11da177e4SLinus Torvalds# 21da177e4SLinus Torvalds# Network configuration 31da177e4SLinus Torvalds# 41da177e4SLinus Torvalds 5d5950b43SSam Ravnborgmenu "Networking" 61da177e4SLinus Torvalds 71da177e4SLinus Torvaldsconfig NET 81da177e4SLinus Torvalds bool "Networking support" 91da177e4SLinus Torvalds ---help--- 101da177e4SLinus Torvalds Unless you really know what you are doing, you should say Y here. 111da177e4SLinus Torvalds The reason is that some programs need kernel networking support even 121da177e4SLinus Torvalds when running on a stand-alone machine that isn't connected to any 13d5950b43SSam Ravnborg other computer. 14d5950b43SSam Ravnborg 15d5950b43SSam Ravnborg If you are upgrading from an older kernel, you 161da177e4SLinus Torvalds should consider updating your networking tools too because changes 171da177e4SLinus Torvalds in the kernel and the tools often go hand in hand. The tools are 181da177e4SLinus Torvalds contained in the package net-tools, the location and version number 191da177e4SLinus Torvalds of which are given in <file:Documentation/Changes>. 201da177e4SLinus Torvalds 211da177e4SLinus Torvalds For a general introduction to Linux networking, it is highly 221da177e4SLinus Torvalds recommended to read the NET-HOWTO, available from 231da177e4SLinus Torvalds <http://www.tldp.org/docs.html#howto>. 241da177e4SLinus Torvalds 256a2e9b73SSam Ravnborg# Make sure that all config symbols are dependent on NET 266a2e9b73SSam Ravnborgif NET 276a2e9b73SSam Ravnborg 281da177e4SLinus Torvaldsmenu "Networking options" 291da177e4SLinus Torvalds 300dec456dSStephen Hemmingerconfig NETDEBUG 310dec456dSStephen Hemminger bool "Network packet debugging" 320dec456dSStephen Hemminger help 330dec456dSStephen Hemminger You can say Y here if you want to get additional messages useful in 340dec456dSStephen Hemminger debugging bad packets, but can overwhelm logs under denial of service 350dec456dSStephen Hemminger attacks. 360dec456dSStephen Hemminger 376a2e9b73SSam Ravnborgsource "net/packet/Kconfig" 386a2e9b73SSam Ravnborgsource "net/unix/Kconfig" 396a2e9b73SSam Ravnborgsource "net/xfrm/Kconfig" 401da177e4SLinus Torvalds 411da177e4SLinus Torvaldsconfig INET 421da177e4SLinus Torvalds bool "TCP/IP networking" 431da177e4SLinus Torvalds ---help--- 441da177e4SLinus Torvalds These are the protocols used on the Internet and on most local 451da177e4SLinus Torvalds Ethernets. It is highly recommended to say Y here (this will enlarge 461da177e4SLinus Torvalds your kernel by about 144 KB), since some programs (e.g. the X window 471da177e4SLinus Torvalds system) use TCP/IP even if your machine is not connected to any 481da177e4SLinus Torvalds other computer. You will get the so-called loopback device which 491da177e4SLinus Torvalds allows you to ping yourself (great fun, that!). 501da177e4SLinus Torvalds 511da177e4SLinus Torvalds For an excellent introduction to Linux networking, please read the 521da177e4SLinus Torvalds Linux Networking HOWTO, available from 531da177e4SLinus Torvalds <http://www.tldp.org/docs.html#howto>. 541da177e4SLinus Torvalds 551da177e4SLinus Torvalds If you say Y here and also to "/proc file system support" and 561da177e4SLinus Torvalds "Sysctl support" below, you can change various aspects of the 571da177e4SLinus Torvalds behavior of the TCP/IP code by writing to the (virtual) files in 581da177e4SLinus Torvalds /proc/sys/net/ipv4/*; the options are explained in the file 591da177e4SLinus Torvalds <file:Documentation/networking/ip-sysctl.txt>. 