1.. SPDX-License-Identifier: GPL-2.0
2
3=========
4IP Sysctl
5=========
6
7/proc/sys/net/ipv4/* Variables
8==============================
9
10ip_forward - BOOLEAN
11	- 0 - disabled (default)
12	- not 0 - enabled
13
14	Forward Packets between interfaces.
15
16	This variable is special, its change resets all configuration
17	parameters to their default state (RFC1122 for hosts, RFC1812
18	for routers)
19
20ip_default_ttl - INTEGER
21	Default value of TTL field (Time To Live) for outgoing (but not
22	forwarded) IP packets. Should be between 1 and 255 inclusive.
23	Default: 64 (as recommended by RFC1700)
24
25ip_no_pmtu_disc - INTEGER
26	Disable Path MTU Discovery. If enabled in mode 1 and a
27	fragmentation-required ICMP is received, the PMTU to this
28	destination will be set to min_pmtu (see below). You will need
29	to raise min_pmtu to the smallest interface MTU on your system
30	manually if you want to avoid locally generated fragments.
31
32	In mode 2 incoming Path MTU Discovery messages will be
33	discarded. Outgoing frames are handled the same as in mode 1,
34	implicitly setting IP_PMTUDISC_DONT on every created socket.
35
36	Mode 3 is a hardened pmtu discover mode. The kernel will only
37	accept fragmentation-needed errors if the underlying protocol
38	can verify them besides a plain socket lookup. Current
39	protocols for which pmtu events will be honored are TCP, SCTP
40	and DCCP as they verify e.g. the sequence number or the
41	association. This mode should not be enabled globally but is
42	only intended to secure e.g. name servers in namespaces where
43	TCP path mtu must still work but path MTU information of other
44	protocols should be discarded. If enabled globally this mode
45	could break other protocols.
46
47	Possible values: 0-3
48
49	Default: FALSE
50
51min_pmtu - INTEGER
52	default 552 - minimum discovered Path MTU
53
54ip_forward_use_pmtu - BOOLEAN
55	By default we don't trust protocol path MTUs while forwarding
56	because they could be easily forged and can lead to unwanted
57	fragmentation by the router.
58	You only need to enable this if you have user-space software
59	which tries to discover path mtus by itself and depends on the
60	kernel honoring this information. This is normally not the
61	case.
62
63	Default: 0 (disabled)
64
65	Possible values:
66
67	- 0 - disabled
68	- 1 - enabled
69
70fwmark_reflect - BOOLEAN
71	Controls the fwmark of kernel-generated IPv4 reply packets that are not
72	associated with a socket for example, TCP RSTs or ICMP echo replies).
73	If unset, these packets have a fwmark of zero. If set, they have the
74	fwmark of the packet they are replying to.
75
76	Default: 0
77
78fib_multipath_use_neigh - BOOLEAN
79	Use status of existing neighbor entry when determining nexthop for
80	multipath routes. If disabled, neighbor information is not used and
81	packets could be directed to a failed nexthop. Only valid for kernels
82	built with CONFIG_IP_ROUTE_MULTIPATH enabled.
83
84	Default: 0 (disabled)
85
86	Possible values:
87
88	- 0 - disabled
89	- 1 - enabled
90
91fib_multipath_hash_policy - INTEGER
92	Controls which hash policy to use for multipath routes. Only valid
93	for kernels built with CONFIG_IP_ROUTE_MULTIPATH enabled.
94
95	Default: 0 (Layer 3)
96
97	Possible values:
98
99	- 0 - Layer 3
100	- 1 - Layer 4
101	- 2 - Layer 3 or inner Layer 3 if present
102
103fib_sync_mem - UNSIGNED INTEGER
104	Amount of dirty memory from fib entries that can be backlogged before
105	synchronize_rcu is forced.
106
107	Default: 512kB   Minimum: 64kB   Maximum: 64MB
108
109ip_forward_update_priority - INTEGER
110	Whether to update SKB priority from "TOS" field in IPv4 header after it
111	is forwarded. The new SKB priority is mapped from TOS field value
112	according to an rt_tos2priority table (see e.g. man tc-prio).
113
114	Default: 1 (Update priority.)
115
116	Possible values:
117
118	- 0 - Do not update priority.
119	- 1 - Update priority.
120
121route/max_size - INTEGER
122	Maximum number of routes allowed in the kernel.  Increase
123	this when using large numbers of interfaces and/or routes.
124
125	From linux kernel 3.6 onwards, this is deprecated for ipv4
126	as route cache is no longer used.
127
128neigh/default/gc_thresh1 - INTEGER
129	Minimum number of entries to keep.  Garbage collector will not
130	purge entries if there are fewer than this number.
131
132	Default: 128
133
134neigh/default/gc_thresh2 - INTEGER
135	Threshold when garbage collector becomes more aggressive about
136	purging entries. Entries older than 5 seconds will be cleared
137	when over this number.
138
139	Default: 512
140
141neigh/default/gc_thresh3 - INTEGER
142	Maximum number of non-PERMANENT neighbor entries allowed.  Increase
143	this when using large numbers of interfaces and when communicating
144	with large numbers of directly-connected peers.
145
146	Default: 1024
147
148neigh/default/unres_qlen_bytes - INTEGER
149	The maximum number of bytes which may be used by packets
150	queued for each	unresolved address by other network layers.
151	(added in linux 3.3)
152
153	Setting negative value is meaningless and will return error.
154
155	Default: SK_WMEM_MAX, (same as net.core.wmem_default).
156
157		Exact value depends on architecture and kernel options,
158		but should be enough to allow queuing 256 packets
159		of medium size.
160
161neigh/default/unres_qlen - INTEGER
162	The maximum number of packets which may be queued for each
163	unresolved address by other network layers.
164
165	(deprecated in linux 3.3) : use unres_qlen_bytes instead.
166
167	Prior to linux 3.3, the default value is 3 which may cause
168	unexpected packet loss. The current default value is calculated
169	according to default value of unres_qlen_bytes and true size of
170	packet.
171
172	Default: 101
173
174mtu_expires - INTEGER
175	Time, in seconds, that cached PMTU information is kept.
176
177min_adv_mss - INTEGER
178	The advertised MSS depends on the first hop route MTU, but will
179	never be lower than this setting.
180
181IP Fragmentation:
182
183ipfrag_high_thresh - LONG INTEGER
184	Maximum memory used to reassemble IP fragments.
185
186ipfrag_low_thresh - LONG INTEGER
187	(Obsolete since linux-4.17)
188	Maximum memory used to reassemble IP fragments before the kernel
189	begins to remove incomplete fragment queues to free up resources.
190	The kernel still accepts new fragments for defragmentation.
191
192ipfrag_time - INTEGER
193	Time in seconds to keep an IP fragment in memory.
194
195ipfrag_max_dist - INTEGER
196	ipfrag_max_dist is a non-negative integer value which defines the
197	maximum "disorder" which is allowed among fragments which share a
198	common IP source address. Note that reordering of packets is
199	not unusual, but if a large number of fragments arrive from a source
200	IP address while a particular fragment queue remains incomplete, it
201	probably indicates that one or more fragments belonging to that queue
202	have been lost. When ipfrag_max_dist is positive, an additional check
203	is done on fragments before they are added to a reassembly queue - if
204	ipfrag_max_dist (or more) fragments have arrived from a particular IP
205	address between additions to any IP fragment queue using that source
206	address, it's presumed that one or more fragments in the queue are
207	lost. The existing fragment queue will be dropped, and a new one
208	started. An ipfrag_max_dist value of zero disables this check.
209
210	Using a very small value, e.g. 1 or 2, for ipfrag_max_dist can
211	result in unnecessarily dropping fragment queues when normal
212	reordering of packets occurs, which could lead to poor application
213	performance. Using a very large value, e.g. 50000, increases the
214	likelihood of incorrectly reassembling IP fragments that originate
215	from different IP datagrams, which could result in data corruption.
216	Default: 64
217
218INET peer storage
219=================
220
221inet_peer_threshold - INTEGER
222	The approximate size of the storage.  Starting from this threshold
223	entries will be thrown aggressively.  This threshold also determines
224	entries' time-to-live and time intervals between garbage collection
225	passes.  More entries, less time-to-live, less GC interval.
226
227inet_peer_minttl - INTEGER
228	Minimum time-to-live of entries.  Should be enough to cover fragment
229	time-to-live on the reassembling side.  This minimum time-to-live  is
230	guaranteed if the pool size is less than inet_peer_threshold.
231	Measured in seconds.
232
233inet_peer_maxttl - INTEGER
234	Maximum time-to-live of entries.  Unused entries will expire after
235	this period of time if there is no memory pressure on the pool (i.e.
236	when the number of entries in the pool is very small).
237	Measured in seconds.
238
239TCP variables
240=============
241
242somaxconn - INTEGER
243	Limit of socket listen() backlog, known in userspace as SOMAXCONN.
244	Defaults to 4096. (Was 128 before linux-5.4)
245	See also tcp_max_syn_backlog for additional tuning for TCP sockets.
246
247tcp_abort_on_overflow - BOOLEAN
248	If listening service is too slow to accept new connections,
249	reset them. Default state is FALSE. It means that if overflow
250	occurred due to a burst, connection will recover. Enable this
251	option _only_ if you are really sure that listening daemon
252	cannot be tuned to accept connections faster. Enabling this
253	option can harm clients of your server.
254
255tcp_adv_win_scale - INTEGER
256	Count buffering overhead as bytes/2^tcp_adv_win_scale
257	(if tcp_adv_win_scale > 0) or bytes-bytes/2^(-tcp_adv_win_scale),
258	if it is <= 0.
259
260	Possible values are [-31, 31], inclusive.
261
262	Default: 1
263
264tcp_allowed_congestion_control - STRING
265	Show/set the congestion control choices available to non-privileged
266	processes. The list is a subset of those listed in
267	tcp_available_congestion_control.
268
269	Default is "reno" and the default setting (tcp_congestion_control).
270
271tcp_app_win - INTEGER
272	Reserve max(window/2^tcp_app_win, mss) of window for application
273	buffer. Value 0 is special, it means that nothing is reserved.
274
275	Default: 31
276
277tcp_autocorking - BOOLEAN
278	Enable TCP auto corking :
279	When applications do consecutive small write()/sendmsg() system calls,
280	we try to coalesce these small writes as much as possible, to lower
281	total amount of sent packets. This is done if at least one prior
282	packet for the flow is waiting in Qdisc queues or device transmit
283	queue. Applications can still use TCP_CORK for optimal behavior
284	when they know how/when to uncork their sockets.
285
286	Default : 1
287
288tcp_available_congestion_control - STRING
289	Shows the available congestion control choices that are registered.
290	More congestion control algorithms may be available as modules,
291	but not loaded.
292
293tcp_base_mss - INTEGER
294	The initial value of search_low to be used by the packetization layer
295	Path MTU discovery (MTU probing).  If MTU probing is enabled,
296	this is the initial MSS used by the connection.
297
298tcp_mtu_probe_floor - INTEGER
299	If MTU probing is enabled this caps the minimum MSS used for search_low
300	for the connection.
301
302	Default : 48
303
304tcp_min_snd_mss - INTEGER
305	TCP SYN and SYNACK messages usually advertise an ADVMSS option,
306	as described in RFC 1122 and RFC 6691.
307
308	If this ADVMSS option is smaller than tcp_min_snd_mss,
309	it is silently capped to tcp_min_snd_mss.
310
311	Default : 48 (at least 8 bytes of payload per segment)
312
313tcp_congestion_control - STRING
314	Set the congestion control algorithm to be used for new
315	connections. The algorithm "reno" is always available, but
316	additional choices may be available based on kernel configuration.
317	Default is set as part of kernel configuration.
318	For passive connections, the listener congestion control choice
319	is inherited.
320
321	[see setsockopt(listenfd, SOL_TCP, TCP_CONGESTION, "name" ...) ]
322
323tcp_dsack - BOOLEAN
324	Allows TCP to send "duplicate" SACKs.
325
326tcp_early_retrans - INTEGER
327	Tail loss probe (TLP) converts RTOs occurring due to tail
328	losses into fast recovery (draft-ietf-tcpm-rack). Note that
329	TLP requires RACK to function properly (see tcp_recovery below)
330
331	Possible values:
332
333		- 0 disables TLP
334		- 3 or 4 enables TLP
335
336	Default: 3
337
338tcp_ecn - INTEGER
339	Control use of Explicit Congestion Notification (ECN) by TCP.
340	ECN is used only when both ends of the TCP connection indicate
341	support for it.  This feature is useful in avoiding losses due
342	to congestion by allowing supporting routers to signal
343	congestion before having to drop packets.
