11da177e4SLinus Torvalds# 21da177e4SLinus Torvalds# IP configuration 31da177e4SLinus Torvalds# 419baf839SRobert Olssonchoice 5b5354207SKumar Gala prompt "Choose IP: FIB lookup" 619baf839SRobert Olsson depends on INET 719baf839SRobert Olsson default IP_FIB_HASH 819baf839SRobert Olsson 919baf839SRobert Olssonconfig IP_FIB_HASH 1019baf839SRobert Olsson bool "FIB_HASH" 1119baf839SRobert Olsson ---help--- 1219baf839SRobert Olsson Current FIB is very proven and good enough for most users. 1319baf839SRobert Olsson 1419baf839SRobert Olssonconfig IP_FIB_TRIE 1519baf839SRobert Olsson bool "FIB_TRIE" 1619baf839SRobert Olsson ---help--- 1719baf839SRobert Olsson Use new experimental LC-trie as FIB lookup algoritm. 1819baf839SRobert Olsson This improves lookup performance 1919baf839SRobert Olsson 2019baf839SRobert Olsson LC-trie is described in: 2119baf839SRobert Olsson 2219baf839SRobert Olsson IP-address lookup using LC-tries. Stefan Nilsson and Gunnar Karlsson 2319baf839SRobert Olsson IEEE Journal on Selected Areas in Communications, 17(6):1083-1092, June 1999 2419baf839SRobert Olsson An experimental study of compression methods for dynamic tries 2519baf839SRobert Olsson Stefan Nilsson and Matti Tikkanen. Algorithmica, 33(1):19-33, 2002. 2619baf839SRobert Olsson http://www.nada.kth.se/~snilsson/public/papers/dyntrie2/ 2719baf839SRobert Olsson 2819baf839SRobert Olssonendchoice 2919baf839SRobert Olsson 301da177e4SLinus Torvaldsconfig IP_MULTICAST 311da177e4SLinus Torvalds bool "IP: multicasting" 321da177e4SLinus Torvalds depends on INET 331da177e4SLinus Torvalds help 341da177e4SLinus Torvalds This is code for addressing several networked computers at once, 351da177e4SLinus Torvalds enlarging your kernel by about 2 KB. You need multicasting if you 361da177e4SLinus Torvalds intend to participate in the MBONE, a high bandwidth network on top 371da177e4SLinus Torvalds of the Internet which carries audio and video broadcasts. More 381da177e4SLinus Torvalds information about the MBONE is on the WWW at 391da177e4SLinus Torvalds <http://www-itg.lbl.gov/mbone/>. Information about the multicast 401da177e4SLinus Torvalds capabilities of the various network cards is contained in 411da177e4SLinus Torvalds <file:Documentation/networking/multicast.txt>. For most people, it's 421da177e4SLinus Torvalds safe to say N. 431da177e4SLinus Torvalds 441da177e4SLinus Torvaldsconfig IP_ADVANCED_ROUTER 451da177e4SLinus Torvalds bool "IP: advanced router" 461da177e4SLinus Torvalds depends on INET 471da177e4SLinus Torvalds ---help--- 481da177e4SLinus Torvalds If you intend to run your Linux box mostly as a router, i.e. as a 491da177e4SLinus Torvalds computer that forwards and redistributes network packets, say Y; you 501da177e4SLinus Torvalds will then be presented with several options that allow more precise 511da177e4SLinus Torvalds control about the routing process. 521da177e4SLinus Torvalds 531da177e4SLinus Torvalds The answer to this question won't directly affect the kernel: 541da177e4SLinus Torvalds answering N will just cause the configurator to skip all the 551da177e4SLinus Torvalds questions about advanced routing. 561da177e4SLinus Torvalds 571da177e4SLinus Torvalds Note that your box can only act as a router if you enable IP 581da177e4SLinus Torvalds forwarding in your kernel; you can do that by saying Y to "/proc 591da177e4SLinus Torvalds file system support" and "Sysctl support" below and executing the 601da177e4SLinus Torvalds line 611da177e4SLinus Torvalds 621da177e4SLinus Torvalds echo "1" > /proc/sys/net/ipv4/ip_forward 631da177e4SLinus Torvalds 641da177e4SLinus Torvalds at boot time after the /proc file system has been mounted. 