - BOOLEAN
1164        Automatically generate flow labels based based on a flow hash
1165        of the packet. This allows intermediate devices, such as routers,
1166        to idenfify packet flows for mechanisms like Equal Cost Multipath
1167        Routing (see RFC 6438).
1168        TRUE: enabled
1169        FALSE: disabled
1170        Default: false
1172anycast_src_echo_reply - BOOLEAN
1173        Controls the use of anycast addresses as source addresses for ICMPv6
1174        echo reply
1175        TRUE:  enabled
1176        FALSE: disabled
1177        Default: FALSE
1179mld_qrv - INTEGER
1180        Controls the MLD query robustness variable (see RFC3810 9.1).
1181        Default: 2 (as specified by RFC3810 9.1)
1182        Minimum: 1 (as specified by RFC6636 4.5)
1184IPv6 Fragmentation:
1186ip6frag_high_thresh - INTEGER
1187        Maximum memory used to reassemble IPv6 fragments. When
1188        ip6frag_high_thresh bytes of memory is allocated for this purpose,
1189        the fragment handler will toss packets until ip6frag_low_thresh
1190        is reached.
1192ip6frag_low_thresh - INTEGER
1193        See ip6frag_high_thresh
1195ip6frag_time - INTEGER
1196        Time in seconds to keep an IPv6 fragment in memory.
1199        Change the interface-specific default settings.
1203        Change all the interface-specific settings.
1205        [XXX:  Other special features than forwarding?]
1207conf/all/forwarding - BOOLEAN
1208        Enable global IPv6 forwarding between all interfaces.
1210        IPv4 and IPv6 work differently here; e.g. netfilter must be used
1211        to control which interfaces may forward packets and which not.
1213        This also sets all interfaces' Host/Router setting
1214        'forwarding' to the specified value.  See below for details.
1216        This referred to as global forwarding.
1218proxy_ndp - BOOLEAN
1219        Do proxy ndp.
1221fwmark_reflect - BOOLEAN
1222        Controls the fwmark of kernel-generated IPv6 reply packets that are not
1223        associated with a socket for example, TCP RSTs or ICMPv6 echo replies).
1224        If unset, these packets have a fwmark of zero. If set, they have the
1225        fwmark of the packet they are replying to.
1226        Default: 0
1229        Change special settings per interface.
1231        The functional behaviour for certain settings is different
1232        depending on whether local forwarding is enabled or not.
1234accept_ra - INTEGER
1235        Accept Router Advertisements; autoconfigure using them.
1237        It also determines whether or not to transmit Router
1238        Solicitations. If and only if the functional setting is to
1239        accept Router Advertisements, Router Solicitations will be
1240        transmitted.
1242        Possible values are:
1243                0 Do not accept Router Advertisements.
1244                1 Accept Router Advertisements if forwarding is disabled.
1245                2 Overrule forwarding behaviour. Accept Router Advertisements
1246                  even if forwarding is enabled.
1248        Functional default: enabled if local forwarding is disabled.
1249                            disabled if local forwarding is enabled.
1251accept_ra_defrtr - BOOLEAN
1252        Learn default router in Router Advertisement.
1254        Functional default: enabled if accept_ra is enabled.
1255                            disabled if accept_ra is disabled.
1257accept_ra_from_local - BOOLEAN
1258        Accept RA with source-address that is found on local machine
1259        if the RA is otherwise proper and able to be accepted.
1260        Default is to NOT accept these as it may be an un-intended
1261        network loop.
1263        Functional default:
1264           enabled if accept_ra_from_local is enabled
1265               on a specific interface.
1266           disabled if accept_ra_from_local is disabled
1267               on a specific interface.
1269accept_ra_pinfo - BOOLEAN
1270        Learn Prefix Information in Router Advertisement.
1272        Functional default: enabled if accept_ra is enabled.
1273                            disabled if accept_ra is disabled.
1275accept_ra_rt_info_max_plen - INTEGER
1276        Maximum prefix length of Route Information in RA.
1278        Route Information w/ prefix larger than or equal to this
1279        variable shall be ignored.
1281        Functional default: 0 if accept_ra_rtr_pref is enabled.
1282                            -1 if accept_ra_rtr_pref is disabled.
1284accept_ra_rtr_pref - BOOLEAN
1285        Accept Router Preference in RA.
1287        Functional default: enabled if accept_ra is enabled.
1288                            disabled if accept_ra is disabled.
