1/proc/sys/net/ipv4/* Variables:
   3ip_forward - BOOLEAN
   4        0 - disabled (default)
   5        not 0 - enabled
   7        Forward Packets between interfaces.
   9        This variable is special, its change resets all configuration
  10        parameters to their default state (RFC1122 for hosts, RFC1812
  11        for routers)
  13ip_default_ttl - INTEGER
  14        Default value of TTL field (Time To Live) for outgoing (but not
  15        forwarded) IP packets. Should be between 1 and 255 inclusive.
  16        Default: 64 (as recommended by RFC1700)
  18ip_no_pmtu_disc - INTEGER
  19        Disable Path MTU Discovery. If enabled in mode 1 and a
  20        fragmentation-required ICMP is received, the PMTU to this
  21        destination will be set to min_pmtu (see below). You will need
  22        to raise min_pmtu to the smallest interface MTU on your system
  23        manually if you want to avoid locally generated fragments.
  25        In mode 2 incoming Path MTU Discovery messages will be
  26        discarded. Outgoing frames are handled the same as in mode 1,
  27        implicitly setting IP_PMTUDISC_DONT on every created socket.
  29        Mode 3 is a hardend pmtu discover mode. The kernel will only
  30        accept fragmentation-needed errors if the underlying protocol
  31        can verify them besides a plain socket lookup. Current
  32        protocols for which pmtu events will be honored are TCP, SCTP
  33        and DCCP as they verify e.g. the sequence number or the
  34        association. This mode should not be enabled globally but is
  35        only intended to secure e.g. name servers in namespaces where
  36        TCP path mtu must still work but path MTU information of other
  37        protocols should be discarded. If enabled globally this mode
  38        could break other protocols.
  40        Possible values: 0-3
  41        Default: FALSE
  43min_pmtu - INTEGER
  44        default 552 - minimum discovered Path MTU
  46ip_forward_use_pmtu - BOOLEAN
  47        By default we don't trust protocol path MTUs while forwarding
  48        because they could be easily forged and can lead to unwanted
  49        fragmentation by the router.
  50        You only need to enable this if you have user-space software
  51        which tries to discover path mtus by itself and depends on the
  52        kernel honoring this information. This is normally not the
  53        case.
  54        Default: 0 (disabled)
  55        Possible values:
  56        0 - disabled
  57        1 - enabled
  59fwmark_reflect - BOOLEAN
  60        Controls the fwmark of kernel-generated IPv4 reply packets that are not
  61        associated with a socket for example, TCP RSTs or ICMP echo replies).
  62        If unset, these packets have a fwmark of zero. If set, they have the
  63        fwmark of the packet they are replying to.
  64        Default: 0
  66route/max_size - INTEGER
  67        Maximum number of routes allowed in the kernel.  Increase
  68        this when using large numbers of interfaces and/or routes.
  69        From linux kernel 3.6 onwards, this is deprecated for ipv4
  70        as route cache is no longer used.
  72neigh/default/gc_thresh1 - INTEGER
  73        Minimum number of entries to keep.  Garbage collector will not
  74        purge entries if there are fewer than this number.
  75        Default: 128
  77neigh/default/gc_thresh2 - INTEGER
  78        Threshold when garbage collector becomes more aggressive about
  79        purging entries. Entries older than 5 seconds will be cleared
  80        when over this number.
  81        Default: 512
  83neigh/default/gc_thresh3 - INTEGER
  84        Maximum number of neighbor entries allowed.  Increase this
  85        when using large numbers of interfaces and when communicating
  86        with large numbers of directly-connected peers.
  87        Default: 1024
  89neigh/default/unres_qlen_bytes - INTEGER
  90        The maximum number of bytes which may be used by packets
  91        queued for each unresolved address by other network layers.
  92        (added in linux 3.3)
  93        Setting negative value is meaningless and will return error.
  94        Default: 65536 Bytes(64KB)
  96neigh/default/unres_qlen - INTEGER
  97        The maximum number of packets which may be queued for each
  98        unresolved address by other network layers.
  99        (deprecated in linux 3.3) : use unres_qlen_bytes instead.
 100        Prior to linux 3.3, the default value is 3 which may cause
 101        unexpected packet loss. The current default value is calculated
 102        according to default value of unres_qlen_bytes and true size of
 103        packet.
 104        Default: 31
 106mtu_expires - INTEGER
 107        Time, in seconds, that cached PMTU information is kept.
 109min_adv_mss - INTEGER
 110        The advertised MSS depends on the first hop route MTU, but will
 111        never be lower than this setting.
 113IP Fragmentation:
 115ipfrag_high_thresh - INTEGER
 116        Maximum memory used to reassemble IP fragments. When
 117        ipfrag_high_thresh bytes of memory is allocated for this purpose,
 118        the fragment handler will toss packets until ipfrag_low_thresh
 119        is reached. This also serves as a maximum limit to namespaces
 120        different from the initial one.
 122ipfrag_low_thresh - INTEGER
 123        Maximum memory used to reassemble IP fragments before the kernel
 124        begins to remove incomplete fragment queues to free up resources.
 125        The kernel still accepts new fragments for defragmentation.
 127ipfrag_time - INTEGER
 128        Time in seconds to keep an IP fragment in memory.
 130ipfrag_max_dist - INTEGER
 131        ipfrag_max_dist is a non-negative integer value which defines the
 132        maximum "disorder" which is allowed among fragments which share a
 133        common IP source address. Note that reordering of packets is
 134        not unusual, but if a large number of fragments arrive from a source
 135        IP address while a particular fragment queue remains incomplete, it
 136        probably indicates that one or more fragments belonging to that queue
 137        have been lost. When ipfrag_max_dist is positive, an additional check
 138        is done on fragments before they are added to a reassembly queue - if
 139        ipfrag_max_dist (or more) fragments have arrived from a particular IP
 140        address between additions to any IP fragment queue using that source
 141        address, it's presumed that one or more fragments in the queue are
 142        lost. The existing fragment queue will be dropped, and a new one
 143        started. An ipfrag_max_dist value of zero disables this check.
 145        Using a very small value, e.g. 1 or 2, for ipfrag_max_dist can
 146        result in unnecessarily dropping fragment queues when normal
 147        reordering of packets occurs, which could lead to poor application
 148        performance. Using a very large value, e.g. 50000, increases the
 149        likelihood of incorrectly reassembling IP fragments that originate
 150        from different IP datagrams, which could result in data corruption.
 151        Default: 64
 153INET peer storage:
 155inet_peer_threshold - INTEGER
 156        The approximate size of the storage.  Starting from this threshold
 157        entries will be thrown aggressively.  This threshold also determines
 158        entries' time-to-live and time intervals between garbage collection
 159        passes.  More entries, less time-to-live, less GC interval.
 161inet_peer_minttl - INTEGER
 162        Minimum time-to-live of entries.  Should be enough to cover fragment
 163        time-to-live on the reassembling side.  This minimum time-to-live  is
 164        guaranteed if the pool size is less than inet_peer_threshold.
 165        Measured in seconds.
 167inet_peer_maxttl - INTEGER
 168        Maximum time-to-live of entries.  Unused entries will expire after
 169        this period of time if there is no memory pressure on the pool (i.e.
 170        when the number of entries in the pool is very small).
 171        Measured in seconds.
 173TCP variables:
 175somaxconn - INTEGER
 176        Limit of socket listen() backlog, known in userspace as SOMAXCONN.
 177        Defaults to 128.  See also tcp_max_syn_backlog for additional tuning
 178        for TCP sockets.
 180tcp_abort_on_overflow - BOOLEAN
 181        If listening service is too slow to accept new connections,
 182        reset them. Default state is FALSE. It means that if overflow
 183        occurred due to a burst, connection will recover. Enable this
 184        option _only_ if you are really sure that listening daemon
 185        cannot be tuned to accept connections faster. Enabling this
 186        option can harm clients of your server.
 188tcp_adv_win_scale - INTEGER
 189        Count buffering overhead as bytes/2^tcp_adv_win_scale
 190        (if tcp_adv_win_scale > 0) or bytes-bytes/2^(-tcp_adv_win_scale),
 191        if it is <= 0.
 192        Possible values are [-31, 31], inclusive.
 193        Default: 1
 195tcp_allowed_congestion_control - STRING
 196        Show/set the congestion control choices available to non-privileged
 197        processes. The list is a subset of those listed in
 198        tcp_available_congestion_control.
 199        Default is "reno" and the default setting (tcp_congestion_control).
 201tcp_app_win - INTEGER
 202        Reserve max(window/2^tcp_app_win, mss) of window for application
 203        buffer. Value 0 is special, it means that nothing is reserved.
 204        Default: 31
 206tcp_autocorking - BOOLEAN
 207        Enable TCP auto corking :
 208        When applications do consecutive small write()/sendmsg() system calls,
 209        we try to coalesce these small writes as much as possible, to lower
 210        total amount of sent packets. This is done if at least one prior
 211        packet for the flow is waiting in Qdisc queues or device transmit
 212        queue. Applications can still use TCP_CORK for optimal behavior
 213        when they know how/when to uncork their sockets.
 214        Default : 1
 216tcp_available_congestion_control - STRING
 217        Shows the available congestion control choices that are registered.
 218        More congestion control algorithms may be available as modules,
 219        but not loaded.
 221tcp_base_mss - INTEGER
 222        The initial value of search_low to be used by the packetization layer
 223        Path MTU discovery (MTU probing).  If MTU probing is enabled,
 224        this is the initial MSS used by the connection.
 226tcp_congestion_control - STRING
 227        Set the congestion control algorithm to be used for new
 228        connections. The algorithm "reno" is always available, but
 229        additional choices may be available based on kernel configuration.
 230        Default is set as part of kernel configuration.
 231        For passive connections, the listener congestion control choice
 232        is inherited.