651da177e4SLinus Torvalds 661da177e4SLinus Torvalds If you turn on IP forwarding, you will also get the rp_filter, which 671da177e4SLinus Torvalds automatically rejects incoming packets if the routing table entry 681da177e4SLinus Torvalds for their source address doesn't match the network interface they're 691da177e4SLinus Torvalds arriving on. This has security advantages because it prevents the 701da177e4SLinus Torvalds so-called IP spoofing, however it can pose problems if you use 711da177e4SLinus Torvalds asymmetric routing (packets from you to a host take a different path 721da177e4SLinus Torvalds than packets from that host to you) or if you operate a non-routing 731da177e4SLinus Torvalds host which has several IP addresses on different interfaces. To turn 741da177e4SLinus Torvalds rp_filter off use: 751da177e4SLinus Torvalds 761da177e4SLinus Torvalds echo 0 > /proc/sys/net/ipv4/conf/<device>/rp_filter 771da177e4SLinus Torvalds or 781da177e4SLinus Torvalds echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter 791da177e4SLinus Torvalds 801da177e4SLinus Torvalds If unsure, say N here. 811da177e4SLinus Torvalds 821da177e4SLinus Torvaldsconfig IP_MULTIPLE_TABLES 831da177e4SLinus Torvalds bool "IP: policy routing" 841da177e4SLinus Torvalds depends on IP_ADVANCED_ROUTER 851da177e4SLinus Torvalds ---help--- 861da177e4SLinus Torvalds Normally, a router decides what to do with a received packet based 871da177e4SLinus Torvalds solely on the packet's final destination address. If you say Y here, 881da177e4SLinus Torvalds the Linux router will also be able to take the packet's source 891da177e4SLinus Torvalds address into account. Furthermore, the TOS (Type-Of-Service) field 901da177e4SLinus Torvalds of the packet can be used for routing decisions as well. 911da177e4SLinus Torvalds 921da177e4SLinus Torvalds If you are interested in this, please see the preliminary 931da177e4SLinus Torvalds documentation at <http://www.compendium.com.ar/policy-routing.txt> 941da177e4SLinus Torvalds and <ftp://post.tepkom.ru/pub/vol2/Linux/docs/advanced-routing.tex>. 951da177e4SLinus Torvalds You will need supporting software from 961da177e4SLinus Torvalds <ftp://ftp.tux.org/pub/net/ip-routing/>. 971da177e4SLinus Torvalds 981da177e4SLinus Torvalds If unsure, say N. 991da177e4SLinus Torvalds 1001da177e4SLinus Torvaldsconfig IP_ROUTE_FWMARK 1011da177e4SLinus Torvalds bool "IP: use netfilter MARK value as routing key" 1021da177e4SLinus Torvalds depends on IP_MULTIPLE_TABLES && NETFILTER 1031da177e4SLinus Torvalds help 1041da177e4SLinus Torvalds If you say Y here, you will be able to specify different routes for 1051da177e4SLinus Torvalds packets with different mark values (see iptables(8), MARK target). 1061da177e4SLinus Torvalds 1071da177e4SLinus Torvaldsconfig IP_ROUTE_MULTIPATH 1081da177e4SLinus Torvalds bool "IP: equal cost multipath" 1091da177e4SLinus Torvalds depends on IP_ADVANCED_ROUTER 1101da177e4SLinus Torvalds help 1111da177e4SLinus Torvalds Normally, the routing tables specify a single action to be taken in 1121da177e4SLinus Torvalds a deterministic manner for a given packet. If you say Y here 1131da177e4SLinus Torvalds however, it becomes possible to attach several actions to a packet 1141da177e4SLinus Torvalds pattern, in effect specifying several alternative paths to travel 1151da177e4SLinus Torvalds for those packets. The router considers all these paths to be of 1161da177e4SLinus Torvalds equal "cost" and chooses one of them in a non-deterministic fashion 1171da177e4SLinus Torvalds if a matching packet arrives. 