1290accept_redirects - BOOLEAN
1291        Accept Redirects.
1293        Functional default: enabled if local forwarding is disabled.
1294                            disabled if local forwarding is enabled.
1296accept_source_route - INTEGER
1297        Accept source routing (routing extension header).
1299        >= 0: Accept only routing header type 2.
1300        < 0: Do not accept routing header.
1302        Default: 0
1304autoconf - BOOLEAN
1305        Autoconfigure addresses using Prefix Information in Router
1306        Advertisements.
1308        Functional default: enabled if accept_ra_pinfo is enabled.
1309                            disabled if accept_ra_pinfo is disabled.
1311dad_transmits - INTEGER
1312        The amount of Duplicate Address Detection probes to send.
1313        Default: 1
1315forwarding - INTEGER
1316        Configure interface-specific Host/Router behaviour.
1318        Note: It is recommended to have the same setting on all
1319        interfaces; mixed router/host scenarios are rather uncommon.
1321        Possible values are:
1322                0 Forwarding disabled
1323                1 Forwarding enabled
1325        FALSE (0):
1327        By default, Host behaviour is assumed.  This means:
1329        1. IsRouter flag is not set in Neighbour Advertisements.
1330        2. If accept_ra is TRUE (default), transmit Router
1331           Solicitations.
1332        3. If accept_ra is TRUE (default), accept Router
1333           Advertisements (and do autoconfiguration).
1334        4. If accept_redirects is TRUE (default), accept Redirects.
1336        TRUE (1):
1338        If local forwarding is enabled, Router behaviour is assumed.
1339        This means exactly the reverse from the above:
1341        1. IsRouter flag is set in Neighbour Advertisements.
1342        2. Router Solicitations are not sent unless accept_ra is 2.
1343        3. Router Advertisements are ignored unless accept_ra is 2.
1344        4. Redirects are ignored.
1346        Default: 0 (disabled) if global forwarding is disabled (default),
1347                 otherwise 1 (enabled).
1349hop_limit - INTEGER
1350        Default Hop Limit to set.
1351        Default: 64
1353mtu - INTEGER
1354        Default Maximum Transfer Unit
1355        Default: 1280 (IPv6 required minimum)
1357router_probe_interval - INTEGER
1358        Minimum interval (in seconds) between Router Probing described
1359        in RFC4191.
1361        Default: 60
1363router_solicitation_delay - INTEGER
1364        Number of seconds to wait after interface is brought up
1365        before sending Router Solicitations.
1366        Default: 1
1368router_solicitation_interval - INTEGER
1369        Number of seconds to wait between Router Solicitations.
1370        Default: 4
1372router_solicitations - INTEGER
1373        Number of Router Solicitations to send until assuming no
1374        routers are present.
1375        Default: 3
1377use_tempaddr - INTEGER
1378        Preference for Privacy Extensions (RFC3041).
1379          <= 0 : disable Privacy Extensions
1380          == 1 : enable Privacy Extensions, but prefer public
1381                 addresses over temporary addresses.
1382          >  1 : enable Privacy Extensions and prefer temporary
1383                 addresses over public addresses.
1384        Default:  0 (for most devices)
1385                 -1 (for point-to-point devices and loopback devices)
1387temp_valid_lft - INTEGER
1388        valid lifetime (in seconds) for temporary addresses.
1389        Default: 604800 (7 days)
1391temp_prefered_lft - INTEGER
1392        Preferred lifetime (in seconds) for temporary addresses.
1393        Default: 86400 (1 day)
1395max_desync_factor - INTEGER
1396        Maximum value for DESYNC_FACTOR, which is a random value
1397        that ensures that clients don't synchronize with each
1398        other and generate new addresses at exactly the same time.
1399        value is in seconds.
1400        Default: 600
1402regen_max_retry - INTEGER
1403        Number of attempts before give up attempting to generate
1404        valid temporary addresses.
1405        Default: 5
1407max_addresses - INTEGER
1408        Maximum number of autoconfigured addresses per interface.  Setting
1409        to zero disables the limitation.  It is not recommended to set this
1410        value too large (or to zero) because it would be an easy way to
1411        crash the kernel by allowing too many addresses to be created.
1412        Default: 16
1414disable_ipv6 - BOOLEAN
1415        Disable IPv6 operation.  If accept_dad is set to 2, this value
1416        will be dynamically set to TRUE if DAD fails for the link-local
1417        address.
