1.. SPDX-License-Identifier: GPL-2.0
2
3===================================
4Netfilter Conntrack Sysfs variables
5===================================
6
7/proc/sys/net/netfilter/nf_conntrack_* Variables:
8=================================================
9
10nf_conntrack_acct - BOOLEAN
11	- 0 - disabled (default)
12	- not 0 - enabled
13
14	Enable connection tracking flow accounting. 64-bit byte and packet
15	counters per flow are added.
16
17nf_conntrack_buckets - INTEGER
18	Size of hash table. If not specified as parameter during module
19	loading, the default size is calculated by dividing total memory
20	by 16384 to determine the number of buckets but the hash table will
21	never have fewer than 32 and limited to 16384 buckets. For systems
22	with more than 4GB of memory it will be 65536 buckets.
23	This sysctl is only writeable in the initial net namespace.
24
25nf_conntrack_checksum - BOOLEAN
26	- 0 - disabled
27	- not 0 - enabled (default)
28
29	Verify checksum of incoming packets. Packets with bad checksums are
30	in INVALID state. If this is enabled, such packets will not be
31	considered for connection tracking.
32
33nf_conntrack_count - INTEGER (read-only)
34	Number of currently allocated flow entries.
35
36nf_conntrack_events - BOOLEAN
37	- 0 - disabled
38	- not 0 - enabled (default)
39
40	If this option is enabled, the connection tracking code will
41	provide userspace with connection tracking events via ctnetlink.
42
43nf_conntrack_expect_max - INTEGER
44	Maximum size of expectation table.  Default value is
45	nf_conntrack_buckets / 256. Minimum is 1.
46
47nf_conntrack_frag6_high_thresh - INTEGER
48	default 262144
49
50	Maximum memory used to reassemble IPv6 fragments.  When
51	nf_conntrack_frag6_high_thresh bytes of memory is allocated for this
52	purpose, the fragment handler will toss packets until
53	nf_conntrack_frag6_low_thresh is reached.
54
55nf_conntrack_frag6_low_thresh - INTEGER
56	default 196608
57
58	See nf_conntrack_frag6_low_thresh
59
60nf_conntrack_frag6_timeout - INTEGER (seconds)
61	default 60
62
63	Time to keep an IPv6 fragment in memory.
64
65nf_conntrack_generic_timeout - INTEGER (seconds)
66	default 600
67
68	Default for generic timeout.  This refers to layer 4 unknown/unsupported
69	protocols.
70
71nf_conntrack_helper - BOOLEAN
72	- 0 - disabled (default)
73	- not 0 - enabled
74
75	Enable automatic conntrack helper assignment.
76	If disabled it is required to set up iptables rules to assign
77	helpers to connections.  See the CT target description in the
78	iptables-extensions(8) man page for further information.
79
80nf_conntrack_icmp_timeout - INTEGER (seconds)
81	default 30
82
83	Default for ICMP timeout.
84
85nf_conntrack_icmpv6_timeout - INTEGER (seconds)
86	default 30
87
88	Default for ICMP6 timeout.
89
90nf_conntrack_log_invalid - INTEGER
91	- 0   - disable (default)
92	- 1   - log ICMP packets
93	- 6   - log TCP packets
94	- 17  - log UDP packets
95	- 33  - log DCCP packets
96	- 41  - log ICMPv6 packets
97	- 136 - log UDPLITE packets
98	- 255 - log packets of any protocol
99
100	Log invalid packets of a type specified by value.
101
102nf_conntrack_max - INTEGER
103	Size of connection tracking table.  Default value is
104	nf_conntrack_buckets value * 4.
105
106nf_conntrack_tcp_be_liberal - BOOLEAN
107	- 0 - disabled (default)
108	- not 0 - enabled
109
110	Be conservative in what you do, be liberal in what you accept from others.
111	If it's non-zero, we mark only out of window RST segments as INVALID.
112
113nf_conntrack_tcp_loose - BOOLEAN
114	- 0 - disabled
115	- not 0 - enabled (default)
116
117	If it is set to zero, we disable picking up already established
118	connections.
119
120nf_conntrack_tcp_max_retrans - INTEGER
121	default 3
122
123	Maximum number of packets that can be retransmitted without
124	received an (acceptable) ACK from the destination. If this number
125	is reached, a shorter timer will be started.
126
127nf_conntrack_tcp_timeout_close - INTEGER (seconds)
128	default 10
129
130nf_conntrack_tcp_timeout_close_wait - INTEGER (seconds)
131	default 60
132
133nf_conntrack_tcp_timeout_established - INTEGER (seconds)
134	default 432000 (5 days)
135
136nf_conntrack_tcp_timeout_fin_wait - INTEGER (seconds)
137	default 120
138
139nf_conntrack_tcp_timeout_last_ack - INTEGER (seconds)
140	default 30
141
142nf_conntrack_tcp_timeout_max_retrans - INTEGER (seconds)
143	default 300
144
145nf_conntrack_tcp_timeout_syn_recv - INTEGER (seconds)
146	default 60
147
148nf_conntrack_tcp_timeout_syn_sent - INTEGER (seconds)
149	default 120
150
151nf_conntrack_tcp_timeout_time_wait - INTEGER (seconds)
152	default 120
153
154nf_conntrack_tcp_timeout_unacknowledged - INTEGER (seconds)
155	default 300
156
157nf_conntrack_timestamp - BOOLEAN
158	- 0 - disabled (default)
159	- not 0 - enabled
160
161	Enable connection tracking flow timestamping.
162
163nf_conntrack_udp_timeout - INTEGER (seconds)
164	default 30
165
166nf_conntrack_udp_timeout_stream - INTEGER (seconds)
167	default 120
168
169	This extended timeout will be used in case there is an UDP stream
170	detected.
171
172nf_conntrack_gre_timeout - INTEGER (seconds)
173	default 30
174
175nf_conntrack_gre_timeout_stream - INTEGER (seconds)
176	default 180
177
178	This extended timeout will be used in case there is an GRE stream
179	detected.
180