1181da177e4SLinus Torvalds 1191da177e4SLinus Torvaldsconfig IP_ROUTE_MULTIPATH_CACHED 1201da177e4SLinus Torvalds bool "IP: equal cost multipath with caching support (EXPERIMENTAL)" 1211da177e4SLinus Torvalds depends on: IP_ROUTE_MULTIPATH 1221da177e4SLinus Torvalds help 1231da177e4SLinus Torvalds Normally, equal cost multipath routing is not supported by the 1241da177e4SLinus Torvalds routing cache. If you say Y here, alternative routes are cached 1251da177e4SLinus Torvalds and on cache lookup a route is chosen in a configurable fashion. 1261da177e4SLinus Torvalds 1271da177e4SLinus Torvalds If unsure, say N. 1281da177e4SLinus Torvalds 1291da177e4SLinus Torvaldsconfig IP_ROUTE_MULTIPATH_RR 1301da177e4SLinus Torvalds tristate "MULTIPATH: round robin algorithm" 1311da177e4SLinus Torvalds depends on IP_ROUTE_MULTIPATH_CACHED 1321da177e4SLinus Torvalds help 1331da177e4SLinus Torvalds Mulitpath routes are chosen according to Round Robin 1341da177e4SLinus Torvalds 1351da177e4SLinus Torvaldsconfig IP_ROUTE_MULTIPATH_RANDOM 1361da177e4SLinus Torvalds tristate "MULTIPATH: random algorithm" 1371da177e4SLinus Torvalds depends on IP_ROUTE_MULTIPATH_CACHED 1381da177e4SLinus Torvalds help 1391da177e4SLinus Torvalds Multipath routes are chosen in a random fashion. Actually, 1401da177e4SLinus Torvalds there is no weight for a route. The advantage of this policy 1411da177e4SLinus Torvalds is that it is implemented stateless and therefore introduces only 1421da177e4SLinus Torvalds a very small delay. 1431da177e4SLinus Torvalds 1441da177e4SLinus Torvaldsconfig IP_ROUTE_MULTIPATH_WRANDOM 1451da177e4SLinus Torvalds tristate "MULTIPATH: weighted random algorithm" 1461da177e4SLinus Torvalds depends on IP_ROUTE_MULTIPATH_CACHED 1471da177e4SLinus Torvalds help 1481da177e4SLinus Torvalds Multipath routes are chosen in a weighted random fashion. 1491da177e4SLinus Torvalds The per route weights are the weights visible via ip route 2. As the 1501da177e4SLinus Torvalds corresponding state management introduces some overhead routing delay 1511da177e4SLinus Torvalds is increased. 1521da177e4SLinus Torvalds 1531da177e4SLinus Torvaldsconfig IP_ROUTE_MULTIPATH_DRR 1541da177e4SLinus Torvalds tristate "MULTIPATH: interface round robin algorithm" 1551da177e4SLinus Torvalds depends on IP_ROUTE_MULTIPATH_CACHED 1561da177e4SLinus Torvalds help 1571da177e4SLinus Torvalds Connections are distributed in a round robin fashion over the 1581da177e4SLinus Torvalds available interfaces. This policy makes sense if the connections 1591da177e4SLinus Torvalds should be primarily distributed on interfaces and not on routes. 1601da177e4SLinus Torvalds 1611da177e4SLinus Torvaldsconfig IP_ROUTE_VERBOSE 1621da177e4SLinus Torvalds bool "IP: verbose route monitoring" 1631da177e4SLinus Torvalds depends on IP_ADVANCED_ROUTER 1641da177e4SLinus Torvalds help 1651da177e4SLinus Torvalds If you say Y here, which is recommended, then the kernel will print 1661da177e4SLinus Torvalds verbose messages regarding the routing, for example warnings about 1671da177e4SLinus Torvalds received packets which look strange and could be evidence of an 1681da177e4SLinus Torvalds attack or a misconfigured system somewhere. The information is 1691da177e4SLinus Torvalds handled by the klogd daemon which is responsible for kernel messages 1701da177e4SLinus Torvalds ("man klogd"). 