1418        Default: FALSE (enable IPv6 operation)
1420        When this value is changed from 1 to 0 (IPv6 is being enabled),
1421        it will dynamically create a link-local address on the given
1422        interface and start Duplicate Address Detection, if necessary.
1424        When this value is changed from 0 to 1 (IPv6 is being disabled),
1425        it will dynamically delete all address on the given interface.
1427accept_dad - INTEGER
1428        Whether to accept DAD (Duplicate Address Detection).
1429        0: Disable DAD
1430        1: Enable DAD (default)
1431        2: Enable DAD, and disable IPv6 operation if MAC-based duplicate
1432           link-local address has been found.
1434force_tllao - BOOLEAN
1435        Enable sending the target link-layer address option even when
1436        responding to a unicast neighbor solicitation.
1437        Default: FALSE
1439        Quoting from RFC 2461, section 4.4, Target link-layer address:
1441        "The option MUST be included for multicast solicitations in order to
1442        avoid infinite Neighbor Solicitation "recursion" when the peer node
1443        does not have a cache entry to return a Neighbor Advertisements
1444        message.  When responding to unicast solicitations, the option can be
1445        omitted since the sender of the solicitation has the correct link-
1446        layer address; otherwise it would not have be able to send the unicast
1447        solicitation in the first place. However, including the link-layer
1448        address in this case adds little overhead and eliminates a potential
1449        race condition where the sender deletes the cached link-layer address
1450        prior to receiving a response to a previous solicitation."
1452ndisc_notify - BOOLEAN
1453        Define mode for notification of address and device changes.
1454        0 - (default): do nothing
1455        1 - Generate unsolicited neighbour advertisements when device is brought
1456            up or hardware address changes.
1458mldv1_unsolicited_report_interval - INTEGER
1459        The interval in milliseconds in which the next unsolicited
1460        MLDv1 report retransmit will take place.
1461        Default: 10000 (10 seconds)
1463mldv2_unsolicited_report_interval - INTEGER
1464        The interval in milliseconds in which the next unsolicited
1465        MLDv2 report retransmit will take place.
1466        Default: 1000 (1 second)
1468force_mld_version - INTEGER
1469        0 - (default) No enforcement of a MLD version, MLDv1 fallback allowed
1470        1 - Enforce to use MLD version 1
1471        2 - Enforce to use MLD version 2
1473suppress_frag_ndisc - INTEGER
1474        Control RFC 6980 (Security Implications of IPv6 Fragmentation
1475        with IPv6 Neighbor Discovery) behavior:
1476        1 - (default) discard fragmented neighbor discovery packets
1477        0 - allow fragmented neighbor discovery packets
1479optimistic_dad - BOOLEAN
1480        Whether to perform Optimistic Duplicate Address Detection (RFC 4429).
1481                0: disabled (default)
1482                1: enabled
1484use_optimistic - BOOLEAN
1485        If enabled, do not classify optimistic addresses as deprecated during
1486        source address selection.  Preferred addresses will still be chosen
1487        before optimistic addresses, subject to other ranking in the source
1488        address selection algorithm.
1489                0: disabled (default)
1490                1: enabled
1493ratelimit - INTEGER
1494        Limit the maximal rates for sending ICMPv6 packets.
1495        0 to disable any limiting,
1496        otherwise the minimal space between responses in milliseconds.
1497        Default: 1000
1500IPv6 Update by:
1501Pekka Savola <>
1502YOSHIFUJI Hideaki / USAGI Project <>
1505/proc/sys/net/bridge/* Variables:
1507bridge-nf-call-arptables - BOOLEAN
1508        1 : pass bridged ARP traffic to arptables' FORWARD chain.
1509        0 : disable this.
1510        Default: 1
1512bridge-nf-call-iptables - BOOLEAN
1513        1 : pass bridged IPv4 traffic to iptables' chains.
1514        0 : disable this.
1515        Default: 1
1517bridge-nf-call-ip6tables - BOOLEAN
1518        1 : pass bridged IPv6 traffic to ip6tables' chains.
1519        0 : disable this.
1520        Default: 1
1522bridge-nf-filter-vlan-tagged - BOOLEAN
1523        1 : pass bridged vlan-tagged ARP/IP/IPv6 traffic to {arp,ip,ip6}tables.
1524        0 : disable this.
