.. SPDX-License-Identifier: GPL-2.0 =========IP Sysctl========= /proc/sys/net/ipv4/* Variables============================== ip_forward - BOOLEAN	Forward Packets between interfaces. 	This variable is special, its change resets all configuration	parameters to their default state (RFC1122 for hosts, RFC1812	for routers) 	Possible values: 	- 0 (disabled)	- 1 (enabled) 	Default: 0 (disabled) ip_default_ttl - INTEGER	Default value of TTL field (Time To Live) for outgoing (but not	forwarded) IP packets. Should be between 1 and 255 inclusive.	Default: 64 (as recommended by RFC1700) ip_no_pmtu_disc - INTEGER	Disable Path MTU Discovery. If enabled in mode 1 and a	fragmentation-required ICMP is received, the PMTU to this	destination will be set to the smallest of the old MTU to	this destination and min_pmtu (see below). You will need	to raise min_pmtu to the smallest interface MTU on your system	manually if you want to avoid locally generated fragments. 	In mode 2 incoming Path MTU Discovery messages will be	discarded. Outgoing frames are handled the same as in mode 1,	implicitly setting IP_PMTUDISC_DONT on every created socket. 	Mode 3 is a hardened pmtu discover mode. The kernel will only	accept fragmentation-needed errors if the underlying protocol	can verify them besides a plain socket lookup. Current	protocols for which pmtu events will be honored are TCP and	SCTP as they verify e.g. the sequence number or the	association. This mode should not be enabled globally but is	only intended to secure e.g. name servers in namespaces where	TCP path mtu must still work but path MTU information of other	protocols should be discarded. If enabled globally this mode	could break other protocols. 	Possible values: 0-3 	Default: FALSE min_pmtu - INTEGER	default 552 - minimum Path MTU. Unless this is changed manually,	each cached pmtu will never be lower than this setting. ip_forward_use_pmtu - BOOLEAN	By default we don't trust protocol path MTUs while forwarding	because they could be easily forged and can lead to unwanted	fragmentation by the router.	You only need to enable this if you have user-space software	which tries to discover path mtus by itself and depends on the	kernel honoring this information. This is normally not the	case. 	Possible values: 	- 0 (disabled)	- 1 (enabled) 	Default: 0 (disabled) fwmark_reflect - BOOLEAN	Controls the fwmark of kernel-generated IPv4 reply packets that are not	associated with a socket for example, TCP RSTs or ICMP echo replies).	If disabled, these packets have a fwmark of zero. If enabled, they have the	fwmark of the packet they are replying to. 	Possible values: 	- 0 (disabled)	- 1 (enabled) 	Default: 0 (disabled) fib_multipath_use_neigh - BOOLEAN	Use status of existing neighbor entry when determining nexthop for	multipath routes. If disabled, neighbor information is not used and	packets could be directed to a failed nexthop. Only valid for kernels	built with CONFIG_IP_ROUTE_MULTIPATH enabled. 	Possible values: 	- 0 (disabled)	- 1 (enabled) 	Default: 0 (disabled) fib_multipath_hash_policy - INTEGER	Controls which hash policy to use for multipath routes. Only valid	for kernels built with CONFIG_IP_ROUTE_MULTIPATH enabled. 	Default: 0 (Layer 3) 	Possible values: 	- 0 - Layer 3	- 1 - Layer 4	- 2 - Layer 3 or inner Layer 3 if present	- 3 - Custom multipath hash. Fields used for multipath hash calculation	  are determined by fib_multipath_hash_fields sysctl fib_multipath_hash_fields - UNSIGNED INTEGER	When fib_multipath_hash_policy is set to 3 (custom multipath hash), the	fields used for multipath hash calculation are determined by this	sysctl. 	This value is a bitmask which enables various fields for multipath hash	calculation. 	Possible fields are: 	====== ============================	0x0001 Source IP address	0x0002 Destination IP address	0x0004 IP protocol	0x0008 Unused (Flow Label)	0x0010 Source port	0x0020 Destination port	0x0040 Inner source IP address	0x0080 Inner destination IP address	0x0100 Inner IP protocol	0x0200 Inner Flow Label	0x0400 Inner source port	0x0800 Inner destination port	====== ============================ 	Default: 0x0007 (source IP, destination IP and IP protocol) fib_multipath_hash_seed - UNSIGNED INTEGER	The seed value used when calculating hash for multipath routes. Applies	to both IPv4 and IPv6 datapath. Only present for kernels built with	CONFIG_IP_ROUTE_MULTIPATH enabled. 	