601da177e4SLinus Torvalds 611da177e4SLinus Torvalds Short answer: say Y. 621da177e4SLinus Torvalds 636a2e9b73SSam Ravnborgif INET 641da177e4SLinus Torvaldssource "net/ipv4/Kconfig" 651da177e4SLinus Torvaldssource "net/ipv6/Kconfig" 661da177e4SLinus Torvalds 676a2e9b73SSam Ravnborgendif # if INET 686a2e9b73SSam Ravnborg 691da177e4SLinus Torvaldsmenuconfig NETFILTER 701da177e4SLinus Torvalds bool "Network packet filtering (replaces ipchains)" 711da177e4SLinus Torvalds ---help--- 721da177e4SLinus Torvalds Netfilter is a framework for filtering and mangling network packets 731da177e4SLinus Torvalds that pass through your Linux box. 741da177e4SLinus Torvalds 751da177e4SLinus Torvalds The most common use of packet filtering is to run your Linux box as 761da177e4SLinus Torvalds a firewall protecting a local network from the Internet. The type of 771da177e4SLinus Torvalds firewall provided by this kernel support is called a "packet 781da177e4SLinus Torvalds filter", which means that it can reject individual network packets 791da177e4SLinus Torvalds based on type, source, destination etc. The other kind of firewall, 801da177e4SLinus Torvalds a "proxy-based" one, is more secure but more intrusive and more 811da177e4SLinus Torvalds bothersome to set up; it inspects the network traffic much more 821da177e4SLinus Torvalds closely, modifies it and has knowledge about the higher level 831da177e4SLinus Torvalds protocols, which a packet filter lacks. Moreover, proxy-based 841da177e4SLinus Torvalds firewalls often require changes to the programs running on the local 851da177e4SLinus Torvalds clients. Proxy-based firewalls don't need support by the kernel, but 861da177e4SLinus Torvalds they are often combined with a packet filter, which only works if 871da177e4SLinus Torvalds you say Y here. 881da177e4SLinus Torvalds 891da177e4SLinus Torvalds You should also say Y here if you intend to use your Linux box as 901da177e4SLinus Torvalds the gateway to the Internet for a local network of machines without 911da177e4SLinus Torvalds globally valid IP addresses. This is called "masquerading": if one 921da177e4SLinus Torvalds of the computers on your local network wants to send something to 931da177e4SLinus Torvalds the outside, your box can "masquerade" as that computer, i.e. it 941da177e4SLinus Torvalds forwards the traffic to the intended outside destination, but 951da177e4SLinus Torvalds modifies the packets to make it look like they came from the 961da177e4SLinus Torvalds firewall box itself. It works both ways: if the outside host 971da177e4SLinus Torvalds replies, the Linux box will silently forward the traffic to the 981da177e4SLinus Torvalds correct local computer. This way, the computers on your local net 991da177e4SLinus Torvalds are completely invisible to the outside world, even though they can 1001da177e4SLinus Torvalds reach the outside and can receive replies. It is even possible to 1011da177e4SLinus Torvalds run globally visible servers from within a masqueraded local network 1021da177e4SLinus Torvalds using a mechanism called portforwarding. Masquerading is also often 1031da177e4SLinus Torvalds called NAT (Network Address Translation). 1041da177e4SLinus Torvalds 1051da177e4SLinus Torvalds Another use of Netfilter is in transparent proxying: if a machine on 1061da177e4SLinus Torvalds the local network tries to connect to an outside host, your Linux 1071da177e4SLinus Torvalds box can transparently forward the traffic to a local server, 1081da177e4SLinus Torvalds typically a caching proxy server. 1091da177e4SLinus Torvalds 1101da177e4SLinus Torvalds Yet another use of Netfilter is building a bridging firewall. Using 1111da177e4SLinus Torvalds a bridge with Network packet filtering enabled makes iptables "see" 1121da177e4SLinus Torvalds the bridged traffic. For filtering on the lower network and Ethernet 1131da177e4SLinus Torvalds protocols over the bridge, use ebtables (under bridge netfilter 1141da177e4SLinus Torvalds configuration). 