1711da177e4SLinus Torvalds 1721da177e4SLinus Torvaldsconfig IP_PNP 1731da177e4SLinus Torvalds bool "IP: kernel level autoconfiguration" 1741da177e4SLinus Torvalds depends on INET 1751da177e4SLinus Torvalds help 1761da177e4SLinus Torvalds This enables automatic configuration of IP addresses of devices and 1771da177e4SLinus Torvalds of the routing table during kernel boot, based on either information 1781da177e4SLinus Torvalds supplied on the kernel command line or by BOOTP or RARP protocols. 1791da177e4SLinus Torvalds You need to say Y only for diskless machines requiring network 1801da177e4SLinus Torvalds access to boot (in which case you want to say Y to "Root file system 1811da177e4SLinus Torvalds on NFS" as well), because all other machines configure the network 1821da177e4SLinus Torvalds in their startup scripts. 1831da177e4SLinus Torvalds 1841da177e4SLinus Torvaldsconfig IP_PNP_DHCP 1851da177e4SLinus Torvalds bool "IP: DHCP support" 1861da177e4SLinus Torvalds depends on IP_PNP 1871da177e4SLinus Torvalds ---help--- 1881da177e4SLinus Torvalds If you want your Linux box to mount its whole root file system (the 1891da177e4SLinus Torvalds one containing the directory /) from some other computer over the 1901da177e4SLinus Torvalds net via NFS and you want the IP address of your computer to be 1911da177e4SLinus Torvalds discovered automatically at boot time using the DHCP protocol (a 1921da177e4SLinus Torvalds special protocol designed for doing this job), say Y here. In case 1931da177e4SLinus Torvalds the boot ROM of your network card was designed for booting Linux and 1941da177e4SLinus Torvalds does DHCP itself, providing all necessary information on the kernel 1951da177e4SLinus Torvalds command line, you can say N here. 1961da177e4SLinus Torvalds 1971da177e4SLinus Torvalds If unsure, say Y. Note that if you want to use DHCP, a DHCP server 1981da177e4SLinus Torvalds must be operating on your network. Read 1991da177e4SLinus Torvalds <file:Documentation/nfsroot.txt> for details. 2001da177e4SLinus Torvalds 2011da177e4SLinus Torvaldsconfig IP_PNP_BOOTP 2021da177e4SLinus Torvalds bool "IP: BOOTP support" 2031da177e4SLinus Torvalds depends on IP_PNP 2041da177e4SLinus Torvalds ---help--- 2051da177e4SLinus Torvalds If you want your Linux box to mount its whole root file system (the 2061da177e4SLinus Torvalds one containing the directory /) from some other computer over the 2071da177e4SLinus Torvalds net via NFS and you want the IP address of your computer to be 2081da177e4SLinus Torvalds discovered automatically at boot time using the BOOTP protocol (a 2091da177e4SLinus Torvalds special protocol designed for doing this job), say Y here. In case 2101da177e4SLinus Torvalds the boot ROM of your network card was designed for booting Linux and 2111da177e4SLinus Torvalds does BOOTP itself, providing all necessary information on the kernel 2121da177e4SLinus Torvalds command line, you can say N here. If unsure, say Y. Note that if you 2131da177e4SLinus Torvalds want to use BOOTP, a BOOTP server must be operating on your network. 2141da177e4SLinus Torvalds Read <file:Documentation/nfsroot.txt> for details. 