344
345	Possible values are:
346
347		=  =====================================================
348		0  Disable ECN.  Neither initiate nor accept ECN.
349		1  Enable ECN when requested by incoming connections and
350		   also request ECN on outgoing connection attempts.
351		2  Enable ECN when requested by incoming connections
352		   but do not request ECN on outgoing connections.
353		=  =====================================================
354
355	Default: 2
356
357tcp_ecn_fallback - BOOLEAN
358	If the kernel detects that ECN connection misbehaves, enable fall
359	back to non-ECN. Currently, this knob implements the fallback
360	from RFC3168, section 6.1.1.1., but we reserve that in future,
361	additional detection mechanisms could be implemented under this
362	knob. The value	is not used, if tcp_ecn or per route (or congestion
363	control) ECN settings are disabled.
364
365	Default: 1 (fallback enabled)
366
367tcp_fack - BOOLEAN
368	This is a legacy option, it has no effect anymore.
369
370tcp_fin_timeout - INTEGER
371	The length of time an orphaned (no longer referenced by any
372	application) connection will remain in the FIN_WAIT_2 state
373	before it is aborted at the local end.  While a perfectly
374	valid "receive only" state for an un-orphaned connection, an
375	orphaned connection in FIN_WAIT_2 state could otherwise wait
376	forever for the remote to close its end of the connection.
377
378	Cf. tcp_max_orphans
379
380	Default: 60 seconds
381
382tcp_frto - INTEGER
383	Enables Forward RTO-Recovery (F-RTO) defined in RFC5682.
384	F-RTO is an enhanced recovery algorithm for TCP retransmission
385	timeouts.  It is particularly beneficial in networks where the
386	RTT fluctuates (e.g., wireless). F-RTO is sender-side only
387	modification. It does not require any support from the peer.
388
389	By default it's enabled with a non-zero value. 0 disables F-RTO.
390
391tcp_fwmark_accept - BOOLEAN
392	If set, incoming connections to listening sockets that do not have a
393	socket mark will set the mark of the accepting socket to the fwmark of
394	the incoming SYN packet. This will cause all packets on that connection
395	(starting from the first SYNACK) to be sent with that fwmark. The
396	listening socket's mark is unchanged. Listening sockets that already
397	have a fwmark set via setsockopt(SOL_SOCKET, SO_MARK, ...) are
398	unaffected.
399
400	Default: 0
401
402tcp_invalid_ratelimit - INTEGER
403	Limit the maximal rate for sending duplicate acknowledgments
404	in response to incoming TCP packets that are for an existing
405	connection but that are invalid due to any of these reasons:
406
407	  (a) out-of-window sequence number,
408	  (b) out-of-window acknowledgment number, or
409	  (c) PAWS (Protection Against Wrapped Sequence numbers) check failure
410
411	This can help mitigate simple "ack loop" DoS attacks, wherein
412	a buggy or malicious middlebox or man-in-the-middle can
413	rewrite TCP header fields in manner that causes each endpoint
414	to think that the other is sending invalid TCP segments, thus
415	causing each side to send an unterminating stream of duplicate
416	acknowledgments for invalid segments.
417
418	Using 0 disables rate-limiting of dupacks in response to
419	invalid segments; otherwise this value specifies the minimal
420	space between sending such dupacks, in milliseconds.
421
422	Default: 500 (milliseconds).
423
424tcp_keepalive_time - INTEGER
425	How often TCP sends out keepalive messages when keepalive is enabled.
426	Default: 2hours.
427
428tcp_keepalive_probes - INTEGER
429	How many keepalive probes TCP sends out, until it decides that the
430	connection is broken. Default value: 9.
431
432tcp_keepalive_intvl - INTEGER
433	How frequently the probes are send out. Multiplied by
434	tcp_keepalive_probes it is time to kill not responding connection,
435	after probes started. Default value: 75sec i.e. connection
436	will be aborted after ~11 minutes of retries.
437
438tcp_l3mdev_accept - BOOLEAN
439	Enables child sockets to inherit the L3 master device index.
440	Enabling this option allows a "global" listen socket to work
441	across L3 master domains (e.g., VRFs) with connected sockets
442	derived from the listen socket to be bound to the L3 domain in
443	which the packets originated. Only valid when the kernel was
444	compiled with CONFIG_NET_L3_MASTER_DEV.
445
446	Default: 0 (disabled)
447
448tcp_low_latency - BOOLEAN
449	This is a legacy option, it has no effect anymore.
450
451tcp_max_orphans - INTEGER
452	Maximal number of TCP sockets not attached to any user file handle,
453	held by system.	If this number is exceeded orphaned connections are
454	reset immediately and warning is printed. This limit exists
455	only to prevent simple DoS attacks, you _must_ not rely on this
456	or lower the limit artificially, but rather increase it
457	(probably, after increasing installed memory),
458	if network conditions require more than default value,
459	and tune network services to linger and kill such states
460	more aggressively. Let me to remind again: each orphan eats
461	up to ~64K of unswappable memory.
462
463tcp_max_syn_backlog - INTEGER
464	Maximal number of remembered connection requests (SYN_RECV),
465	which have not received an acknowledgment from connecting client.
466
467	This is a per-listener limit.
468
469	The minimal value is 128 for low memory machines, and it will
470	increase in proportion to the memory of machine.
471
472	If server suffers from overload, try increasing this number.
473
474	Remember to also check /proc/sys/net/core/somaxconn
475	A SYN_RECV request socket consumes about 304 bytes of memory.
476
477tcp_max_tw_buckets - INTEGER
478	Maximal number of timewait sockets held by system simultaneously.
479	If this number is exceeded time-wait socket is immediately destroyed
480	and warning is printed. This limit exists only to prevent
481	simple DoS attacks, you _must_ not lower the limit artificially,
482	but rather increase it (probably, after increasing installed memory),
483	if network conditions require more than default value.
484
485tcp_mem - vector of 3 INTEGERs: min, pressure, max
486	min: below this number of pages TCP is not bothered about its
487	memory appetite.
488
489	pressure: when amount of memory allocated by TCP exceeds this number
490	of pages, TCP moderates its memory consumption and enters memory
491	pressure mode, which is exited when memory consumption falls
492	under "min".
493
494	max: number of pages allowed for queueing by all TCP sockets.
495
496	Defaults are calculated at boot time from amount of available
497	memory.
498
499tcp_min_rtt_wlen - INTEGER
500	The window length of the windowed min filter to track the minimum RTT.
501	A shorter window lets a flow more quickly pick up new (higher)
502	minimum RTT when it is moved to a longer path (e.g., due to traffic
503	engineering). A longer window makes the filter more resistant to RTT
504	inflations such as transient congestion. The unit is seconds.
505
506	Possible values: 0 - 86400 (1 day)
507
508	Default: 300
509
510tcp_moderate_rcvbuf - BOOLEAN
511	If set, TCP performs receive buffer auto-tuning, attempting to
512	automatically size the buffer (no greater than tcp_rmem[2]) to
513	match the size required by the path for full throughput.  Enabled by
514	default.
515
516tcp_mtu_probing - INTEGER
517	Controls TCP Packetization-Layer Path MTU Discovery.  Takes three
518	values:
519
520	- 0 - Disabled
521	- 1 - Disabled by default, enabled when an ICMP black hole detected
522	- 2 - Always enabled, use initial MSS of tcp_base_mss.
523
524tcp_probe_interval - UNSIGNED INTEGER
525	Controls how often to start TCP Packetization-Layer Path MTU
526	Discovery reprobe. The default is reprobing every 10 minutes as
527	per RFC4821.
528
529tcp_probe_threshold - INTEGER
530	Controls when TCP Packetization-Layer Path MTU Discovery probing
531	will stop in respect to the width of search range in bytes. Default
532	is 8 bytes.
533
534tcp_no_metrics_save - BOOLEAN
535	By default, TCP saves various connection metrics in the route cache
536	when the connection closes, so that connections established in the
537	near future can use these to set initial conditions.  Usually, this
538	increases overall performance, but may sometimes cause performance
539	degradation.  If set, TCP will not cache metrics on closing
540	connections.
541
542tcp_no_ssthresh_metrics_save - BOOLEAN
543	Controls whether TCP saves ssthresh metrics in the route cache.
544
545	Default is 1, which disables ssthresh metrics.
546
547tcp_orphan_retries - INTEGER
548	This value influences the timeout of a locally closed TCP connection,
549	when RTO retransmissions remain unacknowledged.
550	See tcp_retries2 for more details.
551
552	The default value is 8.
553
554	If your machine is a loaded WEB server,
555	you should think about lowering this value, such sockets
556	may consume significant resources. Cf. tcp_max_orphans.
557
558tcp_recovery - INTEGER
559	This value is a bitmap to enable various experimental loss recovery
560	features.
561
562	=========   =============================================================
563	RACK: 0x1   enables the RACK loss detection for fast detection of lost
564		    retransmissions and tail drops. It also subsumes and disables
565		    RFC6675 recovery for SACK connections.
566
567	RACK: 0x2   makes RACK's reordering window static (min_rtt/4).
568
569	RACK: 0x4   disables RACK's DUPACK threshold heuristic
570	=========   =============================================================
571
572	Default: 0x1
573
574tcp_reordering - INTEGER
575	Initial reordering level of packets in a TCP stream.
576	TCP stack can then dynamically adjust flow reordering level
577	between this initial value and tcp_max_reordering
578
579	Default: 3
580
581tcp_max_reordering - INTEGER
582	Maximal reordering level of packets in a TCP stream.
583	300 is a fairly conservative value, but you might increase it
584	if paths are using per packet load balancing (like bonding rr mode)
585
586	Default: 300
587
588tcp_retrans_collapse - BOOLEAN
589	Bug-to-bug compatibility with some broken printers.
590	On retransmit try to send bigger packets to work around bugs in
591	certain TCP stacks.
592
593tcp_retries1 - INTEGER
594	This value influences the time, after which TCP decides, that
595	something is wrong due to unacknowledged RTO retransmissions,
596	and reports this suspicion to the network layer.
597	See tcp_retries2 for more details.
598
599	RFC 1122 recommends at least 3 retransmissions, which is the
600	default.
601
602tcp_retries2 - INTEGER
603	This value influences the timeout of an alive TCP connection,
604	when RTO retransmissions remain unacknowledged.
605	Given a value of N, a hypothetical TCP connection following
606	exponential backoff with an initial RTO of TCP_RTO_MIN would
607	retransmit N times before killing the connection at the (N+1)th RTO.
608
609	The default value of 15 yields a hypothetical timeout of 924.6
610	seconds and is a lower bound for the effective timeout.
611	TCP will effectively time out at the first RTO which exceeds the
612	hypothetical timeout.
613
614	RFC 1122 recommends at least 100 seconds for the timeout,
615	which corresponds to a value of at least 8.
616
617tcp_rfc1337 - BOOLEAN
618	If set, the TCP stack behaves conforming to RFC1337. If unset,
619	we are not conforming to RFC, but prevent TCP TIME_WAIT
620	assassination.
621
622	Default: 0
623
624tcp_rmem - vector of 3 INTEGERs: min, default, max
625	min: Minimal size of receive buffer used by TCP sockets.
626	It is guaranteed to each TCP socket, even under moderate memory
627	pressure.
628
629	Default: 4K
630
631	default: initial size of receive buffer used by TCP sockets.
632	This value overrides net.core.rmem_default used by other protocols.
633	Default: 87380 bytes. This value results in window of 65535 with
634	default setting of tcp_adv_win_scale and tcp_app_win:0 and a bit
635	less for default tcp_app_win. See below about these variables.
636
637	max: maximal size of receive buffer allowed for automatically
638	selected receiver buffers for TCP socket. This value does not override
639	net.core.rmem_max.  Calling setsockopt() with SO_RCVBUF disables
640	automatic tuning of that socket's receive buffer size, in which
641	case this value is ignored.
642	Default: between 87380B and 6MB, depending on RAM size.
643
644tcp_sack - BOOLEAN
645	Enable select acknowledgments (SACKS).
646
647tcp_comp_sack_delay_ns - LONG INTEGER
648	TCP tries to reduce number of SACK sent, using a timer
649	based on 5% of SRTT, capped by this sysctl, in nano seconds.
650	The default is 1ms, based on TSO autosizing period.
651
652	Default : 1,000,000 ns (1 ms)
653
654tcp_comp_sack_slack_ns - LONG INTEGER
655	This sysctl control the slack used when arming the
656	timer used by SACK compression. This gives extra time
657	for small RTT flows, and reduces system overhead by allowing
658	opportunistic reduction of timer interrupts.