When set to 0, the seed value used for multipath routing defaults to an	internal random-generated one. 	The actual hashing algorithm is not specified -- there is no guarantee	that a next hop distribution effected by a given seed will keep stable	across kernel versions. 	Default: 0 (random) fib_sync_mem - UNSIGNED INTEGER	Amount of dirty memory from fib entries that can be backlogged before	synchronize_rcu is forced. 	Default: 512kB   Minimum: 64kB   Maximum: 64MB ip_forward_update_priority - INTEGER	Whether to update SKB priority from "TOS" field in IPv4 header after it	is forwarded. The new SKB priority is mapped from TOS field value	according to an rt_tos2priority table (see e.g. man tc-prio). 	Default: 1 (Update priority.) 	Possible values: 	- 0 - Do not update priority.	- 1 - Update priority. route/max_size - INTEGER	Maximum number of routes allowed in the kernel.  Increase	this when using large numbers of interfaces and/or routes. 	From linux kernel 3.6 onwards, this is deprecated for ipv4	as route cache is no longer used. 	From linux kernel 6.3 onwards, this is deprecated for ipv6	as garbage collection manages cached route entries. neigh/default/gc_thresh1 - INTEGER	Minimum number of entries to keep.  Garbage collector will not	purge entries if there are fewer than this number. 	Default: 128 neigh/default/gc_thresh2 - INTEGER	Threshold when garbage collector becomes more aggressive about	purging entries. Entries older than 5 seconds will be cleared	when over this number. 	Default: 512 neigh/default/gc_thresh3 - INTEGER	Maximum number of non-PERMANENT neighbor entries allowed.  Increase	this when using large numbers of interfaces and when communicating	with large numbers of directly-connected peers. 	Default: 1024 neigh/default/gc_interval - INTEGER	Specifies how often the garbage collector for neighbor entries	should run. This value applies to the entire table, not	individual entries. Unused since kernel v2.6.8. 	Default: 30 seconds neigh/default/gc_stale_time - INTEGER	Determines how long a neighbor entry can remain unused before it is	considered stale and eligible for garbage collection. Entries that have	not been used for longer than this time will be removed by the garbage	collector, unless they have active references, are marked as PERMANENT,	or carry the NTF_EXT_LEARNED or NTF_EXT_VALIDATED flag. Stale entries	are only removed by the periodic GC when there are at least gc_thresh1	neighbors in the table. 	Default: 60 seconds neigh/default/unres_qlen_bytes - INTEGER	The maximum number of bytes which may be used by packets	queued for each	unresolved address by other network layers.	(added in linux 3.3) 	Setting negative value is meaningless and will return error. 	Default: SK_WMEM_DEFAULT, (same as net.core.wmem_default). 		Exact value depends on architecture and kernel options,		but should be enough to allow queuing 256 packets		of medium size. neigh/default/unres_qlen - INTEGER	The maximum number of packets which may be queued for each	unresolved address by other network layers. 	(deprecated in linux 3.3) : use unres_qlen_bytes instead. 	Prior to linux 3.3, the default value is 3 which may cause	unexpected packet loss. The current default value is calculated	according to default value of unres_qlen_bytes and true size of	packet. 	Default: 101 neigh/default/interval_probe_time_ms - INTEGER	The probe interval for neighbor entries with NTF_MANAGED flag,	the min value is 1. 	Default: 5000 mtu_expires - INTEGER	Time, in seconds, that cached PMTU information is kept. min_adv_mss - INTEGER	The advertised MSS depends on the first hop route MTU, but will	never be lower than this setting. fib_notify_on_flag_change - INTEGER        Whether to emit RTM_NEWROUTE notifications whenever RTM_F_OFFLOAD/        RTM_F_TRAP/RTM_F_OFFLOAD_FAILED flags are changed.         After installing a route to the kernel, user space receives an        acknowledgment, which means the route was installed in the kernel,        but not necessarily in hardware.        