 233        [see setsockopt(listenfd, SOL_TCP, TCP_CONGESTION, "name" ...) ]
 235tcp_dsack - BOOLEAN
 236        Allows TCP to send "duplicate" SACKs.
 238tcp_early_retrans - INTEGER
 239        Enable Early Retransmit (ER), per RFC 5827. ER lowers the threshold
 240        for triggering fast retransmit when the amount of outstanding data is
 241        small and when no previously unsent data can be transmitted (such
 242        that limited transmit could be used). Also controls the use of
 243        Tail loss probe (TLP) that converts RTOs occurring due to tail
 244        losses into fast recovery (draft-dukkipati-tcpm-tcp-loss-probe-01).
 245        Possible values:
 246                0 disables ER
 247                1 enables ER
 248                2 enables ER but delays fast recovery and fast retransmit
 249                  by a fourth of RTT. This mitigates connection falsely
 250                  recovers when network has a small degree of reordering
 251                  (less than 3 packets).
 252                3 enables delayed ER and TLP.
 253                4 enables TLP only.
 254        Default: 3
 256tcp_ecn - INTEGER
 257        Control use of Explicit Congestion Notification (ECN) by TCP.
 258        ECN is used only when both ends of the TCP connection indicate
 259        support for it.  This feature is useful in avoiding losses due
 260        to congestion by allowing supporting routers to signal
 261        congestion before having to drop packets.
 262        Possible values are:
 263                0 Disable ECN.  Neither initiate nor accept ECN.
 264                1 Enable ECN when requested by incoming connections and
 265                  also request ECN on outgoing connection attempts.
 266                2 Enable ECN when requested by incoming connections
 267                  but do not request ECN on outgoing connections.
 268        Default: 2
 270tcp_ecn_fallback - BOOLEAN
 271        If the kernel detects that ECN connection misbehaves, enable fall
 272        back to non-ECN. Currently, this knob implements the fallback
 273        from RFC3168, section, but we reserve that in future,
 274        additional detection mechanisms could be implemented under this
 275        knob. The value is not used, if tcp_ecn or per route (or congestion
 276        control) ECN settings are disabled.
 277        Default: 1 (fallback enabled)
 279tcp_fack - BOOLEAN
 280        Enable FACK congestion avoidance and fast retransmission.
 281        The value is not used, if tcp_sack is not enabled.
 283tcp_fin_timeout - INTEGER
 284        The length of time an orphaned (no longer referenced by any
 285        application) connection will remain in the FIN_WAIT_2 state
 286        before it is aborted at the local end.  While a perfectly
 287        valid "receive only" state for an un-orphaned connection, an
 288        orphaned connection in FIN_WAIT_2 state could otherwise wait
 289        forever for the remote to close its end of the connection.
 290        Cf. tcp_max_orphans
 291        Default: 60 seconds
 293tcp_frto - INTEGER
 294        Enables Forward RTO-Recovery (F-RTO) defined in RFC5682.
 295        F-RTO is an enhanced recovery algorithm for TCP retransmission
 296        timeouts.  It is particularly beneficial in networks where the
 297        RTT fluctuates (e.g., wireless). F-RTO is sender-side only
 298        modification. It does not require any support from the peer.
 300        By default it's enabled with a non-zero value. 0 disables F-RTO.
 302tcp_invalid_ratelimit - INTEGER
 303        Limit the maximal rate for sending duplicate acknowledgments
 304        in response to incoming TCP packets that are for an existing
 305        connection but that are invalid due to any of these reasons:
 307          (a) out-of-window sequence number,
 308          (b) out-of-window acknowledgment number, or
 309          (c) PAWS (Protection Against Wrapped Sequence numbers) check failure
 311        This can help mitigate simple "ack loop" DoS attacks, wherein
 312        a buggy or malicious middlebox or man-in-the-middle can
 313        rewrite TCP header fields in manner that causes each endpoint
 314        to think that the other is sending invalid TCP segments, thus
 315        causing each side to send an unterminating stream of duplicate
 316        acknowledgments for invalid segments.
 318        Using 0 disables rate-limiting of dupacks in response to
 319        invalid segments; otherwise this value specifies the minimal
 320        space between sending such dupacks, in milliseconds.
 322        Default: 500 (milliseconds).
 324tcp_keepalive_time - INTEGER
 325        How often TCP sends out keepalive messages when keepalive is enabled.
 326        Default: 2hours.
 328tcp_keepalive_probes - INTEGER
 329        How many keepalive probes TCP sends out, until it decides that the
 330        connection is broken. Default value: 9.
 332tcp_keepalive_intvl - INTEGER
 333        How frequently the probes are send out. Multiplied by
 334        tcp_keepalive_probes it is time to kill not responding connection,
 335        after probes started. Default value: 75sec i.e. connection
 336        will be aborted after ~11 minutes of retries.
 338tcp_l3mdev_accept - BOOLEAN
 339        Enables child sockets to inherit the L3 master device index.
 340        Enabling this option allows a "global" listen socket to work
 341        across L3 master domains (e.g., VRFs) with connected sockets
 342        derived from the listen socket to be bound to the L3 domain in
 343        which the packets originated. Only valid when the kernel was
 344        compiled with CONFIG_NET_L3_MASTER_DEV.
 346tcp_low_latency - BOOLEAN
 347        If set, the TCP stack makes decisions that prefer lower
 348        latency as opposed to higher throughput.  By default, this
 349        option is not set meaning that higher throughput is preferred.
 350        An example of an application where this default should be
 351        changed would be a Beowulf compute cluster.
 352        Default: 0
 354tcp_max_orphans - INTEGER
 355        Maximal number of TCP sockets not attached to any user file handle,
 356        held by system. If this number is exceeded orphaned connections are
 357        reset immediately and warning is printed. This limit exists
 358        only to prevent simple DoS attacks, you _must_ not rely on this
 359        or lower the limit artificially, but rather increase it
 360        (probably, after increasing installed memory),
 361        if network conditions require more than default value,
 362        and tune network services to linger and kill such states
 363        more aggressively. Let me to remind again: each orphan eats
 364        up to ~64K of unswappable memory.
 366tcp_max_syn_backlog - INTEGER
 367        Maximal number of remembered connection requests, which have not
 368        received an acknowledgment from connecting client.
 369        The minimal value is 128 for low memory machines, and it will
 370        increase in proportion to the memory of machine.
 371        If server suffers from overload, try increasing this number.
 373tcp_max_tw_buckets - INTEGER
 374        Maximal number of timewait sockets held by system simultaneously.
 375        If this number is exceeded time-wait socket is immediately destroyed
 376        and warning is printed. This limit exists only to prevent
 377        simple DoS attacks, you _must_ not lower the limit artificially,
 378        but rather increase it (probably, after increasing installed memory),
 379        if network conditions require more than default value.
 381tcp_mem - vector of 3 INTEGERs: min, pressure, max
 382        min: below this number of pages TCP is not bothered about its
 383        memory appetite.
 385        pressure: when amount of memory allocated by TCP exceeds this number
 386        of pages, TCP moderates its memory consumption and enters memory
 387        pressure mode, which is exited when memory consumption falls
 388        under "min".
 390        max: number of pages allowed for queueing by all TCP sockets.
 392        Defaults are calculated at boot time from amount of available
 393        memory.
 395tcp_min_rtt_wlen - INTEGER
 396        The window length of the windowed min filter to track the minimum RTT.
 397        A shorter window lets a flow more quickly pick up new (higher)
 398        minimum RTT when it is moved to a longer path (e.g., due to traffic
 399        engineering). A longer window makes the filter more resistant to RTT
 400        inflations such as transient congestion. The unit is seconds.
 401        Default: 300
 403tcp_moderate_rcvbuf - BOOLEAN
 404        If set, TCP performs receive buffer auto-tuning, attempting to
 405        automatically size the buffer (no greater than tcp_rmem[2]) to
 406        match the size required by the path for full throughput.  Enabled by
 407        default.
 409tcp_mtu_probing - INTEGER
 410        Controls TCP Packetization-Layer Path MTU Discovery.  Takes three
 411        values:
 412          0 - Disabled
 413          1 - Disabled by default, enabled when an ICMP black hole detected
 414          2 - Always enabled, use initial MSS of tcp_base_mss.
 416tcp_probe_interval - INTEGER
 417        Controls how often to start TCP Packetization-Layer Path MTU
 418        Discovery reprobe. The default is reprobing every 10 minutes as
 419        per RFC4821.
 421tcp_probe_threshold - INTEGER
 422        Controls when TCP Packetization-Layer Path MTU Discovery probing
 423        will stop in respect to the width of search range in bytes. Default
 424        is 8 bytes.
 426tcp_no_metrics_save - BOOLEAN
 427        By default, TCP saves various connection metrics in the route cache
 428        when the connection closes, so that connections established in the
 429        near future can use these to set initial conditions.  Usually, this
 430        increases overall performance, but may sometimes cause performance
 431        degradation.  If set, TCP will not cache metrics on closing
 432        connections.
 434tcp_orphan_retries - INTEGER
 435        This value influences the timeout of a locally closed TCP connection,
 436        when RTO retransmissions remain unacknowledged.
 437        See tcp_retries2 for more details.
 439        The default value is 8.
 440        If your machine is a loaded WEB server,
 441        you should think about lowering this value, such sockets
 442        may consume significant resources. Cf. tcp_max_orphans.
 444tcp_recovery - INTEGER
 445        This value is a bitmap to enable various experimental loss recovery
 446        features.
 448        RACK: 0x1 enables the RACK loss detection for fast detection of lost
 449              retransmissions and tail drops.
 451        Default: 0x1
 453tcp_reordering - INTEGER
 454        Initial reordering level of packets in a TCP stream.
 455        TCP stack can then dynamically adjust flow reordering level
 456        between this initial value and tcp_max_reordering
 457        Default: 3
 459tcp_max_reordering - INTEGER
 460        Maximal reordering level of packets in a TCP stream.
 461        300 is a fairly conservative value, but you might increase it
 462        if paths are using per packet load balancing (like bonding rr mode)
 463        Default: 300
 465tcp_retrans_collapse - BOOLEAN
 466        Bug-to-bug compatibility with some broken printers.
 467        On retransmit try to send bigger packets to work around bugs in
 468        certain TCP stacks.