659
660	Default : 100,000 ns (100 us)
661
662tcp_comp_sack_nr - INTEGER
663	Max number of SACK that can be compressed.
664	Using 0 disables SACK compression.
665
666	Default : 44
667
668tcp_slow_start_after_idle - BOOLEAN
669	If set, provide RFC2861 behavior and time out the congestion
670	window after an idle period.  An idle period is defined at
671	the current RTO.  If unset, the congestion window will not
672	be timed out after an idle period.
673
674	Default: 1
675
676tcp_stdurg - BOOLEAN
677	Use the Host requirements interpretation of the TCP urgent pointer field.
678	Most hosts use the older BSD interpretation, so if you turn this on
679	Linux might not communicate correctly with them.
680
681	Default: FALSE
682
683tcp_synack_retries - INTEGER
684	Number of times SYNACKs for a passive TCP connection attempt will
685	be retransmitted. Should not be higher than 255. Default value
686	is 5, which corresponds to 31seconds till the last retransmission
687	with the current initial RTO of 1second. With this the final timeout
688	for a passive TCP connection will happen after 63seconds.
689
690tcp_syncookies - INTEGER
691	Only valid when the kernel was compiled with CONFIG_SYN_COOKIES
692	Send out syncookies when the syn backlog queue of a socket
693	overflows. This is to prevent against the common 'SYN flood attack'
694	Default: 1
695
696	Note, that syncookies is fallback facility.
697	It MUST NOT be used to help highly loaded servers to stand
698	against legal connection rate. If you see SYN flood warnings
699	in your logs, but investigation	shows that they occur
700	because of overload with legal connections, you should tune
701	another parameters until this warning disappear.
702	See: tcp_max_syn_backlog, tcp_synack_retries, tcp_abort_on_overflow.
703
704	syncookies seriously violate TCP protocol, do not allow
705	to use TCP extensions, can result in serious degradation
706	of some services (f.e. SMTP relaying), visible not by you,
707	but your clients and relays, contacting you. While you see
708	SYN flood warnings in logs not being really flooded, your server
709	is seriously misconfigured.
710
711	If you want to test which effects syncookies have to your
712	network connections you can set this knob to 2 to enable
713	unconditionally generation of syncookies.
714
715tcp_fastopen - INTEGER
716	Enable TCP Fast Open (RFC7413) to send and accept data in the opening
717	SYN packet.
718
719	The client support is enabled by flag 0x1 (on by default). The client
720	then must use sendmsg() or sendto() with the MSG_FASTOPEN flag,
721	rather than connect() to send data in SYN.
722
723	The server support is enabled by flag 0x2 (off by default). Then
724	either enable for all listeners with another flag (0x400) or
725	enable individual listeners via TCP_FASTOPEN socket option with
726	the option value being the length of the syn-data backlog.
727
728	The values (bitmap) are
729
730	=====  ======== ======================================================
731	  0x1  (client) enables sending data in the opening SYN on the client.
732	  0x2  (server) enables the server support, i.e., allowing data in
733			a SYN packet to be accepted and passed to the
734			application before 3-way handshake finishes.
735	  0x4  (client) send data in the opening SYN regardless of cookie
736			availability and without a cookie option.
737	0x200  (server) accept data-in-SYN w/o any cookie option present.
738	0x400  (server) enable all listeners to support Fast Open by
739			default without explicit TCP_FASTOPEN socket option.
740	=====  ======== ======================================================
741
742	Default: 0x1
743
744	Note that that additional client or server features are only
745	effective if the basic support (0x1 and 0x2) are enabled respectively.
746
747tcp_fastopen_blackhole_timeout_sec - INTEGER
748	Initial time period in second to disable Fastopen on active TCP sockets
749	when a TFO firewall blackhole issue happens.
750	This time period will grow exponentially when more blackhole issues
751	get detected right after Fastopen is re-enabled and will reset to
752	initial value when the blackhole issue goes away.
753	0 to disable the blackhole detection.
754
755	By default, it is set to 1hr.
756
757tcp_fastopen_key - list of comma separated 32-digit hexadecimal INTEGERs
758	The list consists of a primary key and an optional backup key. The
759	primary key is used for both creating and validating cookies, while the
760	optional backup key is only used for validating cookies. The purpose of
761	the backup key is to maximize TFO validation when keys are rotated.
762
763	A randomly chosen primary key may be configured by the kernel if
764	the tcp_fastopen sysctl is set to 0x400 (see above), or if the
765	TCP_FASTOPEN setsockopt() optname is set and a key has not been
766	previously configured via sysctl. If keys are configured via
767	setsockopt() by using the TCP_FASTOPEN_KEY optname, then those
768	per-socket keys will be used instead of any keys that are specified via
769	sysctl.
770
771	A key is specified as 4 8-digit hexadecimal integers which are separated
772	by a '-' as: xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx. Leading zeros may be
773	omitted. A primary and a backup key may be specified by separating them
774	by a comma. If only one key is specified, it becomes the primary key and
775	any previously configured backup keys are removed.
776
777tcp_syn_retries - INTEGER
778	Number of times initial SYNs for an active TCP connection attempt
779	will be retransmitted. Should not be higher than 127. Default value
780	is 6, which corresponds to 63seconds till the last retransmission
781	with the current initial RTO of 1second. With this the final timeout
782	for an active TCP connection attempt will happen after 127seconds.
783
784tcp_timestamps - INTEGER
785	Enable timestamps as defined in RFC1323.
786
787	- 0: Disabled.
788	- 1: Enable timestamps as defined in RFC1323 and use random offset for
789	  each connection rather than only using the current time.
790	- 2: Like 1, but without random offsets.
791
792	Default: 1
793
794tcp_min_tso_segs - INTEGER
795	Minimal number of segments per TSO frame.
796
797	Since linux-3.12, TCP does an automatic sizing of TSO frames,
798	depending on flow rate, instead of filling 64Kbytes packets.
799	For specific usages, it's possible to force TCP to build big
800	TSO frames. Note that TCP stack might split too big TSO packets
801	if available window is too small.
802
803	Default: 2
804
805tcp_pacing_ss_ratio - INTEGER
806	sk->sk_pacing_rate is set by TCP stack using a ratio applied
807	to current rate. (current_rate = cwnd * mss / srtt)
808	If TCP is in slow start, tcp_pacing_ss_ratio is applied
809	to let TCP probe for bigger speeds, assuming cwnd can be
810	doubled every other RTT.
811
812	Default: 200
813
814tcp_pacing_ca_ratio - INTEGER
815	sk->sk_pacing_rate is set by TCP stack using a ratio applied
816	to current rate. (current_rate = cwnd * mss / srtt)
817	If TCP is in congestion avoidance phase, tcp_pacing_ca_ratio
818	is applied to conservatively probe for bigger throughput.
819
820	Default: 120
821
822tcp_tso_win_divisor - INTEGER
823	This allows control over what percentage of the congestion window
824	can be consumed by a single TSO frame.
825	The setting of this parameter is a choice between burstiness and
826	building larger TSO frames.
827
828	Default: 3
829
830tcp_tw_reuse - INTEGER
831	Enable reuse of TIME-WAIT sockets for new connections when it is
832	safe from protocol viewpoint.
833
834	- 0 - disable
835	- 1 - global enable
836	- 2 - enable for loopback traffic only
837
838	It should not be changed without advice/request of technical
839	experts.
840
841	Default: 2
842
843tcp_window_scaling - BOOLEAN
844	Enable window scaling as defined in RFC1323.
845
846tcp_wmem - vector of 3 INTEGERs: min, default, max
847	min: Amount of memory reserved for send buffers for TCP sockets.
848	Each TCP socket has rights to use it due to fact of its birth.
849
850	Default: 4K
851
852	default: initial size of send buffer used by TCP sockets.  This
853	value overrides net.core.wmem_default used by other protocols.
854
855	It is usually lower than net.core.wmem_default.
856
857	Default: 16K
858
859	max: Maximal amount of memory allowed for automatically tuned
860	send buffers for TCP sockets. This value does not override
861	net.core.wmem_max.  Calling setsockopt() with SO_SNDBUF disables
862	automatic tuning of that socket's send buffer size, in which case
863	this value is ignored.
864
865	Default: between 64K and 4MB, depending on RAM size.
866
867tcp_notsent_lowat - UNSIGNED INTEGER
868	A TCP socket can control the amount of unsent bytes in its write queue,
869	thanks to TCP_NOTSENT_LOWAT socket option. poll()/select()/epoll()
870	reports POLLOUT events if the amount of unsent bytes is below a per
871	socket value, and if the write queue is not full. sendmsg() will
872	also not add new buffers if the limit is hit.
873
874	This global variable controls the amount of unsent data for
875	sockets not using TCP_NOTSENT_LOWAT. For these sockets, a change
876	to the global variable has immediate effect.
877
878	Default: UINT_MAX (0xFFFFFFFF)
879
880tcp_workaround_signed_windows - BOOLEAN
881	If set, assume no receipt of a window scaling option means the
882	remote TCP is broken and treats the window as a signed quantity.
883	If unset, assume the remote TCP is not broken even if we do
884	not receive a window scaling option from them.
885
886	Default: 0
887
888tcp_thin_linear_timeouts - BOOLEAN
889	Enable dynamic triggering of linear timeouts for thin streams.
890	If set, a check is performed upon retransmission by timeout to
891	determine if the stream is thin (less than 4 packets in flight).
892	As long as the stream is found to be thin, up to 6 linear
893	timeouts may be performed before exponential backoff mode is
894	initiated. This improves retransmission latency for
895	non-aggressive thin streams, often found to be time-dependent.
896	For more information on thin streams, see
897	Documentation/networking/tcp-thin.rst
898
899	Default: 0
900
901tcp_limit_output_bytes - INTEGER
902	Controls TCP Small Queue limit per tcp socket.
903	TCP bulk sender tends to increase packets in flight until it
904	gets losses notifications. With SNDBUF autotuning, this can
905	result in a large amount of packets queued on the local machine
906	(e.g.: qdiscs, CPU backlog, or device) hurting latency of other
907	flows, for typical pfifo_fast qdiscs.  tcp_limit_output_bytes
908	limits the number of bytes on qdisc or device to reduce artificial
909	RTT/cwnd and reduce bufferbloat.
910
911	Default: 1048576 (16 * 65536)
912
913tcp_challenge_ack_limit - INTEGER
914	Limits number of Challenge ACK sent per second, as recommended
915	in RFC 5961 (Improving TCP's Robustness to Blind In-Window Attacks)
916	Default: 1000
917
918tcp_rx_skb_cache - BOOLEAN
919	Controls a per TCP socket cache of one skb, that might help
920	performance of some workloads. This might be dangerous
921	on systems with a lot of TCP sockets, since it increases
922	memory usage.
923
924	Default: 0 (disabled)
925
926UDP variables
927=============
928
929udp_l3mdev_accept - BOOLEAN
930	Enabling this option allows a "global" bound socket to work
931	across L3 master domains (e.g., VRFs) with packets capable of
932	being received regardless of the L3 domain in which they
933	originated. Only valid when the kernel was compiled with
934	CONFIG_NET_L3_MASTER_DEV.
935
936	Default: 0 (disabled)
937
938udp_mem - vector of 3 INTEGERs: min, pressure, max
939	Number of pages allowed for queueing by all UDP sockets.
940
941	min: Below this number of pages UDP is not bothered about its
942	memory appetite. When amount of memory allocated by UDP exceeds
943	this number, UDP starts to moderate memory usage.
944
945	pressure: This value was introduced to follow format of tcp_mem.
946
947	max: Number of pages allowed for queueing by all UDP sockets.
948
949	Default is calculated at boot time from amount of available memory.
950
951udp_rmem_min - INTEGER
952	Minimal size of receive buffer used by UDP sockets in moderation.
953	Each UDP socket is able to use the size for receiving data, even if
954	total pages of UDP sockets exceed udp_mem pressure. The unit is byte.
955
956	Default: 4K
957
958udp_wmem_min - INTEGER
959	Minimal size of send buffer used by UDP sockets in moderation.
960	Each UDP socket is able to use the size for sending data, even if
961	total pages of UDP sockets exceed udp_mem pressure. The unit is byte.