It is also possible for a route already installed in hardware to change        its action and therefore its flags. For example, a host route that is        trapping packets can be "promoted" to perform decapsulation following        the installation of an IPinIP/VXLAN tunnel.        The notifications will indicate to user-space the state of the route.         Default: 0 (Do not emit notifications.)         Possible values:         - 0 - Do not emit notifications.        - 1 - Emit notifications.        - 2 - Emit notifications only for RTM_F_OFFLOAD_FAILED flag change. IP Fragmentation: ipfrag_high_thresh - LONG INTEGER	Maximum memory used to reassemble IP fragments. ipfrag_low_thresh - LONG INTEGER	(Obsolete since linux-4.17)	Maximum memory used to reassemble IP fragments before the kernel	begins to remove incomplete fragment queues to free up resources.	The kernel still accepts new fragments for defragmentation. ipfrag_time - INTEGER	Time in seconds to keep an IP fragment in memory. ipfrag_max_dist - INTEGER	ipfrag_max_dist is a non-negative integer value which defines the	maximum "disorder" which is allowed among fragments which share a	common IP source address. Note that reordering of packets is	not unusual, but if a large number of fragments arrive from a source	IP address while a particular fragment queue remains incomplete, it	probably indicates that one or more fragments belonging to that queue	have been lost. When ipfrag_max_dist is positive, an additional check	is done on fragments before they are added to a reassembly queue - if	ipfrag_max_dist (or more) fragments have arrived from a particular IP	address between additions to any IP fragment queue using that source	address, it's presumed that one or more fragments in the queue are	lost. The existing fragment queue will be dropped, and a new one	started. An ipfrag_max_dist value of zero disables this check. 	Using a very small value, e.g. 1 or 2, for ipfrag_max_dist can	result in unnecessarily dropping fragment queues when normal	reordering of packets occurs, which could lead to poor application	performance. Using a very large value, e.g. 50000, increases the	likelihood of incorrectly reassembling IP fragments that originate	from different IP datagrams, which could result in data corruption.	Default: 64 bc_forwarding - INTEGER	bc_forwarding enables the feature described in rfc1812#section-5.3.5.2	and rfc2644. It allows the router to forward directed broadcast.	To enable this feature, the 'all' entry and the input interface entry	should be set to 1.	Default: 0 INET peer storage================= inet_peer_threshold - INTEGER	The approximate size of the storage.  Starting from this threshold	entries will be thrown aggressively.  This threshold also determines	entries' time-to-live and time intervals between garbage collection	passes.  More entries, less time-to-live, less GC interval. inet_peer_minttl - INTEGER	Minimum time-to-live of entries.  Should be enough to cover fragment	time-to-live on the reassembling side.  This minimum time-to-live  is	guaranteed if the pool size is less than inet_peer_threshold.	Measured in seconds. inet_peer_maxttl - INTEGER	Maximum time-to-live of entries.  Unused entries will expire after	this period of time if there is no memory pressure on the pool (i.e.	when the number of entries in the pool is very small).	Measured in seconds. TCP variables============= somaxconn - INTEGER	Limit of socket listen() backlog, known in userspace as SOMAXCONN.	Defaults to 4096. (Was 128 before linux-5.4)	See also tcp_max_syn_backlog for additional tuning for TCP sockets. tcp_abort_on_overflow - BOOLEAN	If listening service is too slow to accept new connections,	reset them. Default state is FALSE. It means that if overflow	occurred due to a burst, connection will recover. Enable this	option _only_ if you are really sure that listening daemon	cannot be tuned to accept connections faster. Enabling this	option can harm clients of your server. tcp_adv_win_scale - INTEGER	Obsolete since linux-6.6	Count buffering overhead as bytes/2^tcp_adv_win_scale	(if tcp_adv_win_scale > 0) or bytes-bytes/2^(-tcp_adv_win_scale),	if it is <= 0. 	Possible values are [-31, 31], inclusive. 	