 470tcp_retries1 - INTEGER
 471        This value influences the time, after which TCP decides, that
 472        something is wrong due to unacknowledged RTO retransmissions,
 473        and reports this suspicion to the network layer.
 474        See tcp_retries2 for more details.
 476        RFC 1122 recommends at least 3 retransmissions, which is the
 477        default.
 479tcp_retries2 - INTEGER
 480        This value influences the timeout of an alive TCP connection,
 481        when RTO retransmissions remain unacknowledged.
 482        Given a value of N, a hypothetical TCP connection following
 483        exponential backoff with an initial RTO of TCP_RTO_MIN would
 484        retransmit N times before killing the connection at the (N+1)th RTO.
 486        The default value of 15 yields a hypothetical timeout of 924.6
 487        seconds and is a lower bound for the effective timeout.
 488        TCP will effectively time out at the first RTO which exceeds the
 489        hypothetical timeout.
 491        RFC 1122 recommends at least 100 seconds for the timeout,
 492        which corresponds to a value of at least 8.
 494tcp_rfc1337 - BOOLEAN
 495        If set, the TCP stack behaves conforming to RFC1337. If unset,
 496        we are not conforming to RFC, but prevent TCP TIME_WAIT
 497        assassination.
 498        Default: 0
 500tcp_rmem - vector of 3 INTEGERs: min, default, max
 501        min: Minimal size of receive buffer used by TCP sockets.
 502        It is guaranteed to each TCP socket, even under moderate memory
 503        pressure.
 504        Default: 1 page
 506        default: initial size of receive buffer used by TCP sockets.
 507        This value overrides net.core.rmem_default used by other protocols.
 508        Default: 87380 bytes. This value results in window of 65535 with
 509        default setting of tcp_adv_win_scale and tcp_app_win:0 and a bit
 510        less for default tcp_app_win. See below about these variables.
 512        max: maximal size of receive buffer allowed for automatically
 513        selected receiver buffers for TCP socket. This value does not override
 514        net.core.rmem_max.  Calling setsockopt() with SO_RCVBUF disables
 515        automatic tuning of that socket's receive buffer size, in which
 516        case this value is ignored.
 517        Default: between 87380B and 6MB, depending on RAM size.
 519tcp_sack - BOOLEAN
 520        Enable select acknowledgments (SACKS).
 522tcp_slow_start_after_idle - BOOLEAN
 523        If set, provide RFC2861 behavior and time out the congestion
 524        window after an idle period.  An idle period is defined at
 525        the current RTO.  If unset, the congestion window will not
 526        be timed out after an idle period.
 527        Default: 1
 529tcp_stdurg - BOOLEAN
 530        Use the Host requirements interpretation of the TCP urgent pointer field.
 531        Most hosts use the older BSD interpretation, so if you turn this on
 532        Linux might not communicate correctly with them.
 533        Default: FALSE
 535tcp_synack_retries - INTEGER
 536        Number of times SYNACKs for a passive TCP connection attempt will
 537        be retransmitted. Should not be higher than 255. Default value
 538        is 5, which corresponds to 31seconds till the last retransmission
 539        with the current initial RTO of 1second. With this the final timeout
 540        for a passive TCP connection will happen after 63seconds.
 542tcp_syncookies - BOOLEAN
 543        Only valid when the kernel was compiled with CONFIG_SYN_COOKIES
 544        Send out syncookies when the syn backlog queue of a socket
 545        overflows. This is to prevent against the common 'SYN flood attack'
 546        Default: 1
 548        Note, that syncookies is fallback facility.
 549        It MUST NOT be used to help highly loaded servers to stand
 550        against legal connection rate. If you see SYN flood warnings
 551        in your logs, but investigation shows that they occur
 552        because of overload with legal connections, you should tune
 553        another parameters until this warning disappear.
 554        See: tcp_max_syn_backlog, tcp_synack_retries, tcp_abort_on_overflow.
 556        syncookies seriously violate TCP protocol, do not allow
 557        to use TCP extensions, can result in serious degradation
 558        of some services (f.e. SMTP relaying), visible not by you,
 559        but your clients and relays, contacting you. While you see
 560        SYN flood warnings in logs not being really flooded, your server
 561        is seriously misconfigured.
 563        If you want to test which effects syncookies have to your
 564        network connections you can set this knob to 2 to enable
 565        unconditionally generation of syncookies.
 567tcp_fastopen - INTEGER
 568        Enable TCP Fast Open feature (draft-ietf-tcpm-fastopen) to send data
 569        in the opening SYN packet. To use this feature, the client application
 570        must use sendmsg() or sendto() with MSG_FASTOPEN flag rather than
 571        connect() to perform a TCP handshake automatically.
 573        The values (bitmap) are
 574        1: Enables sending data in the opening SYN on the client w/ MSG_FASTOPEN.
 575        2: Enables TCP Fast Open on the server side, i.e., allowing data in
 576           a SYN packet to be accepted and passed to the application before
 577           3-way hand shake finishes.
 578        4: Send data in the opening SYN regardless of cookie availability and
 579           without a cookie option.
 580        0x100: Accept SYN data w/o validating the cookie.
 581        0x200: Accept data-in-SYN w/o any cookie option present.
 582        0x400/0x800: Enable Fast Open on all listeners regardless of the
 583           TCP_FASTOPEN socket option. The two different flags designate two
 584           different ways of setting max_qlen without the TCP_FASTOPEN socket
 585           option.
 587        Default: 1
 589        Note that the client & server side Fast Open flags (1 and 2
 590        respectively) must be also enabled before the rest of flags can take
 591        effect.
 593        See include/net/tcp.h and the code for more details.
 595tcp_syn_retries - INTEGER
 596        Number of times initial SYNs for an active TCP connection attempt
 597        will be retransmitted. Should not be higher than 127. Default value
 598        is 6, which corresponds to 63seconds till the last retransmission
 599        with the current initial RTO of 1second. With this the final timeout
 600        for an active TCP connection attempt will happen after 127seconds.
 602tcp_timestamps - BOOLEAN
 603        Enable timestamps as defined in RFC1323.
 605tcp_min_tso_segs - INTEGER
 606        Minimal number of segments per TSO frame.
 607        Since linux-3.12, TCP does an automatic sizing of TSO frames,
 608        depending on flow rate, instead of filling 64Kbytes packets.
 609        For specific usages, it's possible to force TCP to build big
 610        TSO frames. Note that TCP stack might split too big TSO packets
 611        if available window is too small.
 612        Default: 2
 614tcp_pacing_ss_ratio - INTEGER
 615        sk->sk_pacing_rate is set by TCP stack using a ratio applied
 616        to current rate. (current_rate = cwnd * mss / srtt)
 617        If TCP is in slow start, tcp_pacing_ss_ratio is applied
 618        to let TCP probe for bigger speeds, assuming cwnd can be
 619        doubled every other RTT.
 620        Default: 200
 622tcp_pacing_ca_ratio - INTEGER
 623        sk->sk_pacing_rate is set by TCP stack using a ratio applied
 624        to current rate. (current_rate = cwnd * mss / srtt)
 625        If TCP is in congestion avoidance phase, tcp_pacing_ca_ratio
 626        is applied to conservatively probe for bigger throughput.
 627        Default: 120
 629tcp_tso_win_divisor - INTEGER
 630        This allows control over what percentage of the congestion window
 631        can be consumed by a single TSO frame.
 632        The setting of this parameter is a choice between burstiness and
 633        building larger TSO frames.
 634        Default: 3
 636tcp_tw_recycle - BOOLEAN
 637        Enable fast recycling TIME-WAIT sockets. Default value is 0.
 638        It should not be changed without advice/request of technical
 639        experts.
 641tcp_tw_reuse - BOOLEAN
 642        Allow to reuse TIME-WAIT sockets for new connections when it is
 643        safe from protocol viewpoint. Default value is 0.
 644        It should not be changed without advice/request of technical
 645        experts.
 647tcp_window_scaling - BOOLEAN
 648        Enable window scaling as defined in RFC1323.
 650tcp_wmem - vector of 3 INTEGERs: min, default, max
 651        min: Amount of memory reserved for send buffers for TCP sockets.
 652        Each TCP socket has rights to use it due to fact of its birth.
 653        Default: 1 page
 655        default: initial size of send buffer used by TCP sockets.  This
 656        value overrides net.core.wmem_default used by other protocols.
 657        It is usually lower than net.core.wmem_default.
 658        Default: 16K
 660        max: Maximal amount of memory allowed for automatically tuned
 661        send buffers for TCP sockets. This value does not override
 662        net.core.wmem_max.  Calling setsockopt() with SO_SNDBUF disables
 663        automatic tuning of that socket's send buffer size, in which case
 664        this value is ignored.
 665        Default: between 64K and 4MB, depending on RAM size.
 667tcp_notsent_lowat - UNSIGNED INTEGER
 668        A TCP socket can control the amount of unsent bytes in its write queue,
 669        thanks to TCP_NOTSENT_LOWAT socket option. poll()/select()/epoll()
 670        reports POLLOUT events if the amount of unsent bytes is below a per
 671        socket value, and if the write queue is not full. sendmsg() will
 672        also not add new buffers if the limit is hit.
 674        This global variable controls the amount of unsent data for
 675        sockets not using TCP_NOTSENT_LOWAT. For these sockets, a change
 676        to the global variable has immediate effect.
 678        Default: UINT_MAX (0xFFFFFFFF)
 680tcp_workaround_signed_windows - BOOLEAN
 681        If set, assume no receipt of a window scaling option means the
 682        remote TCP is broken and treats the window as a signed quantity.
 683        If unset, assume the remote TCP is not broken even if we do
 684        not receive a window scaling option from them.