962
963	Default: 4K
964
965RAW variables
966=============
967
968raw_l3mdev_accept - BOOLEAN
969	Enabling this option allows a "global" bound socket to work
970	across L3 master domains (e.g., VRFs) with packets capable of
971	being received regardless of the L3 domain in which they
972	originated. Only valid when the kernel was compiled with
973	CONFIG_NET_L3_MASTER_DEV.
974
975	Default: 1 (enabled)
976
977CIPSOv4 Variables
978=================
979
980cipso_cache_enable - BOOLEAN
981	If set, enable additions to and lookups from the CIPSO label mapping
982	cache.  If unset, additions are ignored and lookups always result in a
983	miss.  However, regardless of the setting the cache is still
984	invalidated when required when means you can safely toggle this on and
985	off and the cache will always be "safe".
986
987	Default: 1
988
989cipso_cache_bucket_size - INTEGER
990	The CIPSO label cache consists of a fixed size hash table with each
991	hash bucket containing a number of cache entries.  This variable limits
992	the number of entries in each hash bucket; the larger the value the
993	more CIPSO label mappings that can be cached.  When the number of
994	entries in a given hash bucket reaches this limit adding new entries
995	causes the oldest entry in the bucket to be removed to make room.
996
997	Default: 10
998
999cipso_rbm_optfmt - BOOLEAN
1000	Enable the "Optimized Tag 1 Format" as defined in section 3.4.2.6 of
1001	the CIPSO draft specification (see Documentation/netlabel for details).
1002	This means that when set the CIPSO tag will be padded with empty
1003	categories in order to make the packet data 32-bit aligned.
1004
1005	Default: 0
1006
1007cipso_rbm_structvalid - BOOLEAN
1008	If set, do a very strict check of the CIPSO option when
1009	ip_options_compile() is called.  If unset, relax the checks done during
1010	ip_options_compile().  Either way is "safe" as errors are caught else
1011	where in the CIPSO processing code but setting this to 0 (False) should
1012	result in less work (i.e. it should be faster) but could cause problems
1013	with other implementations that require strict checking.
1014
1015	Default: 0
1016
1017IP Variables
1018============
1019
1020ip_local_port_range - 2 INTEGERS
1021	Defines the local port range that is used by TCP and UDP to
1022	choose the local port. The first number is the first, the
1023	second the last local port number.
1024	If possible, it is better these numbers have different parity
1025	(one even and one odd value).
1026	Must be greater than or equal to ip_unprivileged_port_start.
1027	The default values are 32768 and 60999 respectively.
1028
1029ip_local_reserved_ports - list of comma separated ranges
1030	Specify the ports which are reserved for known third-party
1031	applications. These ports will not be used by automatic port
1032	assignments (e.g. when calling connect() or bind() with port
1033	number 0). Explicit port allocation behavior is unchanged.
1034
1035	The format used for both input and output is a comma separated
1036	list of ranges (e.g. "1,2-4,10-10" for ports 1, 2, 3, 4 and
1037	10). Writing to the file will clear all previously reserved
1038	ports and update the current list with the one given in the
1039	input.
1040
1041	Note that ip_local_port_range and ip_local_reserved_ports
1042	settings are independent and both are considered by the kernel
1043	when determining which ports are available for automatic port
1044	assignments.
1045
1046	You can reserve ports which are not in the current
1047	ip_local_port_range, e.g.::
1048
1049	    $ cat /proc/sys/net/ipv4/ip_local_port_range
1050	    32000	60999
1051	    $ cat /proc/sys/net/ipv4/ip_local_reserved_ports
1052	    8080,9148
1053
1054	although this is redundant. However such a setting is useful
1055	if later the port range is changed to a value that will
1056	include the reserved ports.
1057
1058	Default: Empty
1059
1060ip_unprivileged_port_start - INTEGER
1061	This is a per-namespace sysctl.  It defines the first
1062	unprivileged port in the network namespace.  Privileged ports
1063	require root or CAP_NET_BIND_SERVICE in order to bind to them.
1064	To disable all privileged ports, set this to 0.  They must not
1065	overlap with the ip_local_port_range.
1066
1067	Default: 1024
1068
1069ip_nonlocal_bind - BOOLEAN
1070	If set, allows processes to bind() to non-local IP addresses,
1071	which can be quite useful - but may break some applications.
1072
1073	Default: 0
1074
1075ip_autobind_reuse - BOOLEAN
1076	By default, bind() does not select the ports automatically even if
1077	the new socket and all sockets bound to the port have SO_REUSEADDR.
1078	ip_autobind_reuse allows bind() to reuse the port and this is useful
1079	when you use bind()+connect(), but may break some applications.
1080	The preferred solution is to use IP_BIND_ADDRESS_NO_PORT and this
1081	option should only be set by experts.
1082	Default: 0
1083
1084ip_dynaddr - BOOLEAN
1085	If set non-zero, enables support for dynamic addresses.
1086	If set to a non-zero value larger than 1, a kernel log
1087	message will be printed when dynamic address rewriting
1088	occurs.
1089
1090	Default: 0
1091
1092ip_early_demux - BOOLEAN
1093	Optimize input packet processing down to one demux for
1094	certain kinds of local sockets.  Currently we only do this
1095	for established TCP and connected UDP sockets.
1096
1097	It may add an additional cost for pure routing workloads that
1098	reduces overall throughput, in such case you should disable it.
1099
1100	Default: 1
1101
1102ping_group_range - 2 INTEGERS
1103	Restrict ICMP_PROTO datagram sockets to users in the group range.
1104	The default is "1 0", meaning, that nobody (not even root) may
1105	create ping sockets.  Setting it to "100 100" would grant permissions
1106	to the single group. "0 4294967295" would enable it for the world, "100
1107	4294967295" would enable it for the users, but not daemons.
1108
1109tcp_early_demux - BOOLEAN
1110	Enable early demux for established TCP sockets.
1111
1112	Default: 1
1113
1114udp_early_demux - BOOLEAN
1115	Enable early demux for connected UDP sockets. Disable this if
1116	your system could experience more unconnected load.
1117
1118	Default: 1
1119
1120icmp_echo_ignore_all - BOOLEAN
1121	If set non-zero, then the kernel will ignore all ICMP ECHO
1122	requests sent to it.
1123
1124	Default: 0
1125
1126icmp_echo_ignore_broadcasts - BOOLEAN
1127	If set non-zero, then the kernel will ignore all ICMP ECHO and
1128	TIMESTAMP requests sent to it via broadcast/multicast.
1129
1130	Default: 1
1131
1132icmp_ratelimit - INTEGER
1133	Limit the maximal rates for sending ICMP packets whose type matches
1134	icmp_ratemask (see below) to specific targets.
1135	0 to disable any limiting,
1136	otherwise the minimal space between responses in milliseconds.
1137	Note that another sysctl, icmp_msgs_per_sec limits the number
1138	of ICMP packets	sent on all targets.
1139
1140	Default: 1000
1141
1142icmp_msgs_per_sec - INTEGER
1143	Limit maximal number of ICMP packets sent per second from this host.
1144	Only messages whose type matches icmp_ratemask (see below) are
1145	controlled by this limit.
1146
1147	Default: 1000
1148
1149icmp_msgs_burst - INTEGER
1150	icmp_msgs_per_sec controls number of ICMP packets sent per second,
1151	while icmp_msgs_burst controls the burst size of these packets.
1152
1153	Default: 50
1154
1155icmp_ratemask - INTEGER
1156	Mask made of ICMP types for which rates are being limited.
1157
1158	Significant bits: IHGFEDCBA9876543210
1159
1160	Default mask:     0000001100000011000 (6168)
1161
1162	Bit definitions (see include/linux/icmp.h):
1163
1164		= =========================
1165		0 Echo Reply
1166		3 Destination Unreachable [1]_
1167		4 Source Quench [1]_
1168		5 Redirect
1169		8 Echo Request
1170		B Time Exceeded [1]_
1171		C Parameter Problem [1]_
1172		D Timestamp Request
1173		E Timestamp Reply
1174		F Info Request
1175		G Info Reply
1176		H Address Mask Request
1177		I Address Mask Reply
1178		= =========================
1179
1180	.. [1] These are rate limited by default (see default mask above)
1181
1182icmp_ignore_bogus_error_responses - BOOLEAN
1183	Some routers violate RFC1122 by sending bogus responses to broadcast
1184	frames.  Such violations are normally logged via a kernel warning.
1185	If this is set to TRUE, the kernel will not give such warnings, which
1186	will avoid log file clutter.
1187
1188	Default: 1
1189
1190icmp_errors_use_inbound_ifaddr - BOOLEAN
1191
1192	If zero, icmp error messages are sent with the primary address of
1193	the exiting interface.
1194
1195	If non-zero, the message will be sent with the primary address of
1196	the interface that received the packet that caused the icmp error.
1197	This is the behaviour network many administrators will expect from
1198	a router. And it can make debugging complicated network layouts
1199	much easier.
1200
1201	Note that if no primary address exists for the interface selected,
1202	then the primary address of the first non-loopback interface that
1203	has one will be used regardless of this setting.
1204
1205	Default: 0
1206
1207igmp_max_memberships - INTEGER
1208	Change the maximum number of multicast groups we can subscribe to.
1209	Default: 20
1210
1211	Theoretical maximum value is bounded by having to send a membership
1212	report in a single datagram (i.e. the report can't span multiple
1213	datagrams, or risk confusing the switch and leaving groups you don't
1214	intend to).
1215
1216	The number of supported groups 'M' is bounded by the number of group
1217	report entries you can fit into a single datagram of 65535 bytes.
1218
1219	M = 65536-sizeof (ip header)/(sizeof(Group record))
1220
1221	Group records are variable length, with a minimum of 12 bytes.
1222	So net.ipv4.igmp_max_memberships should not be set higher than:
1223
1224	(65536-24) / 12 = 5459
1225
1226	The value 5459 assumes no IP header options, so in practice
1227	this number may be lower.
1228
1229igmp_max_msf - INTEGER
1230	Maximum number of addresses allowed in the source filter list for a
1231	multicast group.
1232
1233	Default: 10
1234
1235igmp_qrv - INTEGER
1236	Controls the IGMP query robustness variable (see RFC2236 8.1).
1237
1238	Default: 2 (as specified by RFC2236 8.1)
1239
1240	Minimum: 1 (as specified by RFC6636 4.5)
1241
1242force_igmp_version - INTEGER
1243	- 0 - (default) No enforcement of a IGMP version, IGMPv1/v2 fallback
1244	  allowed. Will back to IGMPv3 mode again if all IGMPv1/v2 Querier
1245	  Present timer expires.
1246	- 1 - Enforce to use IGMP version 1. Will also reply IGMPv1 report if
1247	  receive IGMPv2/v3 query.
1248	- 2 - Enforce to use IGMP version 2. Will fallback to IGMPv1 if receive
1249	  IGMPv1 query message. Will reply report if receive IGMPv3 query.
1250	- 3 - Enforce to use IGMP version 3. The same react with default 0.
1251
1252	.. note::
1253
1254	   this is not the same with force_mld_version because IGMPv3 RFC3376
1255	   Security Considerations does not have clear description that we could
1256	   ignore other version messages completely as MLDv2 RFC3810. So make
1257	   this value as default 0 is recommended.
1258
1259``conf/interface/*``
1260	changes special settings per interface (where
1261	interface" is the name of your network interface)
1262
1263``conf/all/*``
1264	  is special, changes the settings for all interfaces
1265
1266log_martians - BOOLEAN
1267	Log packets with impossible addresses to kernel log.
1268	log_martians for the interface will be enabled if at least one of
1269	conf/{all,interface}/log_martians is set to TRUE,
1270	it will be disabled otherwise
1271
1272accept_redirects - BOOLEAN
1273	Accept ICMP redirect messages.
1274	accept_redirects for the interface will be enabled if:
1275
1276	- both conf/{all,interface}/accept_redirects are TRUE in the case
1277	  forwarding for the interface is enabled
1278
1279	or
1280
1281	- at least one of conf/{all,interface}/accept_redirects is TRUE in the
1282	  case forwarding for the interface is disabled
1283
1284	accept_redirects for the interface will be disabled otherwise
1285
1286	default:
1287
1288		- TRUE (host)
1289		- FALSE (router)
1290
1291forwarding - BOOLEAN
1292	Enable IP forwarding on this interface.  This controls whether packets
1293	received _on_ this interface can be forwarded.
1294
1295mc_forwarding - BOOLEAN
1296	Do multicast routing. The kernel needs to be compiled with CONFIG_MROUTE
1297	and a multicast routing daemon is required.
1298	conf/all/mc_forwarding must also be set to TRUE to enable multicast
1299	routing	for the interface
1300
1301medium_id - INTEGER
1302	Integer value used to differentiate the devices by the medium they
1303	are attached to. Two devices can have different id values when
1304	the broadcast packets are received only on one of them.