2151da177e4SLinus Torvalds 2161da177e4SLinus Torvaldsconfig IP_PNP_RARP 2171da177e4SLinus Torvalds bool "IP: RARP support" 2181da177e4SLinus Torvalds depends on IP_PNP 2191da177e4SLinus Torvalds help 2201da177e4SLinus Torvalds If you want your Linux box to mount its whole root file system (the 2211da177e4SLinus Torvalds one containing the directory /) from some other computer over the 2221da177e4SLinus Torvalds net via NFS and you want the IP address of your computer to be 2231da177e4SLinus Torvalds discovered automatically at boot time using the RARP protocol (an 2241da177e4SLinus Torvalds older protocol which is being obsoleted by BOOTP and DHCP), say Y 2251da177e4SLinus Torvalds here. Note that if you want to use RARP, a RARP server must be 2261da177e4SLinus Torvalds operating on your network. Read <file:Documentation/nfsroot.txt> for 2271da177e4SLinus Torvalds details. 2281da177e4SLinus Torvalds 2291da177e4SLinus Torvalds# not yet ready.. 2301da177e4SLinus Torvalds# bool ' IP: ARP support' CONFIG_IP_PNP_ARP 2311da177e4SLinus Torvaldsconfig NET_IPIP 2321da177e4SLinus Torvalds tristate "IP: tunneling" 2331da177e4SLinus Torvalds depends on INET 2341da177e4SLinus Torvalds select INET_TUNNEL 2351da177e4SLinus Torvalds ---help--- 2361da177e4SLinus Torvalds Tunneling means encapsulating data of one protocol type within 2371da177e4SLinus Torvalds another protocol and sending it over a channel that understands the 2381da177e4SLinus Torvalds encapsulating protocol. This particular tunneling driver implements 2391da177e4SLinus Torvalds encapsulation of IP within IP, which sounds kind of pointless, but 2401da177e4SLinus Torvalds can be useful if you want to make your (or some other) machine 2411da177e4SLinus Torvalds appear on a different network than it physically is, or to use 2421da177e4SLinus Torvalds mobile-IP facilities (allowing laptops to seamlessly move between 2431da177e4SLinus Torvalds networks without changing their IP addresses). 2441da177e4SLinus Torvalds 2451da177e4SLinus Torvalds Saying Y to this option will produce two modules ( = code which can 2461da177e4SLinus Torvalds be inserted in and removed from the running kernel whenever you 2471da177e4SLinus Torvalds want). Most people won't need this and can say N. 2481da177e4SLinus Torvalds 2491da177e4SLinus Torvaldsconfig NET_IPGRE 2501da177e4SLinus Torvalds tristate "IP: GRE tunnels over IP" 2511da177e4SLinus Torvalds depends on INET 2521da177e4SLinus Torvalds select XFRM 2531da177e4SLinus Torvalds help 2541da177e4SLinus Torvalds Tunneling means encapsulating data of one protocol type within 2551da177e4SLinus Torvalds another protocol and sending it over a channel that understands the 2561da177e4SLinus Torvalds encapsulating protocol. This particular tunneling driver implements 2571da177e4SLinus Torvalds GRE (Generic Routing Encapsulation) and at this time allows 2581da177e4SLinus Torvalds encapsulating of IPv4 or IPv6 over existing IPv4 infrastructure. 2591da177e4SLinus Torvalds This driver is useful if the other endpoint is a Cisco router: Cisco 2601da177e4SLinus Torvalds likes GRE much better than the other Linux tunneling driver ("IP 2611da177e4SLinus Torvalds tunneling" above). In addition, GRE allows multicast redistribution 2621da177e4SLinus Torvalds through the tunnel. 2631da177e4SLinus Torvalds 2641da177e4SLinus Torvaldsconfig NET_IPGRE_BROADCAST 2651da177e4SLinus Torvalds bool "IP: broadcast GRE over IP" 2661da177e4SLinus Torvalds depends on IP_MULTICAST && NET_IPGRE 2671da177e4SLinus Torvalds help 2681da177e4SLinus Torvalds One application of GRE/IP is to construct a broadcast WAN (Wide Area 2691da177e4SLinus Torvalds Network), which looks like a normal Ethernet LAN (Local Area 2701da177e4SLinus Torvalds Network), but can be distributed all over the Internet. If you want 2711da177e4SLinus Torvalds to do that, say Y here and to "IP multicast routing" below. 