 685        Default: 0
 687tcp_thin_linear_timeouts - BOOLEAN
 688        Enable dynamic triggering of linear timeouts for thin streams.
 689        If set, a check is performed upon retransmission by timeout to
 690        determine if the stream is thin (less than 4 packets in flight).
 691        As long as the stream is found to be thin, up to 6 linear
 692        timeouts may be performed before exponential backoff mode is
 693        initiated. This improves retransmission latency for
 694        non-aggressive thin streams, often found to be time-dependent.
 695        For more information on thin streams, see
 696        Documentation/networking/tcp-thin.txt
 697        Default: 0
 699tcp_thin_dupack - BOOLEAN
 700        Enable dynamic triggering of retransmissions after one dupACK
 701        for thin streams. If set, a check is performed upon reception
 702        of a dupACK to determine if the stream is thin (less than 4
 703        packets in flight). As long as the stream is found to be thin,
 704        data is retransmitted on the first received dupACK. This
 705        improves retransmission latency for non-aggressive thin
 706        streams, often found to be time-dependent.
 707        For more information on thin streams, see
 708        Documentation/networking/tcp-thin.txt
 709        Default: 0
 711tcp_limit_output_bytes - INTEGER
 712        Controls TCP Small Queue limit per tcp socket.
 713        TCP bulk sender tends to increase packets in flight until it
 714        gets losses notifications. With SNDBUF autotuning, this can
 715        result in a large amount of packets queued in qdisc/device
 716        on the local machine, hurting latency of other flows, for
 717        typical pfifo_fast qdiscs.
 718        tcp_limit_output_bytes limits the number of bytes on qdisc
 719        or device to reduce artificial RTT/cwnd and reduce bufferbloat.
 720        Default: 262144
 722tcp_challenge_ack_limit - INTEGER
 723        Limits number of Challenge ACK sent per second, as recommended
 724        in RFC 5961 (Improving TCP's Robustness to Blind In-Window Attacks)
 725        Default: 100
 727UDP variables:
 729udp_mem - vector of 3 INTEGERs: min, pressure, max
 730        Number of pages allowed for queueing by all UDP sockets.
 732        min: Below this number of pages UDP is not bothered about its
 733        memory appetite. When amount of memory allocated by UDP exceeds
 734        this number, UDP starts to moderate memory usage.
 736        pressure: This value was introduced to follow format of tcp_mem.
 738        max: Number of pages allowed for queueing by all UDP sockets.
 740        Default is calculated at boot time from amount of available memory.
 742udp_rmem_min - INTEGER
 743        Minimal size of receive buffer used by UDP sockets in moderation.
 744        Each UDP socket is able to use the size for receiving data, even if
 745        total pages of UDP sockets exceed udp_mem pressure. The unit is byte.
 746        Default: 1 page
 748udp_wmem_min - INTEGER
 749        Minimal size of send buffer used by UDP sockets in moderation.
 750        Each UDP socket is able to use the size for sending data, even if
 751        total pages of UDP sockets exceed udp_mem pressure. The unit is byte.
 752        Default: 1 page
 754CIPSOv4 Variables:
 756cipso_cache_enable - BOOLEAN
 757        If set, enable additions to and lookups from the CIPSO label mapping
 758        cache.  If unset, additions are ignored and lookups always result in a
 759        miss.  However, regardless of the setting the cache is still
 760        invalidated when required when means you can safely toggle this on and
 761        off and the cache will always be "safe".
 762        Default: 1
 764cipso_cache_bucket_size - INTEGER
 765        The CIPSO label cache consists of a fixed size hash table with each
 766        hash bucket containing a number of cache entries.  This variable limits
 767        the number of entries in each hash bucket; the larger the value the
 768        more CIPSO label mappings that can be cached.  When the number of
 769        entries in a given hash bucket reaches this limit adding new entries
 770        causes the oldest entry in the bucket to be removed to make room.
 771        Default: 10
 773cipso_rbm_optfmt - BOOLEAN
 774        Enable the "Optimized Tag 1 Format" as defined in section of
 775        the CIPSO draft specification (see Documentation/netlabel for details).
 776        This means that when set the CIPSO tag will be padded with empty
 777        categories in order to make the packet data 32-bit aligned.
 778        Default: 0
 780cipso_rbm_structvalid - BOOLEAN
 781        If set, do a very strict check of the CIPSO option when
 782        ip_options_compile() is called.  If unset, relax the checks done during
 783        ip_options_compile().  Either way is "safe" as errors are caught else
 784        where in the CIPSO processing code but setting this to 0 (False) should
 785        result in less work (i.e. it should be faster) but could cause problems
 786        with other implementations that require strict checking.
 787        Default: 0
 789IP Variables:
 791ip_local_port_range - 2 INTEGERS
 792        Defines the local port range that is used by TCP and UDP to
 793        choose the local port. The first number is the first, the
 794        second the last local port number.
 795        If possible, it is better these numbers have different parity.
 796        (one even and one odd values)
 797        The default values are 32768 and 60999 respectively.
 799ip_local_reserved_ports - list of comma separated ranges
 800        Specify the ports which are reserved for known third-party
 801        applications. These ports will not be used by automatic port
 802        assignments (e.g. when calling connect() or bind() with port
 803        number 0). Explicit port allocation behavior is unchanged.
 805        The format used for both input and output is a comma separated
 806        list of ranges (e.g. "1,2-4,10-10" for ports 1, 2, 3, 4 and
 807        10). Writing to the file will clear all previously reserved
 808        ports and update the current list with the one given in the
 809        input.
 811        Note that ip_local_port_range and ip_local_reserved_ports
 812        settings are independent and both are considered by the kernel
 813        when determining which ports are available for automatic port
 814        assignments.
 816        You can reserve ports which are not in the current
 817        ip_local_port_range, e.g.:
 819        $ cat /proc/sys/net/ipv4/ip_local_port_range
 820        32000   60999
 821        $ cat /proc/sys/net/ipv4/ip_local_reserved_ports
 822        8080,9148
 824        although this is redundant. However such a setting is useful
 825        if later the port range is changed to a value that will
 826        include the reserved ports.
 828        Default: Empty
 830ip_nonlocal_bind - BOOLEAN
 831        If set, allows processes to bind() to non-local IP addresses,
 832        which can be quite useful - but may break some applications.
 833        Default: 0
 835ip_dynaddr - BOOLEAN
 836        If set non-zero, enables support for dynamic addresses.
 837        If set to a non-zero value larger than 1, a kernel log
 838        message will be printed when dynamic address rewriting
 839        occurs.
 840        Default: 0
 842ip_early_demux - BOOLEAN
 843        Optimize input packet processing down to one demux for
 844        certain kinds of local sockets.  Currently we only do this
 845        for established TCP sockets.
 847        It may add an additional cost for pure routing workloads that
 848        reduces overall throughput, in such case you should disable it.
 849        Default: 1
 851icmp_echo_ignore_all - BOOLEAN
 852        If set non-zero, then the kernel will ignore all ICMP ECHO
 853        requests sent to it.
 854        Default: 0
 856icmp_echo_ignore_broadcasts - BOOLEAN
 857        If set non-zero, then the kernel will ignore all ICMP ECHO and
 858        TIMESTAMP requests sent to it via broadcast/multicast.
 859        Default: 1
 861icmp_ratelimit - INTEGER
 862        Limit the maximal rates for sending ICMP packets whose type matches
 863        icmp_ratemask (see below) to specific targets.
 864        0 to disable any limiting,
 865        otherwise the minimal space between responses in milliseconds.
 866        Note that another sysctl, icmp_msgs_per_sec limits the number
 867        of ICMP packets sent on all targets.
 868        Default: 1000
 870icmp_msgs_per_sec - INTEGER
 871        Limit maximal number of ICMP packets sent per second from this host.
 872        Only messages whose type matches icmp_ratemask (see below) are
 873        controlled by this limit.
 874        Default: 1000
 876icmp_msgs_burst - INTEGER
 877        icmp_msgs_per_sec controls number of ICMP packets sent per second,
 878        while icmp_msgs_burst controls the burst size of these packets.
 879        Default: 50
 881icmp_ratemask - INTEGER
 882        Mask made of ICMP types for which rates are being limited.
 883        Significant bits: IHGFEDCBA9876543210
 884        Default mask:     0000001100000011000 (6168)
 886        Bit definitions (see include/linux/icmp.h):
 887                0 Echo Reply
 888                3 Destination Unreachable *
 889                4 Source Quench *
 890                5 Redirect
 891                8 Echo Request
 892                B Time Exceeded *
 893                C Parameter Problem *
 894                D Timestamp Request
 895                E Timestamp Reply
 896                F Info Request
 897                G Info Reply
 898                H Address Mask Request
 899                I Address Mask Reply
 901        * These are rate limited by default (see default mask above)
 903icmp_ignore_bogus_error_responses - BOOLEAN
 904        Some routers violate RFC1122 by sending bogus responses to broadcast
 905        frames.  Such violations are normally logged via a kernel warning.
 906        If this is set to TRUE, the kernel will not give such warnings, which
 907        will avoid log file clutter.
 908        Default: 1
 910icmp_errors_use_inbound_ifaddr - BOOLEAN
 912        If zero, icmp error messages are sent with the primary address of
 913        the exiting interface.
 915        If non-zero, the message will be sent with the primary address of
 916        the interface that received the packet that caused the icmp error.
 917        This is the behaviour network many administrators will expect from
 918        a router. And it can make debugging complicated network layouts
 919        much easier.
 921        Note that if no primary address exists for the interface selected,
 922        then the primary address of the first non-loopback interface that
 923        has one will be used regardless of this setting.
 925        Default: 0
 927igmp_max_memberships - INTEGER
 928        Change the maximum number of multicast groups we can subscribe to.
 929        Default: 20
 931        Theoretical maximum value is bounded by having to send a membership
 932        report in a single datagram (i.e. the report can't span multiple
 933        datagrams, or risk confusing the switch and leaving groups you don't
 934        intend to).