1305	The default value 0 means that the device is the only interface
1306	to its medium, value of -1 means that medium is not known.
1307
1308	Currently, it is used to change the proxy_arp behavior:
1309	the proxy_arp feature is enabled for packets forwarded between
1310	two devices attached to different media.
1311
1312proxy_arp - BOOLEAN
1313	Do proxy arp.
1314
1315	proxy_arp for the interface will be enabled if at least one of
1316	conf/{all,interface}/proxy_arp is set to TRUE,
1317	it will be disabled otherwise
1318
1319proxy_arp_pvlan - BOOLEAN
1320	Private VLAN proxy arp.
1321
1322	Basically allow proxy arp replies back to the same interface
1323	(from which the ARP request/solicitation was received).
1324
1325	This is done to support (ethernet) switch features, like RFC
1326	3069, where the individual ports are NOT allowed to
1327	communicate with each other, but they are allowed to talk to
1328	the upstream router.  As described in RFC 3069, it is possible
1329	to allow these hosts to communicate through the upstream
1330	router by proxy_arp'ing. Don't need to be used together with
1331	proxy_arp.
1332
1333	This technology is known by different names:
1334
1335	  In RFC 3069 it is called VLAN Aggregation.
1336	  Cisco and Allied Telesyn call it Private VLAN.
1337	  Hewlett-Packard call it Source-Port filtering or port-isolation.
1338	  Ericsson call it MAC-Forced Forwarding (RFC Draft).
1339
1340shared_media - BOOLEAN
1341	Send(router) or accept(host) RFC1620 shared media redirects.
1342	Overrides secure_redirects.
1343
1344	shared_media for the interface will be enabled if at least one of
1345	conf/{all,interface}/shared_media is set to TRUE,
1346	it will be disabled otherwise
1347
1348	default TRUE
1349
1350secure_redirects - BOOLEAN
1351	Accept ICMP redirect messages only to gateways listed in the
1352	interface's current gateway list. Even if disabled, RFC1122 redirect
1353	rules still apply.
1354
1355	Overridden by shared_media.
1356
1357	secure_redirects for the interface will be enabled if at least one of
1358	conf/{all,interface}/secure_redirects is set to TRUE,
1359	it will be disabled otherwise
1360
1361	default TRUE
1362
1363send_redirects - BOOLEAN
1364	Send redirects, if router.
1365
1366	send_redirects for the interface will be enabled if at least one of
1367	conf/{all,interface}/send_redirects is set to TRUE,
1368	it will be disabled otherwise
1369
1370	Default: TRUE
1371
1372bootp_relay - BOOLEAN
1373	Accept packets with source address 0.b.c.d destined
1374	not to this host as local ones. It is supposed, that
1375	BOOTP relay daemon will catch and forward such packets.
1376	conf/all/bootp_relay must also be set to TRUE to enable BOOTP relay
1377	for the interface
1378
1379	default FALSE
1380
1381	Not Implemented Yet.
1382
1383accept_source_route - BOOLEAN
1384	Accept packets with SRR option.
1385	conf/all/accept_source_route must also be set to TRUE to accept packets
1386	with SRR option on the interface
1387
1388	default
1389
1390		- TRUE (router)
1391		- FALSE (host)
1392
1393accept_local - BOOLEAN
1394	Accept packets with local source addresses. In combination with
1395	suitable routing, this can be used to direct packets between two
1396	local interfaces over the wire and have them accepted properly.
1397	default FALSE
1398
1399route_localnet - BOOLEAN
1400	Do not consider loopback addresses as martian source or destination
1401	while routing. This enables the use of 127/8 for local routing purposes.
1402
1403	default FALSE
1404
1405rp_filter - INTEGER
1406	- 0 - No source validation.
1407	- 1 - Strict mode as defined in RFC3704 Strict Reverse Path
1408	  Each incoming packet is tested against the FIB and if the interface
1409	  is not the best reverse path the packet check will fail.
1410	  By default failed packets are discarded.
1411	- 2 - Loose mode as defined in RFC3704 Loose Reverse Path
1412	  Each incoming packet's source address is also tested against the FIB
1413	  and if the source address is not reachable via any interface
1414	  the packet check will fail.
1415
1416	Current recommended practice in RFC3704 is to enable strict mode
1417	to prevent IP spoofing from DDos attacks. If using asymmetric routing
1418	or other complicated routing, then loose mode is recommended.
1419
1420	The max value from conf/{all,interface}/rp_filter is used
1421	when doing source validation on the {interface}.
1422
1423	Default value is 0. Note that some distributions enable it
1424	in startup scripts.
1425
1426arp_filter - BOOLEAN
1427	- 1 - Allows you to have multiple network interfaces on the same
1428	  subnet, and have the ARPs for each interface be answered
1429	  based on whether or not the kernel would route a packet from
1430	  the ARP'd IP out that interface (therefore you must use source
1431	  based routing for this to work). In other words it allows control
1432	  of which cards (usually 1) will respond to an arp request.
1433
1434	- 0 - (default) The kernel can respond to arp requests with addresses
1435	  from other interfaces. This may seem wrong but it usually makes
1436	  sense, because it increases the chance of successful communication.
1437	  IP addresses are owned by the complete host on Linux, not by
1438	  particular interfaces. Only for more complex setups like load-
1439	  balancing, does this behaviour cause problems.
1440
1441	arp_filter for the interface will be enabled if at least one of
1442	conf/{all,interface}/arp_filter is set to TRUE,
1443	it will be disabled otherwise
1444
1445arp_announce - INTEGER
1446	Define different restriction levels for announcing the local
1447	source IP address from IP packets in ARP requests sent on
1448	interface:
1449
1450	- 0 - (default) Use any local address, configured on any interface
1451	- 1 - Try to avoid local addresses that are not in the target's
1452	  subnet for this interface. This mode is useful when target
1453	  hosts reachable via this interface require the source IP
1454	  address in ARP requests to be part of their logical network
1455	  configured on the receiving interface. When we generate the
1456	  request we will check all our subnets that include the
1457	  target IP and will preserve the source address if it is from
1458	  such subnet. If there is no such subnet we select source
1459	  address according to the rules for level 2.
1460	- 2 - Always use the best local address for this target.
1461	  In this mode we ignore the source address in the IP packet
1462	  and try to select local address that we prefer for talks with
1463	  the target host. Such local address is selected by looking
1464	  for primary IP addresses on all our subnets on the outgoing
1465	  interface that include the target IP address. If no suitable
1466	  local address is found we select the first local address
1467	  we have on the outgoing interface or on all other interfaces,
1468	  with the hope we will receive reply for our request and
1469	  even sometimes no matter the source IP address we announce.
1470
1471	The max value from conf/{all,interface}/arp_announce is used.
1472
1473	Increasing the restriction level gives more chance for
1474	receiving answer from the resolved target while decreasing
1475	the level announces more valid sender's information.
1476
1477arp_ignore - INTEGER
1478	Define different modes for sending replies in response to
1479	received ARP requests that resolve local target IP addresses:
1480
1481	- 0 - (default): reply for any local target IP address, configured
1482	  on any interface
1483	- 1 - reply only if the target IP address is local address
1484	  configured on the incoming interface
1485	- 2 - reply only if the target IP address is local address
1486	  configured on the incoming interface and both with the
1487	  sender's IP address are part from same subnet on this interface
1488	- 3 - do not reply for local addresses configured with scope host,
1489	  only resolutions for global and link addresses are replied
1490	- 4-7 - reserved
1491	- 8 - do not reply for all local addresses
1492
1493	The max value from conf/{all,interface}/arp_ignore is used
1494	when ARP request is received on the {interface}
1495
1496arp_notify - BOOLEAN
1497	Define mode for notification of address and device changes.
1498
1499	 ==  ==========================================================
1500	  0  (default): do nothing
1501	  1  Generate gratuitous arp requests when device is brought up
1502	     or hardware address changes.
1503	 ==  ==========================================================
1504
1505arp_accept - BOOLEAN
1506	Define behavior for gratuitous ARP frames who's IP is not
1507	already present in the ARP table:
1508
1509	- 0 - don't create new entries in the ARP table
1510	- 1 - create new entries in the ARP table
1511
1512	Both replies and requests type gratuitous arp will trigger the
1513	ARP table to be updated, if this setting is on.
1514
1515	If the ARP table already contains the IP address of the
1516	gratuitous arp frame, the arp table will be updated regardless
1517	if this setting is on or off.
1518
1519mcast_solicit - INTEGER
1520	The maximum number of multicast probes in INCOMPLETE state,
1521	when the associated hardware address is unknown.  Defaults
1522	to 3.
1523
1524ucast_solicit - INTEGER
1525	The maximum number of unicast probes in PROBE state, when
1526	the hardware address is being reconfirmed.  Defaults to 3.
1527
1528app_solicit - INTEGER
1529	The maximum number of probes to send to the user space ARP daemon
1530	via netlink before dropping back to multicast probes (see
1531	mcast_resolicit).  Defaults to 0.
1532
1533mcast_resolicit - INTEGER
1534	The maximum number of multicast probes after unicast and
1535	app probes in PROBE state.  Defaults to 0.
1536
1537disable_policy - BOOLEAN
1538	Disable IPSEC policy (SPD) for this interface
1539
1540disable_xfrm - BOOLEAN
1541	Disable IPSEC encryption on this interface, whatever the policy
1542
1543igmpv2_unsolicited_report_interval - INTEGER
1544	The interval in milliseconds in which the next unsolicited
1545	IGMPv1 or IGMPv2 report retransmit will take place.
1546
1547	Default: 10000 (10 seconds)
1548
1549igmpv3_unsolicited_report_interval - INTEGER
1550	The interval in milliseconds in which the next unsolicited
1551	IGMPv3 report retransmit will take place.
1552
1553	Default: 1000 (1 seconds)
1554
1555promote_secondaries - BOOLEAN
1556	When a primary IP address is removed from this interface
1557	promote a corresponding secondary IP address instead of
1558	removing all the corresponding secondary IP addresses.
1559
1560drop_unicast_in_l2_multicast - BOOLEAN
1561	Drop any unicast IP packets that are received in link-layer
1562	multicast (or broadcast) frames.
1563
1564	This behavior (for multicast) is actually a SHOULD in RFC
1565	1122, but is disabled by default for compatibility reasons.
1566
1567	Default: off (0)
1568
1569drop_gratuitous_arp - BOOLEAN
1570	Drop all gratuitous ARP frames, for example if there's a known
1571	good ARP proxy on the network and such frames need not be used
1572	(or in the case of 802.11, must not be used to prevent attacks.)
1573
1574	Default: off (0)
1575
1576
1577tag - INTEGER
1578	Allows you to write a number, which can be used as required.
1579
1580	Default value is 0.
1581
1582xfrm4_gc_thresh - INTEGER
1583	(Obsolete since linux-4.14)
1584	The threshold at which we will start garbage collecting for IPv4
1585	destination cache entries.  At twice this value the system will
1586	refuse new allocations.
1587
1588igmp_link_local_mcast_reports - BOOLEAN
1589	Enable IGMP reports for link local multicast groups in the
1590	224.0.0.X range.
1591
1592	Default TRUE
1593
1594Alexey Kuznetsov.
1595kuznet@ms2.inr.ac.ru
1596
1597Updated by:
1598
1599- Andi Kleen
1600  ak@muc.de
1601- Nicolas Delon
1602  delon.nicolas@wanadoo.fr
1603
1604
1605
1606
1607/proc/sys/net/ipv6/* Variables
1608==============================
1609
1610IPv6 has no global variables such as tcp_*.  tcp_* settings under ipv4/ also
1611apply to IPv6 [XXX?].
1612
1613bindv6only - BOOLEAN
1614	Default value for IPV6_V6ONLY socket option,
1615	which restricts use of the IPv6 socket to IPv6 communication
1616	only.
1617
1618		- TRUE: disable IPv4-mapped address feature
1619		- FALSE: enable IPv4-mapped address feature
1620
1621	Default: FALSE (as specified in RFC3493)
1622
1623flowlabel_consistency - BOOLEAN
1624	Protect the consistency (and unicity) of flow label.
1625	You have to disable it to use IPV6_FL_F_REFLECT flag on the
1626	flow label manager.