1525        Default: 0
1527bridge-nf-filter-pppoe-tagged - BOOLEAN
1528        1 : pass bridged pppoe-tagged IP/IPv6 traffic to {ip,ip6}tables.
1529        0 : disable this.
1530        Default: 0
1532bridge-nf-pass-vlan-input-dev - BOOLEAN
1533        1: if bridge-nf-filter-vlan-tagged is enabled, try to find a vlan
1534        interface on the bridge and set the netfilter input device to the vlan.
1535        This allows use of e.g. "iptables -i br0.1" and makes the REDIRECT
1536        target work with vlan-on-top-of-bridge interfaces.  When no matching
1537        vlan interface is found, or this switch is off, the input device is
1538        set to the bridge interface.
1539        0: disable bridge netfilter vlan interface lookup.
1540        Default: 0
1542proc/sys/net/sctp/* Variables:
1544addip_enable - BOOLEAN
1545        Enable or disable extension of  Dynamic Address Reconfiguration
1546        (ADD-IP) functionality specified in RFC5061.  This extension provides
1547        the ability to dynamically add and remove new addresses for the SCTP
1548        associations.
1550        1: Enable extension.
1552        0: Disable extension.
1554        Default: 0
1556addip_noauth_enable - BOOLEAN
1557        Dynamic Address Reconfiguration (ADD-IP) requires the use of
1558        authentication to protect the operations of adding or removing new
1559        addresses.  This requirement is mandated so that unauthorized hosts
1560        would not be able to hijack associations.  However, older
1561        implementations may not have implemented this requirement while
1562        allowing the ADD-IP extension.  For reasons of interoperability,
1563        we provide this variable to control the enforcement of the
1564        authentication requirement.
1566        1: Allow ADD-IP extension to be used without authentication.  This
1567           should only be set in a closed environment for interoperability
1568           with older implementations.
1570        0: Enforce the authentication requirement
1572        Default: 0
1574auth_enable - BOOLEAN
1575        Enable or disable Authenticated Chunks extension.  This extension
1576        provides the ability to send and receive authenticated chunks and is
1577        required for secure operation of Dynamic Address Reconfiguration
1578        (ADD-IP) extension.
1580        1: Enable this extension.
1581        0: Disable this extension.
1583        Default: 0
1585prsctp_enable - BOOLEAN
1586        Enable or disable the Partial Reliability extension (RFC3758) which
1587        is used to notify peers that a given DATA should no longer be expected.
1589        1: Enable extension
1590        0: Disable
1592        Default: 1
1594max_burst - INTEGER
1595        The limit of the number of new packets that can be initially sent.  It
1596        controls how bursty the generated traffic can be.
1598        Default: 4
1600association_max_retrans - INTEGER
1601        Set the maximum number for retransmissions that an association can
1602        attempt deciding that the remote end is unreachable.  If this value
1603        is exceeded, the association is terminated.
1605        Default: 10
1607max_init_retransmits - INTEGER
1608        The maximum number of retransmissions of INIT and COOKIE-ECHO chunks
1609        that an association will attempt before declaring the destination
1610        unreachable and terminating.
1612        Default: 8
1614path_max_retrans - INTEGER
1615        The maximum number of retransmissions that will be attempted on a given
1616        path.  Once this threshold is exceeded, the path is considered
1617        unreachable, and new traffic will use a different path when the
1618        association is multihomed.
1620        Default: 5
1622pf_retrans - INTEGER
1623        The number of retransmissions that will be attempted on a given path
1624        before traffic is redirected to an alternate transport (should one
1625        exist).  Note this is distinct from path_max_retrans, as a path that
1626        passes the pf_retrans threshold can still be used.  Its only
1627        deprioritized when a transmission path is selected by the stack.  This
1628        setting is primarily used to enable fast failover mechanisms without
1629        having to reduce path_max_retrans to a very low value.  See:
1631        for details.  Note also that a value of pf_retrans > path_max_retrans
1632        disables this feature
1634        Default: 0
1636rto_initial - INTEGER
1637        The initial round trip timeout value in milliseconds that will be used
1638        in calculating round trip times.  This is the initial time interval
1639        for retransmissions.
1641        Default: 3000
1643rto_max - INTEGER
1644        The maximum value (in milliseconds) of the round trip timeout.  This
1645        is the largest time interval that can elapse between retransmissions.
1647        Default: 60000
1649rto_min - INTEGER
1650        The minimum value (in milliseconds) of the round trip timeout.  This
1651        is the smallest time interval the can elapse between retransmissions.