 936        The number of supported groups 'M' is bounded by the number of group
 937        report entries you can fit into a single datagram of 65535 bytes.
 939        M = 65536-sizeof (ip header)/(sizeof(Group record))
 941        Group records are variable length, with a minimum of 12 bytes.
 942        So net.ipv4.igmp_max_memberships should not be set higher than:
 944        (65536-24) / 12 = 5459
 946        The value 5459 assumes no IP header options, so in practice
 947        this number may be lower.
 949igmp_max_msf - INTEGER
 950        Maximum number of addresses allowed in the source filter list for a
 951        multicast group.
 952        Default: 10
 954igmp_qrv - INTEGER
 955        Controls the IGMP query robustness variable (see RFC2236 8.1).
 956        Default: 2 (as specified by RFC2236 8.1)
 957        Minimum: 1 (as specified by RFC6636 4.5)
 959conf/interface/*  changes special settings per interface (where
 960"interface" is the name of your network interface)
 962conf/all/*        is special, changes the settings for all interfaces
 964log_martians - BOOLEAN
 965        Log packets with impossible addresses to kernel log.
 966        log_martians for the interface will be enabled if at least one of
 967        conf/{all,interface}/log_martians is set to TRUE,
 968        it will be disabled otherwise
 970accept_redirects - BOOLEAN
 971        Accept ICMP redirect messages.
 972        accept_redirects for the interface will be enabled if:
 973        - both conf/{all,interface}/accept_redirects are TRUE in the case
 974          forwarding for the interface is enabled
 975        or
 976        - at least one of conf/{all,interface}/accept_redirects is TRUE in the
 977          case forwarding for the interface is disabled
 978        accept_redirects for the interface will be disabled otherwise
 979        default TRUE (host)
 980                FALSE (router)
 982forwarding - BOOLEAN
 983        Enable IP forwarding on this interface.
 985mc_forwarding - BOOLEAN
 986        Do multicast routing. The kernel needs to be compiled with CONFIG_MROUTE
 987        and a multicast routing daemon is required.
 988        conf/all/mc_forwarding must also be set to TRUE to enable multicast
 989        routing for the interface
 991medium_id - INTEGER
 992        Integer value used to differentiate the devices by the medium they
 993        are attached to. Two devices can have different id values when
 994        the broadcast packets are received only on one of them.
 995        The default value 0 means that the device is the only interface
 996        to its medium, value of -1 means that medium is not known.
 998        Currently, it is used to change the proxy_arp behavior:
 999        the proxy_arp feature is enabled for packets forwarded between
1000        two devices attached to different media.
1002proxy_arp - BOOLEAN
1003        Do proxy arp.
1004        proxy_arp for the interface will be enabled if at least one of
1005        conf/{all,interface}/proxy_arp is set to TRUE,
1006        it will be disabled otherwise
1008proxy_arp_pvlan - BOOLEAN
1009        Private VLAN proxy arp.
1010        Basically allow proxy arp replies back to the same interface
1011        (from which the ARP request/solicitation was received).
1013        This is done to support (ethernet) switch features, like RFC
1014        3069, where the individual ports are NOT allowed to
1015        communicate with each other, but they are allowed to talk to
1016        the upstream router.  As described in RFC 3069, it is possible
1017        to allow these hosts to communicate through the upstream
1018        router by proxy_arp'ing. Don't need to be used together with
1019        proxy_arp.
1021        This technology is known by different names:
1022          In RFC 3069 it is called VLAN Aggregation.
1023          Cisco and Allied Telesyn call it Private VLAN.
1024          Hewlett-Packard call it Source-Port filtering or port-isolation.
1025          Ericsson call it MAC-Forced Forwarding (RFC Draft).
1027shared_media - BOOLEAN
1028        Send(router) or accept(host) RFC1620 shared media redirects.
1029        Overrides ip_secure_redirects.
1030        shared_media for the interface will be enabled if at least one of
1031        conf/{all,interface}/shared_media is set to TRUE,
1032        it will be disabled otherwise
1033        default TRUE
1035secure_redirects - BOOLEAN
1036        Accept ICMP redirect messages only for gateways,
1037        listed in default gateway list.
1038        secure_redirects for the interface will be enabled if at least one of
1039        conf/{all,interface}/secure_redirects is set to TRUE,
1040        it will be disabled otherwise
1041        default TRUE
1043send_redirects - BOOLEAN
1044        Send redirects, if router.
1045        send_redirects for the interface will be enabled if at least one of
1046        conf/{all,interface}/send_redirects is set to TRUE,
1047        it will be disabled otherwise
1048        Default: TRUE
1050bootp_relay - BOOLEAN
1051        Accept packets with source address 0.b.c.d destined
1052        not to this host as local ones. It is supposed, that
1053        BOOTP relay daemon will catch and forward such packets.
1054        conf/all/bootp_relay must also be set to TRUE to enable BOOTP relay
1055        for the interface
1056        default FALSE
1057        Not Implemented Yet.
1059accept_source_route - BOOLEAN
1060        Accept packets with SRR option.
1061        conf/all/accept_source_route must also be set to TRUE to accept packets
1062        with SRR option on the interface
1063        default TRUE (router)
1064                FALSE (host)
1066accept_local - BOOLEAN
1067        Accept packets with local source addresses. In combination with
1068        suitable routing, this can be used to direct packets between two
1069        local interfaces over the wire and have them accepted properly.
1070        default FALSE
1072route_localnet - BOOLEAN
1073        Do not consider loopback addresses as martian source or destination
1074        while routing. This enables the use of 127/8 for local routing purposes.
1075        default FALSE
1077rp_filter - INTEGER
1078        0 - No source validation.
1079        1 - Strict mode as defined in RFC3704 Strict Reverse Path
1080            Each incoming packet is tested against the FIB and if the interface
1081            is not the best reverse path the packet check will fail.
1082            By default failed packets are discarded.
1083        2 - Loose mode as defined in RFC3704 Loose Reverse Path
1084            Each incoming packet's source address is also tested against the FIB
1085            and if the source address is not reachable via any interface
1086            the packet check will fail.
1088        Current recommended practice in RFC3704 is to enable strict mode
1089        to prevent IP spoofing from DDos attacks. If using asymmetric routing
1090        or other complicated routing, then loose mode is recommended.
1092        The max value from conf/{all,interface}/rp_filter is used
1093        when doing source validation on the {interface}.
1095        Default value is 0. Note that some distributions enable it
1096        in startup scripts.
1098arp_filter - BOOLEAN
1099        1 - Allows you to have multiple network interfaces on the same
1100        subnet, and have the ARPs for each interface be answered
1101        based on whether or not the kernel would route a packet from
1102        the ARP'd IP out that interface (therefore you must use source
1103        based routing for this to work). In other words it allows control
1104        of which cards (usually 1) will respond to an arp request.
1106        0 - (default) The kernel can respond to arp requests with addresses
1107        from other interfaces. This may seem wrong but it usually makes
1108        sense, because it increases the chance of successful communication.
1109        IP addresses are owned by the complete host on Linux, not by
1110        particular interfaces. Only for more complex setups like load-
1111        balancing, does this behaviour cause problems.
1113        arp_filter for the interface will be enabled if at least one of
1114        conf/{all,interface}/arp_filter is set to TRUE,
1115        it will be disabled otherwise
1117arp_announce - INTEGER
1118        Define different restriction levels for announcing the local
1119        source IP address from IP packets in ARP requests sent on
1120        interface:
1121        0 - (default) Use any local address, configured on any interface
1122        1 - Try to avoid local addresses that are not in the target's
1123        subnet for this interface. This mode is useful when target
1124        hosts reachable via this interface require the source IP
1125        address in ARP requests to be part of their logical network
1126        configured on the receiving interface. When we generate the
1127        request we will check all our subnets that include the
1128        target IP and will preserve the source address if it is from
1129        such subnet. If there is no such subnet we select source
1130        address according to the rules for level 2.
1131        2 - Always use the best local address for this target.
1132        In this mode we ignore the source address in the IP packet
1133        and try to select local address that we prefer for talks with
1134        the target host. Such local address is selected by looking
1135        for primary IP addresses on all our subnets on the outgoing
1136        interface that include the target IP address. If no suitable
1137        local address is found we select the first local address
1138        we have on the outgoing interface or on all other interfaces,
1139        with the hope we will receive reply for our request and
1140        even sometimes no matter the source IP address we announce.
1142        The max value from conf/{all,interface}/arp_announce is used.
1144        Increasing the restriction level gives more chance for
1145        receiving answer from the resolved target while decreasing
1146        the level announces more valid sender's information.
1148arp_ignore - INTEGER
1149        Define different modes for sending replies in response to
1150        received ARP requests that resolve local target IP addresses:
1151        0 - (default): reply for any local target IP address, configured
1152        on any interface
1153        1 - reply only if the target IP address is local address
1154        configured on the incoming interface
1155        2 - reply only if the target IP address is local address
1156        configured on the incoming interface and both with the
1157        sender's IP address are part from same subnet on this interface
1158        3 - do not reply for local addresses configured with scope host,
1159        only resolutions for global and link addresses are replied
1160        4-7 - reserved
1161        8 - do not reply for all local addresses
1163        The max value from conf/{all,interface}/arp_ignore is used
1164        when ARP request is received on the {interface}
1166arp_notify - BOOLEAN
1167        Define mode for notification of address and device changes.
1168        0 - (default): do nothing
1169        1 - Generate gratuitous arp requests when device is brought up
1170            or hardware address changes.
1172arp_accept - BOOLEAN
1173        Define behavior for gratuitous ARP frames who's IP is not
1174        already present in the ARP table:
1175        0 - don't create new entries in the ARP table
1176        1 - create new entries in the ARP table
1178        Both replies and requests type gratuitous arp will trigger the
1179        ARP table to be updated, if this setting is on.
1181        If the ARP table already contains the IP address of the
1182        gratuitous arp frame, the arp table will be updated regardless
1183        if this setting is on or off.
