11da177e4SLinus Torvalds# 21da177e4SLinus Torvalds# Network configuration 31da177e4SLinus Torvalds# 41da177e4SLinus Torvalds 5031cf19eSRobert P. J. Daymenuconfig NET 61da177e4SLinus Torvalds bool "Networking support" 7e9cc8bddSGeert Uytterhoeven select NLATTR 81da177e4SLinus Torvalds ---help--- 91da177e4SLinus Torvalds Unless you really know what you are doing, you should say Y here. 101da177e4SLinus Torvalds The reason is that some programs need kernel networking support even 111da177e4SLinus Torvalds when running on a stand-alone machine that isn't connected to any 12d5950b43SSam Ravnborg other computer. 13d5950b43SSam Ravnborg 14d5950b43SSam Ravnborg If you are upgrading from an older kernel, you 151da177e4SLinus Torvalds should consider updating your networking tools too because changes 161da177e4SLinus Torvalds in the kernel and the tools often go hand in hand. The tools are 171da177e4SLinus Torvalds contained in the package net-tools, the location and version number 181da177e4SLinus Torvalds of which are given in <file:Documentation/Changes>. 191da177e4SLinus Torvalds 201da177e4SLinus Torvalds For a general introduction to Linux networking, it is highly 211da177e4SLinus Torvalds recommended to read the NET-HOWTO, available from 221da177e4SLinus Torvalds <http://www.tldp.org/docs.html#howto>. 231da177e4SLinus Torvalds 246a2e9b73SSam Ravnborgif NET 256a2e9b73SSam Ravnborg 261dacc76dSJohannes Bergconfig WANT_COMPAT_NETLINK_MESSAGES 271dacc76dSJohannes Berg bool 281dacc76dSJohannes Berg help 291dacc76dSJohannes Berg This option can be selected by other options that need compat 301dacc76dSJohannes Berg netlink messages. 311dacc76dSJohannes Berg 321dacc76dSJohannes Bergconfig COMPAT_NETLINK_MESSAGES 331dacc76dSJohannes Berg def_bool y 341dacc76dSJohannes Berg depends on COMPAT 3540b53d8aSDavid S. Miller depends on WEXT_CORE || WANT_COMPAT_NETLINK_MESSAGES 361dacc76dSJohannes Berg help 371dacc76dSJohannes Berg This option makes it possible to send different netlink messages 381dacc76dSJohannes Berg to tasks depending on whether the task is a compat task or not. To 391dacc76dSJohannes Berg achieve this, you need to set skb_shinfo(skb)->frag_list to the 401dacc76dSJohannes Berg compat skb before sending the skb, the netlink code will sort out 411dacc76dSJohannes Berg which message to actually pass to the task. 421dacc76dSJohannes Berg 431dacc76dSJohannes Berg Newly written code should NEVER need this option but do 441dacc76dSJohannes Berg compat-independent messages instead! 451dacc76dSJohannes Berg 461da177e4SLinus Torvaldsmenu "Networking options" 471da177e4SLinus Torvalds 486a2e9b73SSam Ravnborgsource "net/packet/Kconfig" 496a2e9b73SSam Ravnborgsource "net/unix/Kconfig" 506a2e9b73SSam Ravnborgsource "net/xfrm/Kconfig" 512356f4cbSMartin Schwidefskysource "net/iucv/Kconfig" 521da177e4SLinus Torvalds 531da177e4SLinus Torvaldsconfig INET 541da177e4SLinus Torvalds bool "TCP/IP networking" 551da177e4SLinus Torvalds ---help--- 561da177e4SLinus Torvalds These are the protocols used on the Internet and on most local 571da177e4SLinus Torvalds Ethernets. It is highly recommended to say Y here (this will enlarge 58cf80efc2SYOSHIFUJI Hideaki your kernel by about 400 KB), since some programs (e.g. the X window 591da177e4SLinus Torvalds system) use TCP/IP even if your machine is not connected to any 601da177e4SLinus Torvalds other computer. You will get the so-called loopback device which 611da177e4SLinus Torvalds allows you to ping yourself (great fun, that!). 621da177e4SLinus Torvalds 631da177e4SLinus Torvalds For an excellent introduction to Linux networking, please read the 641da177e4SLinus Torvalds Linux Networking HOWTO, available from 651da177e4SLinus Torvalds <http://www.tldp.org/docs.html#howto>. 