1653        Default: 1000
1655hb_interval - INTEGER
1656        The interval (in milliseconds) between HEARTBEAT chunks.  These chunks
1657        are sent at the specified interval on idle paths to probe the state of
1658        a given path between 2 associations.
1660        Default: 30000
1662sack_timeout - INTEGER
1663        The amount of time (in milliseconds) that the implementation will wait
1664        to send a SACK.
1666        Default: 200
1668valid_cookie_life - INTEGER
1669        The default lifetime of the SCTP cookie (in milliseconds).  The cookie
1670        is used during association establishment.
1672        Default: 60000
1674cookie_preserve_enable - BOOLEAN
1675        Enable or disable the ability to extend the lifetime of the SCTP cookie
1676        that is used during the establishment phase of SCTP association
1678        1: Enable cookie lifetime extension.
1679        0: Disable
1681        Default: 1
1683cookie_hmac_alg - STRING
1684        Select the hmac algorithm used when generating the cookie value sent by
1685        a listening sctp socket to a connecting client in the INIT-ACK chunk.
1686        Valid values are:
1687        * md5
1688        * sha1
1689        * none
1690        Ability to assign md5 or sha1 as the selected alg is predicated on the
1691        configuration of those algorithms at build time (CONFIG_CRYPTO_MD5 and
1692        CONFIG_CRYPTO_SHA1).
1694        Default: Dependent on configuration.  MD5 if available, else SHA1 if
1695        available, else none.
1697rcvbuf_policy - INTEGER
1698        Determines if the receive buffer is attributed to the socket or to
1699        association.   SCTP supports the capability to create multiple
1700        associations on a single socket.  When using this capability, it is
1701        possible that a single stalled association that's buffering a lot
1702        of data may block other associations from delivering their data by
1703        consuming all of the receive buffer space.  To work around this,
1704        the rcvbuf_policy could be set to attribute the receiver buffer space
1705        to each association instead of the socket.  This prevents the described
1706        blocking.
1708        1: rcvbuf space is per association
1709        0: rcvbuf space is per socket
1711        Default: 0
1713sndbuf_policy - INTEGER
1714        Similar to rcvbuf_policy above, this applies to send buffer space.
1716        1: Send buffer is tracked per association
1717        0: Send buffer is tracked per socket.
1719        Default: 0
1721sctp_mem - vector of 3 INTEGERs: min, pressure, max
1722        Number of pages allowed for queueing by all SCTP sockets.
1724        min: Below this number of pages SCTP is not bothered about its
1725        memory appetite. When amount of memory allocated by SCTP exceeds
1726        this number, SCTP starts to moderate memory usage.
1728        pressure: This value was introduced to follow format of tcp_mem.
1730        max: Number of pages allowed for queueing by all SCTP sockets.
1732        Default is calculated at boot time from amount of available memory.
1734sctp_rmem - vector of 3 INTEGERs: min, default, max
1735        Only the first value ("min") is used, "default" and "max" are
1736        ignored.
1738        min: Minimal size of receive buffer used by SCTP socket.
1739        It is guaranteed to each SCTP socket (but not association) even
1740        under moderate memory pressure.
1742        Default: 1 page
1744sctp_wmem  - vector of 3 INTEGERs: min, default, max
1745        Currently this tunable has no effect.
1747addr_scope_policy - INTEGER
1748        Control IPv4 address scoping - draft-stewart-tsvwg-sctp-ipv4-00
1750        0   - Disable IPv4 address scoping
1751        1   - Enable IPv4 address scoping
1752        2   - Follow draft but allow IPv4 private addresses
1753        3   - Follow draft but allow IPv4 link local addresses
1755        Default: 1
1759        Please see: Documentation/sysctl/net.txt for descriptions of these entries.
1763max_dgram_qlen - INTEGER
1764        The maximum length of dgram socket receive queue
1766        Default: 10
1772        fast_poll_increase FIXME
1773        warn_noreply_time FIXME
1774        discovery_slots FIXME
1775        slot_timeout FIXME
1776        max_baud_rate FIXME
1777        discovery_timeout FIXME
1778        lap_keepalive_time FIXME
1779        max_noreply_time FIXME
1780        max_tx_data_size FIXME
1781        max_tx_window FIXME
1782        min_tx_turn_time FIXME
1783 kindly hosted by Redpill Linpro AS, provider of Linux consulting and operations services since 1995.