1185mcast_solicit - INTEGER
1186        The maximum number of multicast probes in INCOMPLETE state,
1187        when the associated hardware address is unknown.  Defaults
1188        to 3.
1190ucast_solicit - INTEGER
1191        The maximum number of unicast probes in PROBE state, when
1192        the hardware address is being reconfirmed.  Defaults to 3.
1194app_solicit - INTEGER
1195        The maximum number of probes to send to the user space ARP daemon
1196        via netlink before dropping back to multicast probes (see
1197        mcast_resolicit).  Defaults to 0.
1199mcast_resolicit - INTEGER
1200        The maximum number of multicast probes after unicast and
1201        app probes in PROBE state.  Defaults to 0.
1203disable_policy - BOOLEAN
1204        Disable IPSEC policy (SPD) for this interface
1206disable_xfrm - BOOLEAN
1207        Disable IPSEC encryption on this interface, whatever the policy
1209igmpv2_unsolicited_report_interval - INTEGER
1210        The interval in milliseconds in which the next unsolicited
1211        IGMPv1 or IGMPv2 report retransmit will take place.
1212        Default: 10000 (10 seconds)
1214igmpv3_unsolicited_report_interval - INTEGER
1215        The interval in milliseconds in which the next unsolicited
1216        IGMPv3 report retransmit will take place.
1217        Default: 1000 (1 seconds)
1219promote_secondaries - BOOLEAN
1220        When a primary IP address is removed from this interface
1221        promote a corresponding secondary IP address instead of
1222        removing all the corresponding secondary IP addresses.
1224drop_unicast_in_l2_multicast - BOOLEAN
1225        Drop any unicast IP packets that are received in link-layer
1226        multicast (or broadcast) frames.
1227        This behavior (for multicast) is actually a SHOULD in RFC
1228        1122, but is disabled by default for compatibility reasons.
1229        Default: off (0)
1231drop_gratuitous_arp - BOOLEAN
1232        Drop all gratuitous ARP frames, for example if there's a known
1233        good ARP proxy on the network and such frames need not be used
1234        (or in the case of 802.11, must not be used to prevent attacks.)
1235        Default: off (0)
1238tag - INTEGER
1239        Allows you to write a number, which can be used as required.
1240        Default value is 0.
1242xfrm4_gc_thresh - INTEGER
1243        The threshold at which we will start garbage collecting for IPv4
1244        destination cache entries.  At twice this value the system will
1245        refuse new allocations. The value must be set below the flowcache
1246        limit (4096 * number of online cpus) to take effect.
1248igmp_link_local_mcast_reports - BOOLEAN
1249        Enable IGMP reports for link local multicast groups in the
1250        224.0.0.X range.
1251        Default TRUE
1253Alexey Kuznetsov.
1256Updated by:
1257Andi Kleen
1259Nicolas Delon
1265/proc/sys/net/ipv6/* Variables:
1267IPv6 has no global variables such as tcp_*.  tcp_* settings under ipv4/ also
1268apply to IPv6 [XXX?].
1270bindv6only - BOOLEAN
1271        Default value for IPV6_V6ONLY socket option,
1272        which restricts use of the IPv6 socket to IPv6 communication
1273        only.
1274                TRUE: disable IPv4-mapped address feature
1275                FALSE: enable IPv4-mapped address feature
1277        Default: FALSE (as specified in RFC3493)
1279flowlabel_consistency - BOOLEAN
1280        Protect the consistency (and unicity) of flow label.
1281        You have to disable it to use IPV6_FL_F_REFLECT flag on the
1282        flow label manager.
1283        TRUE: enabled
1284        FALSE: disabled
1285        Default: TRUE
1287auto_flowlabels - INTEGER
1288        Automatically generate flow labels based on a flow hash of the
1289        packet. This allows intermediate devices, such as routers, to
1290        identify packet flows for mechanisms like Equal Cost Multipath
1291        Routing (see RFC 6438).
1292        0: automatic flow labels are completely disabled
1293        1: automatic flow labels are enabled by default, they can be
1294           disabled on a per socket basis using the IPV6_AUTOFLOWLABEL
1295           socket option
1296        2: automatic flow labels are allowed, they may be enabled on a
1297           per socket basis using the IPV6_AUTOFLOWLABEL socket option
1298        3: automatic flow labels are enabled and enforced, they cannot
1299           be disabled by the socket option
1300        Default: 1
1302flowlabel_state_ranges - BOOLEAN
1303        Split the flow label number space into two ranges. 0-0x7FFFF is
1304        reserved for the IPv6 flow manager facility, 0x80000-0xFFFFF
1305        is reserved for stateless flow labels as described in RFC6437.
1306        TRUE: enabled
1307        FALSE: disabled
1308        Default: true
1310anycast_src_echo_reply - BOOLEAN
1311        Controls the use of anycast addresses as source addresses for ICMPv6
1312        echo reply
1313        TRUE:  enabled
1314        FALSE: disabled
1315        Default: FALSE
1317idgen_delay - INTEGER
1318        Controls the delay in seconds after which time to retry
1319        privacy stable address generation if a DAD conflict is
1320        detected.
1321        Default: 1 (as specified in RFC7217)
1323idgen_retries - INTEGER
1324        Controls the number of retries to generate a stable privacy
1325        address if a DAD conflict is detected.
1326        Default: 3 (as specified in RFC7217)
1328mld_qrv - INTEGER
1329        Controls the MLD query robustness variable (see RFC3810 9.1).
1330        Default: 2 (as specified by RFC3810 9.1)
1331        Minimum: 1 (as specified by RFC6636 4.5)
1333IPv6 Fragmentation:
1335ip6frag_high_thresh - INTEGER
1336        Maximum memory used to reassemble IPv6 fragments. When
1337        ip6frag_high_thresh bytes of memory is allocated for this purpose,
1338        the fragment handler will toss packets until ip6frag_low_thresh
1339        is reached.
1341ip6frag_low_thresh - INTEGER
1342        See ip6frag_high_thresh
1344ip6frag_time - INTEGER
1345        Time in seconds to keep an IPv6 fragment in memory.
1348        Change the interface-specific default settings.
1352        Change all the interface-specific settings.
1354        [XXX:  Other special features than forwarding?]
1356conf/all/forwarding - BOOLEAN
1357        Enable global IPv6 forwarding between all interfaces.
1359        IPv4 and IPv6 work differently here; e.g. netfilter must be used
1360        to control which interfaces may forward packets and which not.
1362        This also sets all interfaces' Host/Router setting
1363        'forwarding' to the specified value.  See below for details.
1365        This referred to as global forwarding.
1367proxy_ndp - BOOLEAN
1368        Do proxy ndp.
1370fwmark_reflect - BOOLEAN
1371        Controls the fwmark of kernel-generated IPv6 reply packets that are not
1372        associated with a socket for example, TCP RSTs or ICMPv6 echo replies).
1373        If unset, these packets have a fwmark of zero. If set, they have the
1374        fwmark of the packet they are replying to.
1375        Default: 0
1378        Change special settings per interface.
1380        The functional behaviour for certain settings is different
1381        depending on whether local forwarding is enabled or not.
1383accept_ra - INTEGER
1384        Accept Router Advertisements; autoconfigure using them.
1386        It also determines whether or not to transmit Router
1387        Solicitations. If and only if the functional setting is to
1388        accept Router Advertisements, Router Solicitations will be
1389        transmitted.
1391        Possible values are:
1392                0 Do not accept Router Advertisements.
1393                1 Accept Router Advertisements if forwarding is disabled.
1394                2 Overrule forwarding behaviour. Accept Router Advertisements
1395                  even if forwarding is enabled.
1397        Functional default: enabled if local forwarding is disabled.
1398                            disabled if local forwarding is enabled.
1400accept_ra_defrtr - BOOLEAN
1401        Learn default router in Router Advertisement.
1403        Functional default: enabled if accept_ra is enabled.
1404                            disabled if accept_ra is disabled.
1406accept_ra_from_local - BOOLEAN
1407        Accept RA with source-address that is found on local machine
1408        if the RA is otherwise proper and able to be accepted.
1409        Default is to NOT accept these as it may be an un-intended
1410        network loop.
1412        Functional default:
1413           enabled if accept_ra_from_local is enabled
1414               on a specific interface.
1415           disabled if accept_ra_from_local is disabled
1416               on a specific interface.
1418accept_ra_min_hop_limit - INTEGER
1419        Minimum hop limit Information in Router Advertisement.
1421        Hop limit Information in Router Advertisement less than this
1422        variable shall be ignored.
1424        Default: 1
1426accept_ra_pinfo - BOOLEAN
1427        Learn Prefix Information in Router Advertisement.
1429        Functional default: enabled if accept_ra is enabled.
1430                            disabled if accept_ra is disabled.
1432accept_ra_rt_info_max_plen - INTEGER
1433        Maximum prefix length of Route Information in RA.
1435        Route Information w/ prefix larger than or equal to this
1436        variable shall be ignored.
1438        Functional default: 0 if accept_ra_rtr_pref is enabled.
1439                            -1 if accept_ra_rtr_pref is disabled.
1441accept_ra_rtr_pref - BOOLEAN
1442        Accept Router Preference in RA.
1444        Functional default: enabled if accept_ra is enabled.
1445                            disabled if accept_ra is disabled.
1447accept_ra_mtu - BOOLEAN
1448        Apply the MTU value specified in RA option 5 (RFC4861). If
1449        disabled, the MTU specified in the RA will be ignored.
1451        Functional default: enabled if accept_ra is enabled.
1452                            disabled if accept_ra is disabled.
1454accept_redirects - BOOLEAN
1455        Accept Redirects.
1457        Functional default: enabled if local forwarding is disabled.
1458                            disabled if local forwarding is enabled.
1460accept_source_route - INTEGER
1461        Accept source routing (routing extension header).
1463        >= 0: Accept only routing header type 2.