661da177e4SLinus Torvalds 671da177e4SLinus Torvalds If you say Y here and also to "/proc file system support" and 681da177e4SLinus Torvalds "Sysctl support" below, you can change various aspects of the 691da177e4SLinus Torvalds behavior of the TCP/IP code by writing to the (virtual) files in 701da177e4SLinus Torvalds /proc/sys/net/ipv4/*; the options are explained in the file 711da177e4SLinus Torvalds <file:Documentation/networking/ip-sysctl.txt>. 721da177e4SLinus Torvalds 731da177e4SLinus Torvalds Short answer: say Y. 741da177e4SLinus Torvalds 756a2e9b73SSam Ravnborgif INET 761da177e4SLinus Torvaldssource "net/ipv4/Kconfig" 771da177e4SLinus Torvaldssource "net/ipv6/Kconfig" 7838c94377SPaul Mooresource "net/netlabel/Kconfig" 791da177e4SLinus Torvalds 806a2e9b73SSam Ravnborgendif # if INET 816a2e9b73SSam Ravnborg 82984bc16cSJames Morrisconfig NETWORK_SECMARK 83984bc16cSJames Morris bool "Security Marking" 84984bc16cSJames Morris help 85984bc16cSJames Morris This enables security marking of network packets, similar 86984bc16cSJames Morris to nfmark, but designated for security purposes. 87984bc16cSJames Morris If you are unsure how to answer this question, answer N. 88984bc16cSJames Morris 89c1f19b51SRichard Cochranconfig NETWORK_PHY_TIMESTAMPING 90c1f19b51SRichard Cochran bool "Timestamping in PHY devices" 91c1f19b51SRichard Cochran depends on EXPERIMENTAL 92c1f19b51SRichard Cochran help 93c1f19b51SRichard Cochran This allows timestamping of network packets by PHYs with 94c1f19b51SRichard Cochran hardware timestamping capabilities. This option adds some 95c1f19b51SRichard Cochran overhead in the transmit and receive paths. 96c1f19b51SRichard Cochran 97c1f19b51SRichard Cochran If you are unsure how to answer this question, answer N. 98c1f19b51SRichard Cochran 991da177e4SLinus Torvaldsmenuconfig NETFILTER 100ef91fd52SPablo Neira Ayuso bool "Network packet filtering framework (Netfilter)" 1011da177e4SLinus Torvalds ---help--- 1021da177e4SLinus Torvalds Netfilter is a framework for filtering and mangling network packets 1031da177e4SLinus Torvalds that pass through your Linux box. 1041da177e4SLinus Torvalds 1051da177e4SLinus Torvalds The most common use of packet filtering is to run your Linux box as 1061da177e4SLinus Torvalds a firewall protecting a local network from the Internet. The type of 1071da177e4SLinus Torvalds firewall provided by this kernel support is called a "packet 1081da177e4SLinus Torvalds filter", which means that it can reject individual network packets 1091da177e4SLinus Torvalds based on type, source, destination etc. The other kind of firewall, 1101da177e4SLinus Torvalds a "proxy-based" one, is more secure but more intrusive and more 1111da177e4SLinus Torvalds bothersome to set up; it inspects the network traffic much more 1121da177e4SLinus Torvalds closely, modifies it and has knowledge about the higher level 1131da177e4SLinus Torvalds protocols, which a packet filter lacks. Moreover, proxy-based 1141da177e4SLinus Torvalds firewalls often require changes to the programs running on the local 1151da177e4SLinus Torvalds clients. Proxy-based firewalls don't need support by the kernel, but 1161da177e4SLinus Torvalds they are often combined with a packet filter, which only works if 1171da177e4SLinus Torvalds you say Y here. 1181da177e4SLinus Torvalds 1191da177e4SLinus Torvalds You should also say Y here if you intend to use your Linux box as 1201da177e4SLinus Torvalds the gateway to the Internet for a local network of machines without 1211da177e4SLinus Torvalds globally valid IP addresses. This is called "masquerading": if one 1221da177e4SLinus Torvalds of the computers on your local network wants to send something to 1231da177e4SLinus Torvalds the outside, your box can "masquerade" as that