Default: 1 tcp_allowed_congestion_control - STRING	Show/set the congestion control choices available to non-privileged	processes. The list is a subset of those listed in	tcp_available_congestion_control. 	Default is "reno" and the default setting (tcp_congestion_control). tcp_app_win - INTEGER	Reserve max(window/2^tcp_app_win, mss) of window for application	buffer. Value 0 is special, it means that nothing is reserved. 	Possible values are [0, 31], inclusive. 	Default: 31 tcp_autocorking - BOOLEAN	Enable TCP auto corking :	When applications do consecutive small write()/sendmsg() system calls,	we try to coalesce these small writes as much as possible, to lower	total amount of sent packets. This is done if at least one prior	packet for the flow is waiting in Qdisc queues or device transmit	queue. Applications can still use TCP_CORK for optimal behavior	when they know how/when to uncork their sockets. 	Possible values: 	- 0 (disabled)	- 1 (enabled) 	Default: 1 (enabled) tcp_available_congestion_control - STRING	Shows the available congestion control choices that are registered.	More congestion control algorithms may be available as modules,	but not loaded. tcp_base_mss - INTEGER	The initial value of search_low to be used by the packetization layer	Path MTU discovery (MTU probing).  If MTU probing is enabled,	this is the initial MSS used by the connection. tcp_mtu_probe_floor - INTEGER	If MTU probing is enabled this caps the minimum MSS used for search_low	for the connection. 	Default : 48 tcp_min_snd_mss - INTEGER	TCP SYN and SYNACK messages usually advertise an ADVMSS option,	as described in RFC 1122 and RFC 6691. 	If this ADVMSS option is smaller than tcp_min_snd_mss,	it is silently capped to tcp_min_snd_mss. 	Default : 48 (at least 8 bytes of payload per segment) tcp_congestion_control - STRING	Set the congestion control algorithm to be used for new	connections. The algorithm "reno" is always available, but	additional choices may be available based on kernel configuration.	Default is set as part of kernel configuration.	For passive connections, the listener congestion control choice	is inherited. 	[see setsockopt(listenfd, SOL_TCP, TCP_CONGESTION, "name" ...) ] tcp_dsack - BOOLEAN	Allows TCP to send "duplicate" SACKs. 	Possible values: 	- 0 (disabled)	- 1 (enabled) 	Default: 1 (enabled) tcp_early_retrans - INTEGER	Tail loss probe (TLP) converts RTOs occurring due to tail	losses into fast recovery (RFC8985). Note that	TLP requires RACK to function properly (see tcp_recovery below) 	Possible values: 		- 0 disables TLP		- 3 or 4 enables TLP 	Default: 3 tcp_ecn - INTEGER	Control use of Explicit Congestion Notification (ECN) by TCP.	ECN is used only when both ends of the TCP connection indicate support	for it. This feature is useful in avoiding losses due to congestion by	allowing supporting routers to signal congestion before having to drop	packets. A host that supports ECN both sends ECN at the IP layer and	feeds back ECN at the TCP layer. The highest variant of ECN feedback	that both peers support is chosen by the ECN negotiation (Accurate ECN,	ECN, or no ECN). 	The highest negotiated variant for incoming connection requests	and the highest variant requested by outgoing connection	attempts: 	===== ==================== ====================	Value Incoming connections Outgoing connections	===== ==================== ====================	0     No ECN               No ECN	1     ECN                  ECN	2     ECN                  No ECN	3     AccECN               AccECN	4     AccECN               ECN	5     AccECN               No ECN	===== ==================== ==================== 	Default: 2 tcp_ecn_option - INTEGER	Control Accurate ECN (AccECN) option sending when AccECN has been	successfully negotiated during handshake. Send logic inhibits	sending AccECN options regardless of this setting when no AccECN	option has been seen for the reverse direction. 	Possible values are: 	= ============================================================	0 Never send AccECN option. This also disables sending AccECN	  option in SYN/ACK during handshake.	1 Send AccECN option sparingly according to the minimum option

Lines 1–500 of 3825. Load more