1464        < 0: Do not accept routing header.
1466        Default: 0
1468autoconf - BOOLEAN
1469        Autoconfigure addresses using Prefix Information in Router
1470        Advertisements.
1472        Functional default: enabled if accept_ra_pinfo is enabled.
1473                            disabled if accept_ra_pinfo is disabled.
1475dad_transmits - INTEGER
1476        The amount of Duplicate Address Detection probes to send.
1477        Default: 1
1479forwarding - INTEGER
1480        Configure interface-specific Host/Router behaviour.
1482        Note: It is recommended to have the same setting on all
1483        interfaces; mixed router/host scenarios are rather uncommon.
1485        Possible values are:
1486                0 Forwarding disabled
1487                1 Forwarding enabled
1489        FALSE (0):
1491        By default, Host behaviour is assumed.  This means:
1493        1. IsRouter flag is not set in Neighbour Advertisements.
1494        2. If accept_ra is TRUE (default), transmit Router
1495           Solicitations.
1496        3. If accept_ra is TRUE (default), accept Router
1497           Advertisements (and do autoconfiguration).
1498        4. If accept_redirects is TRUE (default), accept Redirects.
1500        TRUE (1):
1502        If local forwarding is enabled, Router behaviour is assumed.
1503        This means exactly the reverse from the above:
1505        1. IsRouter flag is set in Neighbour Advertisements.
1506        2. Router Solicitations are not sent unless accept_ra is 2.
1507        3. Router Advertisements are ignored unless accept_ra is 2.
1508        4. Redirects are ignored.
1510        Default: 0 (disabled) if global forwarding is disabled (default),
1511                 otherwise 1 (enabled).
1513hop_limit - INTEGER
1514        Default Hop Limit to set.
1515        Default: 64
1517mtu - INTEGER
1518        Default Maximum Transfer Unit
1519        Default: 1280 (IPv6 required minimum)
1521ip_nonlocal_bind - BOOLEAN
1522        If set, allows processes to bind() to non-local IPv6 addresses,
1523        which can be quite useful - but may break some applications.
1524        Default: 0
1526router_probe_interval - INTEGER
1527        Minimum interval (in seconds) between Router Probing described
1528        in RFC4191.
1530        Default: 60
1532router_solicitation_delay - INTEGER
1533        Number of seconds to wait after interface is brought up
1534        before sending Router Solicitations.
1535        Default: 1
1537router_solicitation_interval - INTEGER
1538        Number of seconds to wait between Router Solicitations.
1539        Default: 4
1541router_solicitations - INTEGER
1542        Number of Router Solicitations to send until assuming no
1543        routers are present.
1544        Default: 3
1546use_oif_addrs_only - BOOLEAN
1547        When enabled, the candidate source addresses for destinations
1548        routed via this interface are restricted to the set of addresses
1549        configured on this interface (vis. RFC 6724, section 4).
1551        Default: false
1553use_tempaddr - INTEGER
1554        Preference for Privacy Extensions (RFC3041).
1555          <= 0 : disable Privacy Extensions
1556          == 1 : enable Privacy Extensions, but prefer public
1557                 addresses over temporary addresses.
1558          >  1 : enable Privacy Extensions and prefer temporary
1559                 addresses over public addresses.
1560        Default:  0 (for most devices)
1561                 -1 (for point-to-point devices and loopback devices)
1563temp_valid_lft - INTEGER
1564        valid lifetime (in seconds) for temporary addresses.
1565        Default: 604800 (7 days)
1567temp_prefered_lft - INTEGER
1568        Preferred lifetime (in seconds) for temporary addresses.
1569        Default: 86400 (1 day)
1571keep_addr_on_down - INTEGER
1572        Keep all IPv6 addresses on an interface down event. If set static
1573        global addresses with no expiration time are not flushed.
1574          >0 : enabled
1575           0 : system default
1576          <0 : disabled
1578        Default: 0 (addresses are removed)
1580max_desync_factor - INTEGER
1581        Maximum value for DESYNC_FACTOR, which is a random value
1582        that ensures that clients don't synchronize with each
1583        other and generate new addresses at exactly the same time.
1584        value is in seconds.
1585        Default: 600
1587regen_max_retry - INTEGER
1588        Number of attempts before give up attempting to generate
1589        valid temporary addresses.
1590        Default: 5
1592max_addresses - INTEGER
1593        Maximum number of autoconfigured addresses per interface.  Setting
1594        to zero disables the limitation.  It is not recommended to set this
1595        value too large (or to zero) because it would be an easy way to
1596        crash the kernel by allowing too many addresses to be created.
1597        Default: 16
1599disable_ipv6 - BOOLEAN
1600        Disable IPv6 operation.  If accept_dad is set to 2, this value
1601        will be dynamically set to TRUE if DAD fails for the link-local
1602        address.
1603        Default: FALSE (enable IPv6 operation)
1605        When this value is changed from 1 to 0 (IPv6 is being enabled),
1606        it will dynamically create a link-local address on the given
1607        interface and start Duplicate Address Detection, if necessary.
1609        When this value is changed from 0 to 1 (IPv6 is being disabled),
1610        it will dynamically delete all address on the given interface.
1612accept_dad - INTEGER
1613        Whether to accept DAD (Duplicate Address Detection).
1614        0: Disable DAD
1615        1: Enable DAD (default)
1616        2: Enable DAD, and disable IPv6 operation if MAC-based duplicate
1617           link-local address has been found.
1619force_tllao - BOOLEAN
1620        Enable sending the target link-layer address option even when
1621        responding to a unicast neighbor solicitation.
1622        Default: FALSE
1624        Quoting from RFC 2461, section 4.4, Target link-layer address:
1626        "The option MUST be included for multicast solicitations in order to
1627        avoid infinite Neighbor Solicitation "recursion" when the peer node
1628        does not have a cache entry to return a Neighbor Advertisements
1629        message.  When responding to unicast solicitations, the option can be
1630        omitted since the sender of the solicitation has the correct link-
1631        layer address; otherwise it would not have be able to send the unicast
1632        solicitation in the first place. However, including the link-layer
1633        address in this case adds little overhead and eliminates a potential
1634        race condition where the sender deletes the cached link-layer address
1635        prior to receiving a response to a previous solicitation."
1637ndisc_notify - BOOLEAN
1638        Define mode for notification of address and device changes.
1639        0 - (default): do nothing
1640        1 - Generate unsolicited neighbour advertisements when device is brought
1641            up or hardware address changes.
1643mldv1_unsolicited_report_interval - INTEGER
1644        The interval in milliseconds in which the next unsolicited
1645        MLDv1 report retransmit will take place.
1646        Default: 10000 (10 seconds)
1648mldv2_unsolicited_report_interval - INTEGER
1649        The interval in milliseconds in which the next unsolicited
1650        MLDv2 report retransmit will take place.
1651        Default: 1000 (1 second)
1653force_mld_version - INTEGER
1654        0 - (default) No enforcement of a MLD version, MLDv1 fallback allowed
1655        1 - Enforce to use MLD version 1
1656        2 - Enforce to use MLD version 2
1658suppress_frag_ndisc - INTEGER
1659        Control RFC 6980 (Security Implications of IPv6 Fragmentation
1660        with IPv6 Neighbor Discovery) behavior:
1661        1 - (default) discard fragmented neighbor discovery packets
1662        0 - allow fragmented neighbor discovery packets
1664optimistic_dad - BOOLEAN
1665        Whether to perform Optimistic Duplicate Address Detection (RFC 4429).
1666                0: disabled (default)
1667                1: enabled
1669use_optimistic - BOOLEAN
1670        If enabled, do not classify optimistic addresses as deprecated during
1671        source address selection.  Preferred addresses will still be chosen
1672        before optimistic addresses, subject to other ranking in the source
1673        address selection algorithm.
1674                0: disabled (default)
1675                1: enabled
1677stable_secret - IPv6 address
1678        This IPv6 address will be used as a secret to generate IPv6
1679        addresses for link-local addresses and autoconfigured
1680        ones. All addresses generated after setting this secret will
1681        be stable privacy ones by default. This can be changed via the
1682        addrgenmode ip-link. conf/default/stable_secret is used as the
1683        secret for the namespace, the interface specific ones can
1684        overwrite that. Writes to conf/all/stable_secret are refused.
1686        It is recommended to generate this secret during installation
1687        of a system and keep it stable after that.
1689        By default the stable secret is unset.
1691drop_unicast_in_l2_multicast - BOOLEAN
1692        Drop any unicast IPv6 packets that are received in link-layer
1693        multicast (or broadcast) frames.
1695        By default this is turned off.
1697drop_unsolicited_na - BOOLEAN
1698        Drop all unsolicited neighbor advertisements, for example if there's
1699        a known good NA proxy on the network and such frames need not be used
1700        (or in the case of 802.11, must not be used to prevent attacks.)
1702        By default this is turned off.
1705ratelimit - INTEGER
1706        Limit the maximal rates for sending ICMPv6 packets.
1707        0 to disable any limiting,
1708        otherwise the minimal space between responses in milliseconds.
1709        Default: 1000
1711xfrm6_gc_thresh - INTEGER
1712        The threshold at which we will start garbage collecting for IPv6
1713        destination cache entries.  At twice this value the system will
1714        refuse new allocations. The value must be set below the flowcache
1715        limit (4096 * number of online cpus) to take effect.
1718IPv6 Update by:
1719Pekka Savola <>
1720YOSHIFUJI Hideaki / USAGI Project <>
1723/proc/sys/net/bridge/* Variables:
1725bridge-nf-call-arptables - BOOLEAN
1726        1 : pass bridged ARP traffic to arptables' FORWARD chain.
1727        0 : disable this.
1728        Default: 1
1730bridge-nf-call-iptables - BOOLEAN
1731        1 : pass bridged IPv4 traffic to iptables' chains.
1732        0 : disable this.
1733        Default: 1
1735bridge-nf-call-ip6tables - BOOLEAN
1736        1 : pass bridged IPv6 traffic to ip6tables' chains.