computer, i.e. it 1241da177e4SLinus Torvalds forwards the traffic to the intended outside destination, but 1251da177e4SLinus Torvalds modifies the packets to make it look like they came from the 1261da177e4SLinus Torvalds firewall box itself. It works both ways: if the outside host 1271da177e4SLinus Torvalds replies, the Linux box will silently forward the traffic to the 1281da177e4SLinus Torvalds correct local computer. This way, the computers on your local net 1291da177e4SLinus Torvalds are completely invisible to the outside world, even though they can 1301da177e4SLinus Torvalds reach the outside and can receive replies. It is even possible to 1311da177e4SLinus Torvalds run globally visible servers from within a masqueraded local network 1321da177e4SLinus Torvalds using a mechanism called portforwarding. Masquerading is also often 1331da177e4SLinus Torvalds called NAT (Network Address Translation). 1341da177e4SLinus Torvalds 1351da177e4SLinus Torvalds Another use of Netfilter is in transparent proxying: if a machine on 1361da177e4SLinus Torvalds the local network tries to connect to an outside host, your Linux 1371da177e4SLinus Torvalds box can transparently forward the traffic to a local server, 1381da177e4SLinus Torvalds typically a caching proxy server. 1391da177e4SLinus Torvalds 1401da177e4SLinus Torvalds Yet another use of Netfilter is building a bridging firewall. Using 1411da177e4SLinus Torvalds a bridge with Network packet filtering enabled makes iptables "see" 1421da177e4SLinus Torvalds the bridged traffic. For filtering on the lower network and Ethernet 1431da177e4SLinus Torvalds protocols over the bridge, use ebtables (under bridge netfilter 1441da177e4SLinus Torvalds configuration). 1451da177e4SLinus Torvalds 1461da177e4SLinus Torvalds Various modules exist for netfilter which replace the previous 1471da177e4SLinus Torvalds masquerading (ipmasqadm), packet filtering (ipchains), transparent 1481da177e4SLinus Torvalds proxying, and portforwarding mechanisms. Please see 1491da177e4SLinus Torvalds <file:Documentation/Changes> under "iptables" for the location of 1501da177e4SLinus Torvalds these packages. 1511da177e4SLinus Torvalds 1521da177e4SLinus Torvaldsif NETFILTER 1531da177e4SLinus Torvalds 1541da177e4SLinus Torvaldsconfig NETFILTER_DEBUG 1551da177e4SLinus Torvalds bool "Network packet filtering debugging" 1561da177e4SLinus Torvalds depends on NETFILTER 1571da177e4SLinus Torvalds help 1581da177e4SLinus Torvalds You can say Y here if you want to get additional messages useful in 1591da177e4SLinus Torvalds debugging the netfilter code. 1601da177e4SLinus Torvalds 16133b8e776SPatrick McHardyconfig NETFILTER_ADVANCED 16233b8e776SPatrick McHardy bool "Advanced netfilter configuration" 16333b8e776SPatrick McHardy depends on NETFILTER 16433b8e776SPatrick McHardy default y 16533b8e776SPatrick McHardy help 16633b8e776SPatrick McHardy If you say Y here you can select between all the netfilter modules. 167692105b8SMatt LaPlante If you say N the more unusual ones will not be shown and the 16833b8e776SPatrick McHardy basic ones needed by most people will default to 'M'. 16933b8e776SPatrick McHardy 17033b8e776SPatrick McHardy If unsure, say Y. 17133b8e776SPatrick McHardy 1721da177e4SLinus Torvaldsconfig BRIDGE_NETFILTER 1731da177e4SLinus Torvalds bool "Bridged IP/ARP packets filtering" 1741da177e4SLinus Torvalds depends on BRIDGE && NETFILTER && INET 17533b8e776SPatrick McHardy depends on NETFILTER_ADVANCED 1761da177e4SLinus Torvalds default y 1771da177e4SLinus Torvalds ---help--- 1781da177e4SLinus Torvalds Enabling this option will let arptables resp. iptables see bridged 1791da177e4SLinus Torvalds ARP resp. IP traffic. If you want a bridging firewall, you probably 1801da177e4SLinus Torvalds want this option enabled. 