1151da177e4SLinus Torvalds 1161da177e4SLinus Torvalds Various modules exist for netfilter which replace the previous 1171da177e4SLinus Torvalds masquerading (ipmasqadm), packet filtering (ipchains), transparent 1181da177e4SLinus Torvalds proxying, and portforwarding mechanisms. Please see 1191da177e4SLinus Torvalds <file:Documentation/Changes> under "iptables" for the location of 1201da177e4SLinus Torvalds these packages. 1211da177e4SLinus Torvalds 1221da177e4SLinus Torvalds Make sure to say N to "Fast switching" below if you intend to say Y 1231da177e4SLinus Torvalds here, as Fast switching currently bypasses netfilter. 1241da177e4SLinus Torvalds 1251da177e4SLinus Torvalds Chances are that you should say Y here if you compile a kernel which 1261da177e4SLinus Torvalds will run as a router and N for regular hosts. If unsure, say N. 1271da177e4SLinus Torvalds 1281da177e4SLinus Torvaldsif NETFILTER 1291da177e4SLinus Torvalds 1301da177e4SLinus Torvaldsconfig NETFILTER_DEBUG 1311da177e4SLinus Torvalds bool "Network packet filtering debugging" 1321da177e4SLinus Torvalds depends on NETFILTER 1331da177e4SLinus Torvalds help 1341da177e4SLinus Torvalds You can say Y here if you want to get additional messages useful in 1351da177e4SLinus Torvalds debugging the netfilter code. 1361da177e4SLinus Torvalds 1371da177e4SLinus Torvaldsconfig BRIDGE_NETFILTER 1381da177e4SLinus Torvalds bool "Bridged IP/ARP packets filtering" 1391da177e4SLinus Torvalds depends on BRIDGE && NETFILTER && INET 1401da177e4SLinus Torvalds default y 1411da177e4SLinus Torvalds ---help--- 1421da177e4SLinus Torvalds Enabling this option will let arptables resp. iptables see bridged 1431da177e4SLinus Torvalds ARP resp. IP traffic. If you want a bridging firewall, you probably 1441da177e4SLinus Torvalds want this option enabled. 1451da177e4SLinus Torvalds Enabling or disabling this option doesn't enable or disable 1461da177e4SLinus Torvalds ebtables. 1471da177e4SLinus Torvalds 1481da177e4SLinus Torvalds If unsure, say N. 1491da177e4SLinus Torvalds 1509eb0eec7SHarald Weltesource "net/netfilter/Kconfig" 1511da177e4SLinus Torvaldssource "net/ipv4/netfilter/Kconfig" 1521da177e4SLinus Torvaldssource "net/ipv6/netfilter/Kconfig" 1531da177e4SLinus Torvaldssource "net/decnet/netfilter/Kconfig" 1541da177e4SLinus Torvaldssource "net/bridge/netfilter/Kconfig" 1551da177e4SLinus Torvalds 1561da177e4SLinus Torvaldsendif 1571da177e4SLinus Torvalds 1587c657876SArnaldo Carvalho de Melosource "net/dccp/Kconfig" 1591da177e4SLinus Torvaldssource "net/sctp/Kconfig" 1601e63e681SPer Lidensource "net/tipc/Kconfig" 1616a2e9b73SSam Ravnborgsource "net/atm/Kconfig" 1626a2e9b73SSam Ravnborgsource "net/bridge/Kconfig" 1636a2e9b73SSam Ravnborgsource "net/8021q/Kconfig" 1641da177e4SLinus Torvaldssource "net/decnet/Kconfig" 1651da177e4SLinus Torvaldssource "net/llc/Kconfig" 1661da177e4SLinus Torvaldssource "net/ipx/Kconfig" 1671da177e4SLinus Torvaldssource "drivers/net/appletalk/Kconfig" 1686a2e9b73SSam Ravnborgsource "net/x25/Kconfig" 1696a2e9b73SSam Ravnborgsource "net/lapb/Kconfig" 1701da177e4SLinus Torvalds 1711da177e4SLinus Torvaldsconfig NET_DIVERT 1721da177e4SLinus Torvalds bool "Frame Diverter (EXPERIMENTAL)" 1731da177e4SLinus Torvalds depends on EXPERIMENTAL 1741da177e4SLinus Torvalds ---help--- 1751da177e4SLinus Torvalds The Frame Diverter allows you to divert packets from the 1761da177e4SLinus Torvalds network, that are not aimed at the interface receiving it (in 1771da177e4SLinus Torvalds promisc. mode). Typically, a Linux box setup as an Ethernet bridge 1781da177e4SLinus Torvalds with the Frames Diverter on, can do some *really* transparent www 1791da177e4SLinus Torvalds caching using a Squid proxy for example. 