1737        0 : disable this.
1738        Default: 1
1740bridge-nf-filter-vlan-tagged - BOOLEAN
1741        1 : pass bridged vlan-tagged ARP/IP/IPv6 traffic to {arp,ip,ip6}tables.
1742        0 : disable this.
1743        Default: 0
1745bridge-nf-filter-pppoe-tagged - BOOLEAN
1746        1 : pass bridged pppoe-tagged IP/IPv6 traffic to {ip,ip6}tables.
1747        0 : disable this.
1748        Default: 0
1750bridge-nf-pass-vlan-input-dev - BOOLEAN
1751        1: if bridge-nf-filter-vlan-tagged is enabled, try to find a vlan
1752        interface on the bridge and set the netfilter input device to the vlan.
1753        This allows use of e.g. "iptables -i br0.1" and makes the REDIRECT
1754        target work with vlan-on-top-of-bridge interfaces.  When no matching
1755        vlan interface is found, or this switch is off, the input device is
1756        set to the bridge interface.
1757        0: disable bridge netfilter vlan interface lookup.
1758        Default: 0
1760proc/sys/net/sctp/* Variables:
1762addip_enable - BOOLEAN
1763        Enable or disable extension of  Dynamic Address Reconfiguration
1764        (ADD-IP) functionality specified in RFC5061.  This extension provides
1765        the ability to dynamically add and remove new addresses for the SCTP
1766        associations.
1768        1: Enable extension.
1770        0: Disable extension.
1772        Default: 0
1774pf_enable - INTEGER
1775        Enable or disable pf (pf is short for potentially failed) state. A value
1776        of pf_retrans > path_max_retrans also disables pf state. That is, one of
1777        both pf_enable and pf_retrans > path_max_retrans can disable pf state.
1778        Since pf_retrans and path_max_retrans can be changed by userspace
1779        application, sometimes user expects to disable pf state by the value of
1780        pf_retrans > path_max_retrans, but occasionally the value of pf_retrans
1781        or path_max_retrans is changed by the user application, this pf state is
1782        enabled. As such, it is necessary to add this to dynamically enable
1783        and disable pf state. See:
1784 for
1785        details.
1787        1: Enable pf.
1789        0: Disable pf.
1791        Default: 1
1793addip_noauth_enable - BOOLEAN
1794        Dynamic Address Reconfiguration (ADD-IP) requires the use of
1795        authentication to protect the operations of adding or removing new
1796        addresses.  This requirement is mandated so that unauthorized hosts
1797        would not be able to hijack associations.  However, older
1798        implementations may not have implemented this requirement while
1799        allowing the ADD-IP extension.  For reasons of interoperability,
1800        we provide this variable to control the enforcement of the
1801        authentication requirement.
1803        1: Allow ADD-IP extension to be used without authentication.  This
1804           should only be set in a closed environment for interoperability
1805           with older implementations.
1807        0: Enforce the authentication requirement
1809        Default: 0
1811auth_enable - BOOLEAN
1812        Enable or disable Authenticated Chunks extension.  This extension
1813        provides the ability to send and receive authenticated chunks and is
1814        required for secure operation of Dynamic Address Reconfiguration
1815        (ADD-IP) extension.
1817        1: Enable this extension.
1818        0: Disable this extension.
1820        Default: 0
1822prsctp_enable - BOOLEAN
1823        Enable or disable the Partial Reliability extension (RFC3758) which
1824        is used to notify peers that a given DATA should no longer be expected.
1826        1: Enable extension
1827        0: Disable
1829        Default: 1
1831max_burst - INTEGER
1832        The limit of the number of new packets that can be initially sent.  It
1833        controls how bursty the generated traffic can be.
1835        Default: 4
1837association_max_retrans - INTEGER
1838        Set the maximum number for retransmissions that an association can
1839        attempt deciding that the remote end is unreachable.  If this value
1840        is exceeded, the association is terminated.
1842        Default: 10
1844max_init_retransmits - INTEGER
1845        The maximum number of retransmissions of INIT and COOKIE-ECHO chunks
1846        that an association will attempt before declaring the destination
1847        unreachable and terminating.
1849        Default: 8
1851path_max_retrans - INTEGER
1852        The maximum number of retransmissions that will be attempted on a given
1853        path.  Once this threshold is exceeded, the path is considered
1854        unreachable, and new traffic will use a different path when the
1855        association is multihomed.
1857        Default: 5
1859pf_retrans - INTEGER
1860        The number of retransmissions that will be attempted on a given path
1861        before traffic is redirected to an alternate transport (should one
1862        exist).  Note this is distinct from path_max_retrans, as a path that
1863        passes the pf_retrans threshold can still be used.  Its only
1864        deprioritized when a transmission path is selected by the stack.  This
1865        setting is primarily used to enable fast failover mechanisms without
1866        having to reduce path_max_retrans to a very low value.  See:
1868        for details.  Note also that a value of pf_retrans > path_max_retrans
1869        disables this feature. Since both pf_retrans and path_max_retrans can
1870        be changed by userspace application, a variable pf_enable is used to
1871        disable pf state.
1873        Default: 0
1875rto_initial - INTEGER
1876        The initial round trip timeout value in milliseconds that will be used
1877        in calculating round trip times.  This is the initial time interval
1878        for retransmissions.
1880        Default: 3000
1882rto_max - INTEGER
1883        The maximum value (in milliseconds) of the round trip timeout.  This
1884        is the largest time interval that can elapse between retransmissions.
1886        Default: 60000
1888rto_min - INTEGER
1889        The minimum value (in milliseconds) of the round trip timeout.  This
1890        is the smallest time interval the can elapse between retransmissions.
1892        Default: 1000
1894hb_interval - INTEGER
1895        The interval (in milliseconds) between HEARTBEAT chunks.  These chunks
1896        are sent at the specified interval on idle paths to probe the state of
1897        a given path between 2 associations.
1899        Default: 30000
1901sack_timeout - INTEGER
1902        The amount of time (in milliseconds) that the implementation will wait
1903        to send a SACK.
1905        Default: 200
1907valid_cookie_life - INTEGER
1908        The default lifetime of the SCTP cookie (in milliseconds).  The cookie
1909        is used during association establishment.
1911        Default: 60000
1913cookie_preserve_enable - BOOLEAN
1914        Enable or disable the ability to extend the lifetime of the SCTP cookie
1915        that is used during the establishment phase of SCTP association
1917        1: Enable cookie lifetime extension.
1918        0: Disable
1920        Default: 1
1922cookie_hmac_alg - STRING
1923        Select the hmac algorithm used when generating the cookie value sent by
1924        a listening sctp socket to a connecting client in the INIT-ACK chunk.
1925        Valid values are:
1926        * md5
1927        * sha1
1928        * none
1929        Ability to assign md5 or sha1 as the selected alg is predicated on the
1930        configuration of those algorithms at build time (CONFIG_CRYPTO_MD5 and
1931        CONFIG_CRYPTO_SHA1).
1933        Default: Dependent on configuration.  MD5 if available, else SHA1 if
1934        available, else none.
1936rcvbuf_policy - INTEGER
1937        Determines if the receive buffer is attributed to the socket or to
1938        association.   SCTP supports the capability to create multiple
1939        associations on a single socket.  When using this capability, it is
1940        possible that a single stalled association that's buffering a lot
1941        of data may block other associations from delivering their data by
1942        consuming all of the receive buffer space.  To work around this,
1943        the rcvbuf_policy could be set to attribute the receiver buffer space
1944        to each association instead of the socket.  This prevents the described
1945        blocking.
1947        1: rcvbuf space is per association
1948        0: rcvbuf space is per socket
1950        Default: 0
1952sndbuf_policy - INTEGER
1953        Similar to rcvbuf_policy above, this applies to send buffer space.
1955        1: Send buffer is tracked per association
1956        0: Send buffer is tracked per socket.
1958        Default: 0
1960sctp_mem - vector of 3 INTEGERs: min, pressure, max
1961        Number of pages allowed for queueing by all SCTP sockets.
1963        min: Below this number of pages SCTP is not bothered about its
1964        memory appetite. When amount of memory allocated by SCTP exceeds
1965        this number, SCTP starts to moderate memory usage.
1967        pressure: This value was introduced to follow format of tcp_mem.
1969        max: Number of pages allowed for queueing by all SCTP sockets.
1971        Default is calculated at boot time from amount of available memory.
1973sctp_rmem - vector of 3 INTEGERs: min, default, max
1974        Only the first value ("min") is used, "default" and "max" are
1975        ignored.
1977        min: Minimal size of receive buffer used by SCTP socket.
1978        It is guaranteed to each SCTP socket (but not association) even
1979        under moderate memory pressure.
1981        Default: 1 page
1983sctp_wmem  - vector of 3 INTEGERs: min, default, max
1984        Currently this tunable has no effect.
1986addr_scope_policy - INTEGER
1987        Control IPv4 address scoping - draft-stewart-tsvwg-sctp-ipv4-00
1989        0   - Disable IPv4 address scoping
1990        1   - Enable IPv4 address scoping
1991        2   - Follow draft but allow IPv4 private addresses
1992        3   - Follow draft but allow IPv4 link local addresses
1994        Default: 1
1998        Please see: Documentation/sysctl/net.txt for descriptions of these entries.
2002max_dgram_qlen - INTEGER
2003        The maximum length of dgram socket receive queue
2005        Default: 10
2011        fast_poll_increase FIXME
2012        warn_noreply_time FIXME
2013        discovery_slots FIXME
2014        slot_timeout FIXME
2015        max_baud_rate FIXME
2016        discovery_timeout FIXME
2017        lap_keepalive_time FIXME
2018        max_noreply_time FIXME
2019        max_tx_data_size FIXME
2020        max_tx_window FIXME
2021        min_tx_turn_time FIXME
2022 kindly hosted by Redpill Linpro AS, provider of Linux consulting and operations services since 1995.