1811da177e4SLinus Torvalds Enabling or disabling this option doesn't enable or disable 1821da177e4SLinus Torvalds ebtables. 1831da177e4SLinus Torvalds 1841da177e4SLinus Torvalds If unsure, say N. 1851da177e4SLinus Torvalds 1869eb0eec7SHarald Weltesource "net/netfilter/Kconfig" 1871da177e4SLinus Torvaldssource "net/ipv4/netfilter/Kconfig" 1881da177e4SLinus Torvaldssource "net/ipv6/netfilter/Kconfig" 1891da177e4SLinus Torvaldssource "net/decnet/netfilter/Kconfig" 1901da177e4SLinus Torvaldssource "net/bridge/netfilter/Kconfig" 1911da177e4SLinus Torvalds 1921da177e4SLinus Torvaldsendif 1931da177e4SLinus Torvalds 1947c657876SArnaldo Carvalho de Melosource "net/dccp/Kconfig" 1951da177e4SLinus Torvaldssource "net/sctp/Kconfig" 196fe17f84fSAndy Groversource "net/rds/Kconfig" 1971e63e681SPer Lidensource "net/tipc/Kconfig" 1986a2e9b73SSam Ravnborgsource "net/atm/Kconfig" 199fd558d18SJames Chapmansource "net/l2tp/Kconfig" 200a19800d7SPatrick McHardysource "net/802/Kconfig" 2016a2e9b73SSam Ravnborgsource "net/bridge/Kconfig" 20291da11f8SLennert Buytenheksource "net/dsa/Kconfig" 2036a2e9b73SSam Ravnborgsource "net/8021q/Kconfig" 2041da177e4SLinus Torvaldssource "net/decnet/Kconfig" 2051da177e4SLinus Torvaldssource "net/llc/Kconfig" 2061da177e4SLinus Torvaldssource "net/ipx/Kconfig" 2071da177e4SLinus Torvaldssource "drivers/net/appletalk/Kconfig" 2086a2e9b73SSam Ravnborgsource "net/x25/Kconfig" 2096a2e9b73SSam Ravnborgsource "net/lapb/Kconfig" 2106a2e9b73SSam Ravnborgsource "net/econet/Kconfig" 2116a2e9b73SSam Ravnborgsource "net/wanrouter/Kconfig" 2125075138dSremi.denis-courmont@nokiasource "net/phonet/Kconfig" 2139ec76716SSergey Lapinsource "net/ieee802154/Kconfig" 2141da177e4SLinus Torvaldssource "net/sched/Kconfig" 2152f90b865SAlexander Duycksource "net/dcb/Kconfig" 2161a4240f4SWang Leisource "net/dns_resolver/Kconfig" 217c6c8fea2SSven Eckelmannsource "net/batman-adv/Kconfig" 2181da177e4SLinus Torvalds 219df334545SEric Dumazetconfig RPS 220df334545SEric Dumazet boolean 2216dcbc122SDavid S. Miller depends on SMP && SYSFS && USE_GENERIC_SMP_HELPERS 222df334545SEric Dumazet default y 223df334545SEric Dumazet 224c445477dSBen Hutchingsconfig RFS_ACCEL 225c445477dSBen Hutchings boolean 226c445477dSBen Hutchings depends on RPS && GENERIC_HARDIRQS 227c445477dSBen Hutchings select CPU_RMAP 228c445477dSBen Hutchings default y 229c445477dSBen Hutchings 230bf264145STom Herbertconfig XPS 231bf264145STom Herbert boolean 232bf264145STom Herbert depends on SMP && SYSFS && USE_GENERIC_SMP_HELPERS 233bf264145STom Herbert default y 234bf264145STom Herbert 2350a14842fSEric Dumazetconfig HAVE_BPF_JIT 2360a14842fSEric Dumazet bool 2370a14842fSEric Dumazet 2380a14842fSEric Dumazetconfig BPF_JIT 2390a14842fSEric Dumazet bool "enable BPF Just In Time compiler" 2400a14842fSEric Dumazet depends on HAVE_BPF_JIT 2410a14842fSEric Dumazet ---help--- 2420a14842fSEric Dumazet Berkeley Packet Filter filtering capabilities are normally handled 2430a14842fSEric Dumazet by an interpreter. This option allows kernel to generate a native 2440a14842fSEric Dumazet code when filter is loaded in memory. This should speedup 2450a14842fSEric Dumazet packet sniffing (libpcap/tcpdump). Note : Admin should enable 2460a14842fSEric Dumazet this feature changing /proc/sys/net/core/bpf_jit_enable 2470a14842fSEric Dumazet 2481da177e4SLinus Torvaldsmenu "Network testing" 2491da177e4SLinus Torvalds 2501da177e4SLinus Torvaldsconfig NET_PKTGEN 2511da177e4SLinus Torvalds tristate "Packet Generator (USE WITH CAUTION)" 2521da177e4SLinus Torvalds depends on PROC_FS 2531da177e4SLinus Torvalds ---help--- 2541da177e4SLinus Torvalds This module will inject preconfigured packets, at a configurable 2551da177e4SLinus Torvalds rate, out of a given interface. It is used for network interface 2561da177e4SLinus Torvalds stress testing and performance analysis. If you don't understand 2571da177e4SLinus Torvalds what was just said, you don't need it: say N. 2581da177e4SLinus Torvalds 2591da177e4SLinus Torvalds Documentation on how to use the packet generator can be found 2601da177e4SLinus Torvalds at <file:Documentation/networking/pktgen.txt>. 