1627
1628	- TRUE: enabled
1629	- FALSE: disabled
1630
1631	Default: TRUE
1632
1633auto_flowlabels - INTEGER
1634	Automatically generate flow labels based on a flow hash of the
1635	packet. This allows intermediate devices, such as routers, to
1636	identify packet flows for mechanisms like Equal Cost Multipath
1637	Routing (see RFC 6438).
1638
1639	=  ===========================================================
1640	0  automatic flow labels are completely disabled
1641	1  automatic flow labels are enabled by default, they can be
1642	   disabled on a per socket basis using the IPV6_AUTOFLOWLABEL
1643	   socket option
1644	2  automatic flow labels are allowed, they may be enabled on a
1645	   per socket basis using the IPV6_AUTOFLOWLABEL socket option
1646	3  automatic flow labels are enabled and enforced, they cannot
1647	   be disabled by the socket option
1648	=  ===========================================================
1649
1650	Default: 1
1651
1652flowlabel_state_ranges - BOOLEAN
1653	Split the flow label number space into two ranges. 0-0x7FFFF is
1654	reserved for the IPv6 flow manager facility, 0x80000-0xFFFFF
1655	is reserved for stateless flow labels as described in RFC6437.
1656
1657	- TRUE: enabled
1658	- FALSE: disabled
1659
1660	Default: true
1661
1662flowlabel_reflect - INTEGER
1663	Control flow label reflection. Needed for Path MTU
1664	Discovery to work with Equal Cost Multipath Routing in anycast
1665	environments. See RFC 7690 and:
1666	https://tools.ietf.org/html/draft-wang-6man-flow-label-reflection-01
1667
1668	This is a bitmask.
1669
1670	- 1: enabled for established flows
1671
1672	  Note that this prevents automatic flowlabel changes, as done
1673	  in "tcp: change IPv6 flow-label upon receiving spurious retransmission"
1674	  and "tcp: Change txhash on every SYN and RTO retransmit"
1675
1676	- 2: enabled for TCP RESET packets (no active listener)
1677	  If set, a RST packet sent in response to a SYN packet on a closed
1678	  port will reflect the incoming flow label.
1679
1680	- 4: enabled for ICMPv6 echo reply messages.
1681
1682	Default: 0
1683
1684fib_multipath_hash_policy - INTEGER
1685	Controls which hash policy to use for multipath routes.
1686
1687	Default: 0 (Layer 3)
1688
1689	Possible values:
1690
1691	- 0 - Layer 3 (source and destination addresses plus flow label)
1692	- 1 - Layer 4 (standard 5-tuple)
1693	- 2 - Layer 3 or inner Layer 3 if present
1694
1695anycast_src_echo_reply - BOOLEAN
1696	Controls the use of anycast addresses as source addresses for ICMPv6
1697	echo reply
1698
1699	- TRUE:  enabled
1700	- FALSE: disabled
1701
1702	Default: FALSE
1703
1704idgen_delay - INTEGER
1705	Controls the delay in seconds after which time to retry
1706	privacy stable address generation if a DAD conflict is
1707	detected.
1708
1709	Default: 1 (as specified in RFC7217)
1710
1711idgen_retries - INTEGER
1712	Controls the number of retries to generate a stable privacy
1713	address if a DAD conflict is detected.
1714
1715	Default: 3 (as specified in RFC7217)
1716
1717mld_qrv - INTEGER
1718	Controls the MLD query robustness variable (see RFC3810 9.1).
1719
1720	Default: 2 (as specified by RFC3810 9.1)
1721
1722	Minimum: 1 (as specified by RFC6636 4.5)
1723
1724max_dst_opts_number - INTEGER
1725	Maximum number of non-padding TLVs allowed in a Destination
1726	options extension header. If this value is less than zero
1727	then unknown options are disallowed and the number of known
1728	TLVs allowed is the absolute value of this number.
1729
1730	Default: 8
1731
1732max_hbh_opts_number - INTEGER
1733	Maximum number of non-padding TLVs allowed in a Hop-by-Hop
1734	options extension header. If this value is less than zero
1735	then unknown options are disallowed and the number of known
1736	TLVs allowed is the absolute value of this number.
1737
1738	Default: 8
1739
1740max_dst_opts_length - INTEGER
1741	Maximum length allowed for a Destination options extension
1742	header.
1743
1744	Default: INT_MAX (unlimited)
1745
1746max_hbh_length - INTEGER
1747	Maximum length allowed for a Hop-by-Hop options extension
1748	header.
1749
1750	Default: INT_MAX (unlimited)
1751
1752skip_notify_on_dev_down - BOOLEAN
1753	Controls whether an RTM_DELROUTE message is generated for routes
1754	removed when a device is taken down or deleted. IPv4 does not
1755	generate this message; IPv6 does by default. Setting this sysctl
1756	to true skips the message, making IPv4 and IPv6 on par in relying
1757	on userspace caches to track link events and evict routes.
1758
1759	Default: false (generate message)
1760
1761nexthop_compat_mode - BOOLEAN
1762	New nexthop API provides a means for managing nexthops independent of
1763	prefixes. Backwards compatibilty with old route format is enabled by
1764	default which means route dumps and notifications contain the new
1765	nexthop attribute but also the full, expanded nexthop definition.
1766	Further, updates or deletes of a nexthop configuration generate route
1767	notifications for each fib entry using the nexthop. Once a system
1768	understands the new API, this sysctl can be disabled to achieve full
1769	performance benefits of the new API by disabling the nexthop expansion
1770	and extraneous notifications.
1771	Default: true (backward compat mode)
1772
1773IPv6 Fragmentation:
1774
1775ip6frag_high_thresh - INTEGER
1776	Maximum memory used to reassemble IPv6 fragments. When
1777	ip6frag_high_thresh bytes of memory is allocated for this purpose,
1778	the fragment handler will toss packets until ip6frag_low_thresh
1779	is reached.
1780
1781ip6frag_low_thresh - INTEGER
1782	See ip6frag_high_thresh
1783
1784ip6frag_time - INTEGER
1785	Time in seconds to keep an IPv6 fragment in memory.
1786
1787IPv6 Segment Routing:
1788
1789seg6_flowlabel - INTEGER
1790	Controls the behaviour of computing the flowlabel of outer
1791	IPv6 header in case of SR T.encaps
1792
1793	 == =======================================================
1794	 -1  set flowlabel to zero.
1795	  0  copy flowlabel from Inner packet in case of Inner IPv6
1796	     (Set flowlabel to 0 in case IPv4/L2)
1797	  1  Compute the flowlabel using seg6_make_flowlabel()
1798	 == =======================================================
1799
1800	Default is 0.
1801
1802``conf/default/*``:
1803	Change the interface-specific default settings.
1804
1805
1806``conf/all/*``:
1807	Change all the interface-specific settings.
1808
1809	[XXX:  Other special features than forwarding?]
1810
1811conf/all/forwarding - BOOLEAN
1812	Enable global IPv6 forwarding between all interfaces.
1813
1814	IPv4 and IPv6 work differently here; e.g. netfilter must be used
1815	to control which interfaces may forward packets and which not.
1816
1817	This also sets all interfaces' Host/Router setting
1818	'forwarding' to the specified value.  See below for details.
1819
1820	This referred to as global forwarding.
1821
1822proxy_ndp - BOOLEAN
1823	Do proxy ndp.
1824
1825fwmark_reflect - BOOLEAN
1826	Controls the fwmark of kernel-generated IPv6 reply packets that are not
1827	associated with a socket for example, TCP RSTs or ICMPv6 echo replies).
1828	If unset, these packets have a fwmark of zero. If set, they have the
1829	fwmark of the packet they are replying to.
1830
1831	Default: 0
1832
1833``conf/interface/*``:
1834	Change special settings per interface.
1835
1836	The functional behaviour for certain settings is different
1837	depending on whether local forwarding is enabled or not.
1838
1839accept_ra - INTEGER
1840	Accept Router Advertisements; autoconfigure using them.
1841
1842	It also determines whether or not to transmit Router
1843	Solicitations. If and only if the functional setting is to
1844	accept Router Advertisements, Router Solicitations will be
1845	transmitted.
1846
1847	Possible values are:
1848
1849		==  ===========================================================
1850		 0  Do not accept Router Advertisements.
1851		 1  Accept Router Advertisements if forwarding is disabled.
1852		 2  Overrule forwarding behaviour. Accept Router Advertisements
1853		    even if forwarding is enabled.
1854		==  ===========================================================
1855
1856	Functional default:
1857
1858		- enabled if local forwarding is disabled.
1859		- disabled if local forwarding is enabled.
1860
1861accept_ra_defrtr - BOOLEAN
1862	Learn default router in Router Advertisement.
1863
1864	Functional default:
1865
1866		- enabled if accept_ra is enabled.
1867		- disabled if accept_ra is disabled.
1868
1869accept_ra_from_local - BOOLEAN
1870	Accept RA with source-address that is found on local machine
1871	if the RA is otherwise proper and able to be accepted.
1872
1873	Default is to NOT accept these as it may be an un-intended
1874	network loop.
1875
1876	Functional default:
1877
1878	   - enabled if accept_ra_from_local is enabled
1879	     on a specific interface.
1880	   - disabled if accept_ra_from_local is disabled
1881	     on a specific interface.
1882
1883accept_ra_min_hop_limit - INTEGER
1884	Minimum hop limit Information in Router Advertisement.
1885
1886	Hop limit Information in Router Advertisement less than this
1887	variable shall be ignored.
1888
1889	Default: 1
1890
1891accept_ra_pinfo - BOOLEAN
1892	Learn Prefix Information in Router Advertisement.
1893
1894	Functional default:
1895
1896		- enabled if accept_ra is enabled.
1897		- disabled if accept_ra is disabled.
1898
1899accept_ra_rt_info_min_plen - INTEGER
1900	Minimum prefix length of Route Information in RA.
1901
1902	Route Information w/ prefix smaller than this variable shall
1903	be ignored.
1904
1905	Functional default:
1906
1907		* 0 if accept_ra_rtr_pref is enabled.
1908		* -1 if accept_ra_rtr_pref is disabled.
1909
1910accept_ra_rt_info_max_plen - INTEGER
1911	Maximum prefix length of Route Information in RA.
1912
1913	Route Information w/ prefix larger than this variable shall
1914	be ignored.
1915
1916	Functional default:
1917
1918		* 0 if accept_ra_rtr_pref is enabled.
1919		* -1 if accept_ra_rtr_pref is disabled.
1920
1921accept_ra_rtr_pref - BOOLEAN
1922	Accept Router Preference in RA.
1923
1924	Functional default:
1925
1926		- enabled if accept_ra is enabled.
1927		- disabled if accept_ra is disabled.
1928
1929accept_ra_mtu - BOOLEAN
1930	Apply the MTU value specified in RA option 5 (RFC4861). If
1931	disabled, the MTU specified in the RA will be ignored.
1932
1933	Functional default:
1934
1935		- enabled if accept_ra is enabled.
1936		- disabled if accept_ra is disabled.
1937
1938accept_redirects - BOOLEAN
1939	Accept Redirects.
1940
1941	Functional default:
1942
1943		- enabled if local forwarding is disabled.
1944		- disabled if local forwarding is enabled.
1945
1946accept_source_route - INTEGER
1947	Accept source routing (routing extension header).
1948
1949	- >= 0: Accept only routing header type 2.
1950	- < 0: Do not accept routing header.
1951
1952	Default: 0
1953
1954autoconf - BOOLEAN
1955	Autoconfigure addresses using Prefix Information in Router
1956	Advertisements.
1957
1958	Functional default:
1959
1960		- enabled if accept_ra_pinfo is enabled.
1961		- disabled if accept_ra_pinfo is disabled.
1962
1963dad_transmits - INTEGER
1964	The amount of Duplicate Address Detection probes to send.
1965
1966	Default: 1
1967
1968forwarding - INTEGER
1969	Configure interface-specific Host/Router behaviour.
1970
1971	.. note::
1972
1973	   It is recommended to have the same setting on all
1974	   interfaces; mixed router/host scenarios are rather uncommon.
1975
1976	Possible values are:
1977
1978		- 0 Forwarding disabled
1979		- 1 Forwarding enabled
1980
1981	**FALSE (0)**:
1982
1983	By default, Host behaviour is assumed.  This means:
1984
1985	1. IsRouter flag is not set in Neighbour Advertisements.
1986	2. If accept_ra is TRUE (default), transmit Router
1987	   Solicitations.
1988	3. If accept_ra is TRUE (default), accept Router
1989	   Advertisements (and do autoconfiguration).
1990	4. If accept_redirects is TRUE (default), accept Redirects.
1991
1992	**TRUE (1)**:
1993
1994	If local forwarding is enabled, Router behaviour is assumed.
1995	This means exactly the reverse from the above:
1996
1997	1. IsRouter flag is set in Neighbour Advertisements.
