1.. SPDX-License-Identifier: GPL-2.0
2
3===================================
4Netfilter Conntrack Sysfs variables
5===================================
6
7/proc/sys/net/netfilter/nf_conntrack_* Variables:
8=================================================
9
10nf_conntrack_acct - BOOLEAN
11	- 0 - disabled (default)
12	- not 0 - enabled
13
14	Enable connection tracking flow accounting. 64-bit byte and packet
15	counters per flow are added.
16
17nf_conntrack_buckets - INTEGER
18	Size of hash table. If not specified as parameter during module
19	loading, the default size is calculated by dividing total memory
20	by 16384 to determine the number of buckets but the hash table will
21	never have fewer than 32 and limited to 16384 buckets. For systems
22	with more than 4GB of memory it will be 65536 buckets.
23	This sysctl is only writeable in the initial net namespace.
24
25nf_conntrack_checksum - BOOLEAN
26	- 0 - disabled
27	- not 0 - enabled (default)
28
29	Verify checksum of incoming packets. Packets with bad checksums are
30	in INVALID state. If this is enabled, such packets will not be
31	considered for connection tracking.
32
33nf_conntrack_count - INTEGER (read-only)
34	Number of currently allocated flow entries.
35
36nf_conntrack_events - BOOLEAN
37	- 0 - disabled
38	- not 0 - enabled (default)
39
40	If this option is enabled, the connection tracking code will
41	provide userspace with connection tracking events via ctnetlink.
42
43nf_conntrack_expect_max - INTEGER
44	Maximum size of expectation table.  Default value is
45	nf_conntrack_buckets / 256. Minimum is 1.
46
47nf_conntrack_frag6_high_thresh - INTEGER
48	default 262144
49
50	Maximum memory used to reassemble IPv6 fragments.  When
51	nf_conntrack_frag6_high_thresh bytes of memory is allocated for this
52	purpose, the fragment handler will toss packets until
53	nf_conntrack_frag6_low_thresh is reached.
54
55nf_conntrack_frag6_low_thresh - INTEGER
56	default 196608
57
58	See nf_conntrack_frag6_low_thresh
59
60nf_conntrack_frag6_timeout - INTEGER (seconds)
61	default 60
62
63	Time to keep an IPv6 fragment in memory.
64
65nf_conntrack_generic_timeout - INTEGER (seconds)
66	default 600
67
68	Default for generic timeout.  This refers to layer 4 unknown/unsupported
69	protocols.
70
71nf_conntrack_helper - BOOLEAN
72	- 0 - disabled (default)
73	- not 0 - enabled
74
75	Enable automatic conntrack helper assignment.
76	If disabled it is required to set up iptables rules to assign
77	helpers to connections.  See the CT target description in the
78	iptables-extensions(8) man page for further information.
79
80nf_conntrack_icmp_timeout - INTEGER (seconds)
81	default 30
82
83	Default for ICMP timeout.
84
85nf_conntrack_icmpv6_timeout - INTEGER (seconds)
86	default 30
87
88	Default for ICMP6 timeout.
89
90nf_conntrack_log_invalid - INTEGER
91	- 0   - disable (default)
92	- 1   - log ICMP packets
93	- 6   - log TCP packets
94	- 17  - log UDP packets
95	- 33  - log DCCP packets
96	- 41  - log ICMPv6 packets
97	- 136 - log UDPLITE packets
98	- 255 - log packets of any protocol
99
100	Log invalid packets of a type specified by value.
101
102nf_conntrack_max - INTEGER
103	Size of connection tracking table.  Default value is
104	nf_conntrack_buckets value * 4.
105
106nf_conntrack_tcp_be_liberal - BOOLEAN
107	- 0 - disabled (default)
108	- not 0 - enabled
109
110	Be conservative in what you do, be liberal in what you accept from others.
111	If it's non-zero, we mark only out of window RST segments as INVALID.
112
113nf_conntrack_tcp_ignore_invalid_rst - BOOLEAN
114	- 0 - disabled (default)
115	- 1 - enabled
116
117	If it's 1, we don't mark out of window RST segments as INVALID.
118
119nf_conntrack_tcp_loose - BOOLEAN
120	- 0 - disabled
121	- not 0 - enabled (default)
122
123	If it is set to zero, we disable picking up already established
124	connections.
125
126nf_conntrack_tcp_max_retrans - INTEGER
127	default 3
128
129	Maximum number of packets that can be retransmitted without
130	received an (acceptable) ACK from the destination. If this number
131	is reached, a shorter timer will be started.
132
133nf_conntrack_tcp_timeout_close - INTEGER (seconds)
134	default 10
135
136nf_conntrack_tcp_timeout_close_wait - INTEGER (seconds)
137	default 60
138
139nf_conntrack_tcp_timeout_established - INTEGER (seconds)
140	default 432000 (5 days)
141
142nf_conntrack_tcp_timeout_fin_wait - INTEGER (seconds)
143	default 120
144
145nf_conntrack_tcp_timeout_last_ack - INTEGER (seconds)
146	default 30
147
148nf_conntrack_tcp_timeout_max_retrans - INTEGER (seconds)
149	default 300
150
151nf_conntrack_tcp_timeout_syn_recv - INTEGER (seconds)
152	default 60
153
154nf_conntrack_tcp_timeout_syn_sent - INTEGER (seconds)
155	default 120
156
157nf_conntrack_tcp_timeout_time_wait - INTEGER (seconds)
158	default 120
159
160nf_conntrack_tcp_timeout_unacknowledged - INTEGER (seconds)
161	default 300
162
163nf_conntrack_timestamp - BOOLEAN
164	- 0 - disabled (default)
165	- not 0 - enabled
166
167	Enable connection tracking flow timestamping.
168
169nf_conntrack_udp_timeout - INTEGER (seconds)
170	default 30
171
172nf_conntrack_udp_timeout_stream - INTEGER (seconds)
173	default 120
174
175	This extended timeout will be used in case there is an UDP stream
176	detected.
177
178nf_conntrack_gre_timeout - INTEGER (seconds)
179	default 30
180
181nf_conntrack_gre_timeout_stream - INTEGER (seconds)
182	default 180
183
184	This extended timeout will be used in case there is an GRE stream
185	detected.
186
187nf_flowtable_tcp_timeout - INTEGER (seconds)
188        default 30
189
190        Control offload timeout for tcp connections.
191        TCP connections may be offloaded from nf conntrack to nf flow table.
192        Once aged, the connection is returned to nf conntrack with tcp pickup timeout.
193
194nf_flowtable_tcp_pickup - INTEGER (seconds)
195        default 120
196
197        TCP connection timeout after being aged from nf flow table offload.
198
199nf_flowtable_udp_timeout - INTEGER (seconds)
200        default 30
201
202        Control offload timeout for udp connections.
203        UDP connections may be offloaded from nf conntrack to nf flow table.
204        Once aged, the connection is returned to nf conntrack with udp pickup timeout.
205
206nf_flowtable_udp_pickup - INTEGER (seconds)
207        default 30
208
209        UDP connection timeout after being aged from nf flow table offload.
210