2611da177e4SLinus Torvalds 2621da177e4SLinus Torvalds To compile this code as a module, choose M here: the 2631da177e4SLinus Torvalds module will be called pktgen. 2641da177e4SLinus Torvalds 265a42e9d6cSStephen Hemmingerconfig NET_TCPPROBE 266a42e9d6cSStephen Hemminger tristate "TCP connection probing" 267a42e9d6cSStephen Hemminger depends on INET && EXPERIMENTAL && PROC_FS && KPROBES 268a42e9d6cSStephen Hemminger ---help--- 269a42e9d6cSStephen Hemminger This module allows for capturing the changes to TCP connection 2709dadaa19SDave Jones state in response to incoming packets. It is used for debugging 271a42e9d6cSStephen Hemminger TCP congestion avoidance modules. If you don't understand 272a42e9d6cSStephen Hemminger what was just said, you don't need it: say N. 273a42e9d6cSStephen Hemminger 27482fe7c92SGrant Grundler Documentation on how to use TCP connection probing can be found 275c996d8b9SMichael Witten at: 276c996d8b9SMichael Witten 277c996d8b9SMichael Witten http://www.linuxfoundation.org/collaborate/workgroups/networking/tcpprobe 278a42e9d6cSStephen Hemminger 279a42e9d6cSStephen Hemminger To compile this code as a module, choose M here: the 280a42e9d6cSStephen Hemminger module will be called tcp_probe. 281a42e9d6cSStephen Hemminger 282273ae44bSNeil Hormanconfig NET_DROP_MONITOR 283273ae44bSNeil Horman boolean "Network packet drop alerting service" 284273ae44bSNeil Horman depends on INET && EXPERIMENTAL && TRACEPOINTS 285273ae44bSNeil Horman ---help--- 286273ae44bSNeil Horman This feature provides an alerting service to userspace in the 287273ae44bSNeil Horman event that packets are discarded in the network stack. Alerts 288273ae44bSNeil Horman are broadcast via netlink socket to any listening user space 289273ae44bSNeil Horman process. If you don't need network drop alerts, or if you are ok 290273ae44bSNeil Horman just checking the various proc files and other utilities for 291273ae44bSNeil Horman drop statistics, say N here. 292273ae44bSNeil Horman 2931da177e4SLinus Torvaldsendmenu 2941da177e4SLinus Torvalds 2951da177e4SLinus Torvaldsendmenu 2961da177e4SLinus Torvalds 2971da177e4SLinus Torvaldssource "net/ax25/Kconfig" 2980d66548aSOliver Hartkoppsource "net/can/Kconfig" 2991da177e4SLinus Torvaldssource "net/irda/Kconfig" 3001da177e4SLinus Torvaldssource "net/bluetooth/Kconfig" 30117926a79SDavid Howellssource "net/rxrpc/Kconfig" 302d86b5e0eSAdrian Bunk 30314c0b97dSThomas Grafconfig FIB_RULES 30414c0b97dSThomas Graf bool 30514c0b97dSThomas Graf 3065442060cSRobert P. J. Daymenuconfig WIRELESS 3075442060cSRobert P. J. Day bool "Wireless" 308f54bfc0eSMartin Schwidefsky depends on !S390 3095442060cSRobert P. J. Day default y 3105442060cSRobert P. J. Day 3115442060cSRobert P. J. Dayif WIRELESS 3122a5e1c0eSJohannes Berg 3132a5e1c0eSJohannes Bergsource "net/wireless/Kconfig" 314f0706e82SJiri Bencsource "net/mac80211/Kconfig" 3152a5e1c0eSJohannes Berg 3165442060cSRobert P. J. Dayendif # WIRELESS 3172a5e1c0eSJohannes Berg 318b0c83ae1SInaky Perez-Gonzalezsource "net/wimax/Kconfig" 319b0c83ae1SInaky Perez-Gonzalez 320cf4328cdSIvo van Doornsource "net/rfkill/Kconfig" 321bd238fb4SLatchesar Ionkovsource "net/9p/Kconfig" 3223908c690SSjur Braendelandsource "net/caif/Kconfig" 3233d14c5d2SYehuda Sadehsource "net/ceph/Kconfig" 3243908c690SSjur Braendeland 325cf4328cdSIvo van Doorn 3266a2e9b73SSam Ravnborgendif # if NET 327