1998	2. Router Solicitations are not sent unless accept_ra is 2.
1999	3. Router Advertisements are ignored unless accept_ra is 2.
2000	4. Redirects are ignored.
2001
2002	Default: 0 (disabled) if global forwarding is disabled (default),
2003	otherwise 1 (enabled).
2004
2005hop_limit - INTEGER
2006	Default Hop Limit to set.
2007
2008	Default: 64
2009
2010mtu - INTEGER
2011	Default Maximum Transfer Unit
2012
2013	Default: 1280 (IPv6 required minimum)
2014
2015ip_nonlocal_bind - BOOLEAN
2016	If set, allows processes to bind() to non-local IPv6 addresses,
2017	which can be quite useful - but may break some applications.
2018
2019	Default: 0
2020
2021router_probe_interval - INTEGER
2022	Minimum interval (in seconds) between Router Probing described
2023	in RFC4191.
2024
2025	Default: 60
2026
2027router_solicitation_delay - INTEGER
2028	Number of seconds to wait after interface is brought up
2029	before sending Router Solicitations.
2030
2031	Default: 1
2032
2033router_solicitation_interval - INTEGER
2034	Number of seconds to wait between Router Solicitations.
2035
2036	Default: 4
2037
2038router_solicitations - INTEGER
2039	Number of Router Solicitations to send until assuming no
2040	routers are present.
2041
2042	Default: 3
2043
2044use_oif_addrs_only - BOOLEAN
2045	When enabled, the candidate source addresses for destinations
2046	routed via this interface are restricted to the set of addresses
2047	configured on this interface (vis. RFC 6724, section 4).
2048
2049	Default: false
2050
2051use_tempaddr - INTEGER
2052	Preference for Privacy Extensions (RFC3041).
2053
2054	  * <= 0 : disable Privacy Extensions
2055	  * == 1 : enable Privacy Extensions, but prefer public
2056	    addresses over temporary addresses.
2057	  * >  1 : enable Privacy Extensions and prefer temporary
2058	    addresses over public addresses.
2059
2060	Default:
2061
2062		* 0 (for most devices)
2063		* -1 (for point-to-point devices and loopback devices)
2064
2065temp_valid_lft - INTEGER
2066	valid lifetime (in seconds) for temporary addresses.
2067
2068	Default: 172800 (2 days)
2069
2070temp_prefered_lft - INTEGER
2071	Preferred lifetime (in seconds) for temporary addresses.
2072
2073	Default: 86400 (1 day)
2074
2075keep_addr_on_down - INTEGER
2076	Keep all IPv6 addresses on an interface down event. If set static
2077	global addresses with no expiration time are not flushed.
2078
2079	*   >0 : enabled
2080	*    0 : system default
2081	*   <0 : disabled
2082
2083	Default: 0 (addresses are removed)
2084
2085max_desync_factor - INTEGER
2086	Maximum value for DESYNC_FACTOR, which is a random value
2087	that ensures that clients don't synchronize with each
2088	other and generate new addresses at exactly the same time.
2089	value is in seconds.
2090
2091	Default: 600
2092
2093regen_max_retry - INTEGER
2094	Number of attempts before give up attempting to generate
2095	valid temporary addresses.
2096
2097	Default: 5
2098
2099max_addresses - INTEGER
2100	Maximum number of autoconfigured addresses per interface.  Setting
2101	to zero disables the limitation.  It is not recommended to set this
2102	value too large (or to zero) because it would be an easy way to
2103	crash the kernel by allowing too many addresses to be created.
2104
2105	Default: 16
2106
2107disable_ipv6 - BOOLEAN
2108	Disable IPv6 operation.  If accept_dad is set to 2, this value
2109	will be dynamically set to TRUE if DAD fails for the link-local
2110	address.
2111
2112	Default: FALSE (enable IPv6 operation)
2113
2114	When this value is changed from 1 to 0 (IPv6 is being enabled),
2115	it will dynamically create a link-local address on the given
2116	interface and start Duplicate Address Detection, if necessary.
2117
2118	When this value is changed from 0 to 1 (IPv6 is being disabled),
2119	it will dynamically delete all addresses and routes on the given
2120	interface. From now on it will not possible to add addresses/routes
2121	to the selected interface.
2122
2123accept_dad - INTEGER
2124	Whether to accept DAD (Duplicate Address Detection).
2125
2126	 == ==============================================================
2127	  0  Disable DAD
2128	  1  Enable DAD (default)
2129	  2  Enable DAD, and disable IPv6 operation if MAC-based duplicate
2130	     link-local address has been found.
2131	 == ==============================================================
2132
2133	DAD operation and mode on a given interface will be selected according
2134	to the maximum value of conf/{all,interface}/accept_dad.
2135
2136force_tllao - BOOLEAN
2137	Enable sending the target link-layer address option even when
2138	responding to a unicast neighbor solicitation.
2139
2140	Default: FALSE
2141
2142	Quoting from RFC 2461, section 4.4, Target link-layer address:
2143
2144	"The option MUST be included for multicast solicitations in order to
2145	avoid infinite Neighbor Solicitation "recursion" when the peer node
2146	does not have a cache entry to return a Neighbor Advertisements
2147	message.  When responding to unicast solicitations, the option can be
2148	omitted since the sender of the solicitation has the correct link-
2149	layer address; otherwise it would not have be able to send the unicast
2150	solicitation in the first place. However, including the link-layer
2151	address in this case adds little overhead and eliminates a potential
2152	race condition where the sender deletes the cached link-layer address
2153	prior to receiving a response to a previous solicitation."
2154
2155ndisc_notify - BOOLEAN
2156	Define mode for notification of address and device changes.
2157
2158	* 0 - (default): do nothing
2159	* 1 - Generate unsolicited neighbour advertisements when device is brought
2160	  up or hardware address changes.
2161
2162ndisc_tclass - INTEGER
2163	The IPv6 Traffic Class to use by default when sending IPv6 Neighbor
2164	Discovery (Router Solicitation, Router Advertisement, Neighbor
2165	Solicitation, Neighbor Advertisement, Redirect) messages.
2166	These 8 bits can be interpreted as 6 high order bits holding the DSCP
2167	value and 2 low order bits representing ECN (which you probably want
2168	to leave cleared).
2169
2170	* 0 - (default)
2171
2172mldv1_unsolicited_report_interval - INTEGER
2173	The interval in milliseconds in which the next unsolicited
2174	MLDv1 report retransmit will take place.
2175
2176	Default: 10000 (10 seconds)
2177
2178mldv2_unsolicited_report_interval - INTEGER
2179	The interval in milliseconds in which the next unsolicited
2180	MLDv2 report retransmit will take place.
2181
2182	Default: 1000 (1 second)
2183
2184force_mld_version - INTEGER
2185	* 0 - (default) No enforcement of a MLD version, MLDv1 fallback allowed
2186	* 1 - Enforce to use MLD version 1
2187	* 2 - Enforce to use MLD version 2
2188
2189suppress_frag_ndisc - INTEGER
2190	Control RFC 6980 (Security Implications of IPv6 Fragmentation
2191	with IPv6 Neighbor Discovery) behavior:
2192
2193	* 1 - (default) discard fragmented neighbor discovery packets
2194	* 0 - allow fragmented neighbor discovery packets
2195
2196optimistic_dad - BOOLEAN
2197	Whether to perform Optimistic Duplicate Address Detection (RFC 4429).
2198
2199	* 0: disabled (default)
2200	* 1: enabled
2201
2202	Optimistic Duplicate Address Detection for the interface will be enabled
2203	if at least one of conf/{all,interface}/optimistic_dad is set to 1,
2204	it will be disabled otherwise.
2205
2206use_optimistic - BOOLEAN
2207	If enabled, do not classify optimistic addresses as deprecated during
2208	source address selection.  Preferred addresses will still be chosen
2209	before optimistic addresses, subject to other ranking in the source
2210	address selection algorithm.
2211
2212	* 0: disabled (default)
2213	* 1: enabled
2214
2215	This will be enabled if at least one of
2216	conf/{all,interface}/use_optimistic is set to 1, disabled otherwise.
2217
2218stable_secret - IPv6 address
2219	This IPv6 address will be used as a secret to generate IPv6
2220	addresses for link-local addresses and autoconfigured
2221	ones. All addresses generated after setting this secret will
2222	be stable privacy ones by default. This can be changed via the
2223	addrgenmode ip-link. conf/default/stable_secret is used as the
2224	secret for the namespace, the interface specific ones can
2225	overwrite that. Writes to conf/all/stable_secret are refused.
2226
2227	It is recommended to generate this secret during installation
2228	of a system and keep it stable after that.
2229
2230	By default the stable secret is unset.
2231
2232addr_gen_mode - INTEGER
2233	Defines how link-local and autoconf addresses are generated.
2234
2235	=  =================================================================
2236	0  generate address based on EUI64 (default)
2237	1  do no generate a link-local address, use EUI64 for addresses
2238	   generated from autoconf
2239	2  generate stable privacy addresses, using the secret from
2240	   stable_secret (RFC7217)
2241	3  generate stable privacy addresses, using a random secret if unset
2242	=  =================================================================
2243
2244drop_unicast_in_l2_multicast - BOOLEAN
2245	Drop any unicast IPv6 packets that are received in link-layer
2246	multicast (or broadcast) frames.
2247
2248	By default this is turned off.
2249
2250drop_unsolicited_na - BOOLEAN
2251	Drop all unsolicited neighbor advertisements, for example if there's
2252	a known good NA proxy on the network and such frames need not be used
2253	(or in the case of 802.11, must not be used to prevent attacks.)
2254
2255	By default this is turned off.
2256
2257enhanced_dad - BOOLEAN
2258	Include a nonce option in the IPv6 neighbor solicitation messages used for
2259	duplicate address detection per RFC7527. A received DAD NS will only signal
2260	a duplicate address if the nonce is different. This avoids any false
2261	detection of duplicates due to loopback of the NS messages that we send.
2262	The nonce option will be sent on an interface unless both of
2263	conf/{all,interface}/enhanced_dad are set to FALSE.
2264
2265	Default: TRUE
2266
2267``icmp/*``:
2268===========
2269
2270ratelimit - INTEGER
2271	Limit the maximal rates for sending ICMPv6 messages.
2272
2273	0 to disable any limiting,
2274	otherwise the minimal space between responses in milliseconds.
2275
2276	Default: 1000
2277
2278ratemask - list of comma separated ranges
2279	For ICMPv6 message types matching the ranges in the ratemask, limit
2280	the sending of the message according to ratelimit parameter.
2281
2282	The format used for both input and output is a comma separated
2283	list of ranges (e.g. "0-127,129" for ICMPv6 message type 0 to 127 and
2284	129). Writing to the file will clear all previous ranges of ICMPv6
2285	message types and update the current list with the input.
2286
2287	Refer to: https://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xhtml
2288	for numerical values of ICMPv6 message types, e.g. echo request is 128
2289	and echo reply is 129.
2290
2291	Default: 0-1,3-127 (rate limit ICMPv6 errors except Packet Too Big)
2292
2293echo_ignore_all - BOOLEAN
2294	If set non-zero, then the kernel will ignore all ICMP ECHO
2295	requests sent to it over the IPv6 protocol.
2296
2297	Default: 0
2298
2299echo_ignore_multicast - BOOLEAN
2300	If set non-zero, then the kernel will ignore all ICMP ECHO
2301	requests sent to it over the IPv6 protocol via multicast.
2302
2303	Default: 0
2304
2305echo_ignore_anycast - BOOLEAN
2306	If set non-zero, then the kernel will ignore all ICMP ECHO
2307	requests sent to it over the IPv6 protocol destined to anycast address.
2308
2309	Default: 0
2310
2311xfrm6_gc_thresh - INTEGER
2312	(Obsolete since linux-4.14)
2313	The threshold at which we will start garbage collecting for IPv6
2314	destination cache entries.  At twice this value the system will
2315	refuse new allocations.
2316
2317
2318IPv6 Update by:
2319Pekka Savola <pekkas@netcore.fi>
2320YOSHIFUJI Hideaki / USAGI Project <yoshfuji@linux-ipv6.org>
2321
2322
2323/proc/sys/net/bridge/* Variables:
2324=================================
2325
2326bridge-nf-call-arptables - BOOLEAN
2327	- 1 : pass bridged ARP traffic to arptables' FORWARD chain.
2328	- 0 : disable this.
2329
2330	Default: 1
2331
2332bridge-nf-call-iptables - BOOLEAN
2333	- 1 : pass bridged IPv4 traffic to iptables' chains.