1801da177e4SLinus Torvalds 1811da177e4SLinus Torvalds This is very useful when you don't want to change your router's 1821da177e4SLinus Torvalds config (or if you simply don't have access to it). 1831da177e4SLinus Torvalds 1841da177e4SLinus Torvalds The other possible usages of diverting Ethernet Frames are 1851da177e4SLinus Torvalds numberous: 1861da177e4SLinus Torvalds - reroute smtp traffic to another interface 1871da177e4SLinus Torvalds - traffic-shape certain network streams 1881da177e4SLinus Torvalds - transparently proxy smtp connections 1891da177e4SLinus Torvalds - etc... 1901da177e4SLinus Torvalds 1911da177e4SLinus Torvalds For more informations, please refer to: 1921da177e4SLinus Torvalds <http://diverter.sourceforge.net/> 1931da177e4SLinus Torvalds <http://perso.wanadoo.fr/magpie/EtherDivert.html> 1941da177e4SLinus Torvalds 1951da177e4SLinus Torvalds If unsure, say N. 1961da177e4SLinus Torvalds 1976a2e9b73SSam Ravnborgsource "net/econet/Kconfig" 1986a2e9b73SSam Ravnborgsource "net/wanrouter/Kconfig" 1991da177e4SLinus Torvaldssource "net/sched/Kconfig" 2001da177e4SLinus Torvalds 2011da177e4SLinus Torvaldsmenu "Network testing" 2021da177e4SLinus Torvalds 2031da177e4SLinus Torvaldsconfig NET_PKTGEN 2041da177e4SLinus Torvalds tristate "Packet Generator (USE WITH CAUTION)" 2051da177e4SLinus Torvalds depends on PROC_FS 2061da177e4SLinus Torvalds ---help--- 2071da177e4SLinus Torvalds This module will inject preconfigured packets, at a configurable 2081da177e4SLinus Torvalds rate, out of a given interface. It is used for network interface 2091da177e4SLinus Torvalds stress testing and performance analysis. If you don't understand 2101da177e4SLinus Torvalds what was just said, you don't need it: say N. 2111da177e4SLinus Torvalds 2121da177e4SLinus Torvalds Documentation on how to use the packet generator can be found 2131da177e4SLinus Torvalds at <file:Documentation/networking/pktgen.txt>. 2141da177e4SLinus Torvalds 2151da177e4SLinus Torvalds To compile this code as a module, choose M here: the 2161da177e4SLinus Torvalds module will be called pktgen. 2171da177e4SLinus Torvalds 218a42e9d6cSStephen Hemmingerconfig NET_TCPPROBE 219a42e9d6cSStephen Hemminger tristate "TCP connection probing" 220a42e9d6cSStephen Hemminger depends on INET && EXPERIMENTAL && PROC_FS && KPROBES 221a42e9d6cSStephen Hemminger ---help--- 222a42e9d6cSStephen Hemminger This module allows for capturing the changes to TCP connection 2239dadaa19SDave Jones state in response to incoming packets. It is used for debugging 224a42e9d6cSStephen Hemminger TCP congestion avoidance modules. If you don't understand 225a42e9d6cSStephen Hemminger what was just said, you don't need it: say N. 226a42e9d6cSStephen Hemminger 227a42e9d6cSStephen Hemminger Documentation on how to use the packet generator can be found 228a42e9d6cSStephen Hemminger at http://linux-net.osdl.org/index.php/TcpProbe 229a42e9d6cSStephen Hemminger 230a42e9d6cSStephen Hemminger To compile this code as a module, choose M here: the 231a42e9d6cSStephen Hemminger module will be called tcp_probe. 232a42e9d6cSStephen Hemminger 2331da177e4SLinus Torvaldsendmenu 2341da177e4SLinus Torvalds 2351da177e4SLinus Torvaldsendmenu 2361da177e4SLinus Torvalds 2371da177e4SLinus Torvaldssource "net/ax25/Kconfig" 2381da177e4SLinus Torvaldssource "net/irda/Kconfig" 2391da177e4SLinus Torvaldssource "net/bluetooth/Kconfig" 240b453872cSJeff Garziksource "net/ieee80211/Kconfig" 241b453872cSJeff Garzik 242d86b5e0eSAdrian Bunkconfig WIRELESS_EXT 243d86b5e0eSAdrian Bunk bool 244d86b5e0eSAdrian Bunk 2456a2e9b73SSam Ravnborgendif # if NET 246d5950b43SSam Ravnborgendmenu # Networking 2471da177e4SLinus Torvalds 248