2334	- 0 : disable this.
2335
2336	Default: 1
2337
2338bridge-nf-call-ip6tables - BOOLEAN
2339	- 1 : pass bridged IPv6 traffic to ip6tables' chains.
2340	- 0 : disable this.
2341
2342	Default: 1
2343
2344bridge-nf-filter-vlan-tagged - BOOLEAN
2345	- 1 : pass bridged vlan-tagged ARP/IP/IPv6 traffic to {arp,ip,ip6}tables.
2346	- 0 : disable this.
2347
2348	Default: 0
2349
2350bridge-nf-filter-pppoe-tagged - BOOLEAN
2351	- 1 : pass bridged pppoe-tagged IP/IPv6 traffic to {ip,ip6}tables.
2352	- 0 : disable this.
2353
2354	Default: 0
2355
2356bridge-nf-pass-vlan-input-dev - BOOLEAN
2357	- 1: if bridge-nf-filter-vlan-tagged is enabled, try to find a vlan
2358	  interface on the bridge and set the netfilter input device to the
2359	  vlan. This allows use of e.g. "iptables -i br0.1" and makes the
2360	  REDIRECT target work with vlan-on-top-of-bridge interfaces.  When no
2361	  matching vlan interface is found, or this switch is off, the input
2362	  device is set to the bridge interface.
2363
2364	- 0: disable bridge netfilter vlan interface lookup.
2365
2366	Default: 0
2367
2368``proc/sys/net/sctp/*`` Variables:
2369==================================
2370
2371addip_enable - BOOLEAN
2372	Enable or disable extension of  Dynamic Address Reconfiguration
2373	(ADD-IP) functionality specified in RFC5061.  This extension provides
2374	the ability to dynamically add and remove new addresses for the SCTP
2375	associations.
2376
2377	1: Enable extension.
2378
2379	0: Disable extension.
2380
2381	Default: 0
2382
2383pf_enable - INTEGER
2384	Enable or disable pf (pf is short for potentially failed) state. A value
2385	of pf_retrans > path_max_retrans also disables pf state. That is, one of
2386	both pf_enable and pf_retrans > path_max_retrans can disable pf state.
2387	Since pf_retrans and path_max_retrans can be changed by userspace
2388	application, sometimes user expects to disable pf state by the value of
2389	pf_retrans > path_max_retrans, but occasionally the value of pf_retrans
2390	or path_max_retrans is changed by the user application, this pf state is
2391	enabled. As such, it is necessary to add this to dynamically enable
2392	and disable pf state. See:
2393	https://datatracker.ietf.org/doc/draft-ietf-tsvwg-sctp-failover for
2394	details.
2395
2396	1: Enable pf.
2397
2398	0: Disable pf.
2399
2400	Default: 1
2401
2402pf_expose - INTEGER
2403	Unset or enable/disable pf (pf is short for potentially failed) state
2404	exposure.  Applications can control the exposure of the PF path state
2405	in the SCTP_PEER_ADDR_CHANGE event and the SCTP_GET_PEER_ADDR_INFO
2406	sockopt.   When it's unset, no SCTP_PEER_ADDR_CHANGE event with
2407	SCTP_ADDR_PF state will be sent and a SCTP_PF-state transport info
2408	can be got via SCTP_GET_PEER_ADDR_INFO sockopt;  When it's enabled,
2409	a SCTP_PEER_ADDR_CHANGE event will be sent for a transport becoming
2410	SCTP_PF state and a SCTP_PF-state transport info can be got via
2411	SCTP_GET_PEER_ADDR_INFO sockopt;  When it's diabled, no
2412	SCTP_PEER_ADDR_CHANGE event will be sent and it returns -EACCES when
2413	trying to get a SCTP_PF-state transport info via SCTP_GET_PEER_ADDR_INFO
2414	sockopt.
2415
2416	0: Unset pf state exposure, Compatible with old applications.
2417
2418	1: Disable pf state exposure.
2419
2420	2: Enable pf state exposure.
2421
2422	Default: 0
2423
2424addip_noauth_enable - BOOLEAN
2425	Dynamic Address Reconfiguration (ADD-IP) requires the use of
2426	authentication to protect the operations of adding or removing new
2427	addresses.  This requirement is mandated so that unauthorized hosts
2428	would not be able to hijack associations.  However, older
2429	implementations may not have implemented this requirement while
2430	allowing the ADD-IP extension.  For reasons of interoperability,
2431	we provide this variable to control the enforcement of the
2432	authentication requirement.
2433
2434	== ===============================================================
2435	1  Allow ADD-IP extension to be used without authentication.  This
2436	   should only be set in a closed environment for interoperability
2437	   with older implementations.
2438
2439	0  Enforce the authentication requirement
2440	== ===============================================================
2441
2442	Default: 0
2443
2444auth_enable - BOOLEAN
2445	Enable or disable Authenticated Chunks extension.  This extension
2446	provides the ability to send and receive authenticated chunks and is
2447	required for secure operation of Dynamic Address Reconfiguration
2448	(ADD-IP) extension.
2449
2450	- 1: Enable this extension.
2451	- 0: Disable this extension.
2452
2453	Default: 0
2454
2455prsctp_enable - BOOLEAN
2456	Enable or disable the Partial Reliability extension (RFC3758) which
2457	is used to notify peers that a given DATA should no longer be expected.
2458
2459	- 1: Enable extension
2460	- 0: Disable
2461
2462	Default: 1
2463
2464max_burst - INTEGER
2465	The limit of the number of new packets that can be initially sent.  It
2466	controls how bursty the generated traffic can be.
2467
2468	Default: 4
2469
2470association_max_retrans - INTEGER
2471	Set the maximum number for retransmissions that an association can
2472	attempt deciding that the remote end is unreachable.  If this value
2473	is exceeded, the association is terminated.
2474
2475	Default: 10
2476
2477max_init_retransmits - INTEGER
2478	The maximum number of retransmissions of INIT and COOKIE-ECHO chunks
2479	that an association will attempt before declaring the destination
2480	unreachable and terminating.
2481
2482	Default: 8
2483
2484path_max_retrans - INTEGER
2485	The maximum number of retransmissions that will be attempted on a given
2486	path.  Once this threshold is exceeded, the path is considered
2487	unreachable, and new traffic will use a different path when the
2488	association is multihomed.
2489
2490	Default: 5
2491
2492pf_retrans - INTEGER
2493	The number of retransmissions that will be attempted on a given path
2494	before traffic is redirected to an alternate transport (should one
2495	exist).  Note this is distinct from path_max_retrans, as a path that
2496	passes the pf_retrans threshold can still be used.  Its only
2497	deprioritized when a transmission path is selected by the stack.  This
2498	setting is primarily used to enable fast failover mechanisms without
2499	having to reduce path_max_retrans to a very low value.  See:
2500	http://www.ietf.org/id/draft-nishida-tsvwg-sctp-failover-05.txt
2501	for details.  Note also that a value of pf_retrans > path_max_retrans
2502	disables this feature. Since both pf_retrans and path_max_retrans can
2503	be changed by userspace application, a variable pf_enable is used to
2504	disable pf state.
2505
2506	Default: 0
2507
2508ps_retrans - INTEGER
2509	Primary.Switchover.Max.Retrans (PSMR), it's a tunable parameter coming
2510	from section-5 "Primary Path Switchover" in rfc7829.  The primary path
2511	will be changed to another active path when the path error counter on
2512	the old primary path exceeds PSMR, so that "the SCTP sender is allowed
2513	to continue data transmission on a new working path even when the old
2514	primary destination address becomes active again".   Note this feature
2515	is disabled by initializing 'ps_retrans' per netns as 0xffff by default,
2516	and its value can't be less than 'pf_retrans' when changing by sysctl.
2517
2518	Default: 0xffff
2519
2520rto_initial - INTEGER
2521	The initial round trip timeout value in milliseconds that will be used
2522	in calculating round trip times.  This is the initial time interval
2523	for retransmissions.
2524
2525	Default: 3000
2526
2527rto_max - INTEGER
2528	The maximum value (in milliseconds) of the round trip timeout.  This
2529	is the largest time interval that can elapse between retransmissions.
2530
2531	Default: 60000
2532
2533rto_min - INTEGER
2534	The minimum value (in milliseconds) of the round trip timeout.  This
2535	is the smallest time interval the can elapse between retransmissions.
2536
2537	Default: 1000
2538
2539hb_interval - INTEGER
2540	The interval (in milliseconds) between HEARTBEAT chunks.  These chunks
2541	are sent at the specified interval on idle paths to probe the state of
2542	a given path between 2 associations.
2543
2544	Default: 30000
2545
2546sack_timeout - INTEGER
2547	The amount of time (in milliseconds) that the implementation will wait
2548	to send a SACK.
2549
2550	Default: 200
2551
2552valid_cookie_life - INTEGER
2553	The default lifetime of the SCTP cookie (in milliseconds).  The cookie
2554	is used during association establishment.
2555
2556	Default: 60000
2557
2558cookie_preserve_enable - BOOLEAN
2559	Enable or disable the ability to extend the lifetime of the SCTP cookie
2560	that is used during the establishment phase of SCTP association
2561
2562	- 1: Enable cookie lifetime extension.
2563	- 0: Disable
2564
2565	Default: 1
2566
2567cookie_hmac_alg - STRING
2568	Select the hmac algorithm used when generating the cookie value sent by
2569	a listening sctp socket to a connecting client in the INIT-ACK chunk.
2570	Valid values are:
2571
2572	* md5
2573	* sha1
2574	* none
2575
2576	Ability to assign md5 or sha1 as the selected alg is predicated on the
2577	configuration of those algorithms at build time (CONFIG_CRYPTO_MD5 and
2578	CONFIG_CRYPTO_SHA1).
2579
2580	Default: Dependent on configuration.  MD5 if available, else SHA1 if
2581	available, else none.
2582
2583rcvbuf_policy - INTEGER
2584	Determines if the receive buffer is attributed to the socket or to
2585	association.   SCTP supports the capability to create multiple
2586	associations on a single socket.  When using this capability, it is
2587	possible that a single stalled association that's buffering a lot
2588	of data may block other associations from delivering their data by
2589	consuming all of the receive buffer space.  To work around this,
2590	the rcvbuf_policy could be set to attribute the receiver buffer space
2591	to each association instead of the socket.  This prevents the described
2592	blocking.
2593
2594	- 1: rcvbuf space is per association
2595	- 0: rcvbuf space is per socket
2596
2597	Default: 0
2598
2599sndbuf_policy - INTEGER
2600	Similar to rcvbuf_policy above, this applies to send buffer space.
2601
2602	- 1: Send buffer is tracked per association
2603	- 0: Send buffer is tracked per socket.
2604
2605	Default: 0
2606
2607sctp_mem - vector of 3 INTEGERs: min, pressure, max
2608	Number of pages allowed for queueing by all SCTP sockets.
2609
2610	min: Below this number of pages SCTP is not bothered about its
2611	memory appetite. When amount of memory allocated by SCTP exceeds
2612	this number, SCTP starts to moderate memory usage.
2613
2614	pressure: This value was introduced to follow format of tcp_mem.
2615
2616	max: Number of pages allowed for queueing by all SCTP sockets.
2617
2618	Default is calculated at boot time from amount of available memory.
2619
2620sctp_rmem - vector of 3 INTEGERs: min, default, max
2621	Only the first value ("min") is used, "default" and "max" are
2622	ignored.
2623
2624	min: Minimal size of receive buffer used by SCTP socket.
2625	It is guaranteed to each SCTP socket (but not association) even
2626	under moderate memory pressure.
2627
2628	Default: 4K
2629
2630sctp_wmem  - vector of 3 INTEGERs: min, default, max
2631	Currently this tunable has no effect.
2632
2633addr_scope_policy - INTEGER
2634	Control IPv4 address scoping - draft-stewart-tsvwg-sctp-ipv4-00
2635
2636	- 0   - Disable IPv4 address scoping
2637	- 1   - Enable IPv4 address scoping
2638	- 2   - Follow draft but allow IPv4 private addresses
2639	- 3   - Follow draft but allow IPv4 link local addresses
2640
2641	Default: 1
2642
2643
2644``/proc/sys/net/core/*``
2645========================
2646
2647	Please see: Documentation/admin-guide/sysctl/net.rst for descriptions of these entries.
2648
2649
2650``/proc/sys/net/unix/*``
2651========================
2652
2653max_dgram_qlen - INTEGER
2654	The maximum length of dgram socket receive queue
2655
2656	Default: 10
2657
2658