2721da177e4SLinus Torvalds 2731da177e4SLinus Torvaldsconfig IP_MROUTE 2741da177e4SLinus Torvalds bool "IP: multicast routing" 2751da177e4SLinus Torvalds depends on IP_MULTICAST 2761da177e4SLinus Torvalds help 2771da177e4SLinus Torvalds This is used if you want your machine to act as a router for IP 2781da177e4SLinus Torvalds packets that have several destination addresses. It is needed on the 2791da177e4SLinus Torvalds MBONE, a high bandwidth network on top of the Internet which carries 2801da177e4SLinus Torvalds audio and video broadcasts. In order to do that, you would most 2811da177e4SLinus Torvalds likely run the program mrouted. Information about the multicast 2821da177e4SLinus Torvalds capabilities of the various network cards is contained in 2831da177e4SLinus Torvalds <file:Documentation/networking/multicast.txt>. If you haven't heard 2841da177e4SLinus Torvalds about it, you don't need it. 2851da177e4SLinus Torvalds 2861da177e4SLinus Torvaldsconfig IP_PIMSM_V1 2871da177e4SLinus Torvalds bool "IP: PIM-SM version 1 support" 2881da177e4SLinus Torvalds depends on IP_MROUTE 2891da177e4SLinus Torvalds help 2901da177e4SLinus Torvalds Kernel side support for Sparse Mode PIM (Protocol Independent 2911da177e4SLinus Torvalds Multicast) version 1. This multicast routing protocol is used widely 2921da177e4SLinus Torvalds because Cisco supports it. You need special software to use it 2931da177e4SLinus Torvalds (pimd-v1). Please see <http://netweb.usc.edu/pim/> for more 2941da177e4SLinus Torvalds information about PIM. 2951da177e4SLinus Torvalds 2961da177e4SLinus Torvalds Say Y if you want to use PIM-SM v1. Note that you can say N here if 2971da177e4SLinus Torvalds you just want to use Dense Mode PIM. 2981da177e4SLinus Torvalds 2991da177e4SLinus Torvaldsconfig IP_PIMSM_V2 3001da177e4SLinus Torvalds bool "IP: PIM-SM version 2 support" 3011da177e4SLinus Torvalds depends on IP_MROUTE 3021da177e4SLinus Torvalds help 3031da177e4SLinus Torvalds Kernel side support for Sparse Mode PIM version 2. In order to use 3041da177e4SLinus Torvalds this, you need an experimental routing daemon supporting it (pimd or 3051da177e4SLinus Torvalds gated-5). This routing protocol is not used widely, so say N unless 3061da177e4SLinus Torvalds you want to play with it. 3071da177e4SLinus Torvalds 3081da177e4SLinus Torvaldsconfig ARPD 3091da177e4SLinus Torvalds bool "IP: ARP daemon support (EXPERIMENTAL)" 3101da177e4SLinus Torvalds depends on INET && EXPERIMENTAL 3111da177e4SLinus Torvalds ---help--- 3121da177e4SLinus Torvalds Normally, the kernel maintains an internal cache which maps IP 3131da177e4SLinus Torvalds addresses to hardware addresses on the local network, so that 3141da177e4SLinus Torvalds Ethernet/Token Ring/ etc. frames are sent to the proper address on 3151da177e4SLinus Torvalds the physical networking layer. For small networks having a few 3161da177e4SLinus Torvalds hundred directly connected hosts or less, keeping this address 3171da177e4SLinus Torvalds resolution (ARP) cache inside the kernel works well. However, 3181da177e4SLinus Torvalds maintaining an internal ARP cache does not work well for very large 3191da177e4SLinus Torvalds switched networks, and will use a lot of kernel memory if TCP/IP 3201da177e4SLinus Torvalds connections are made to many machines on the network. 3211da177e4SLinus Torvalds 3221da177e4SLinus Torvalds If you say Y here, the kernel's internal ARP cache will never grow 3231da177e4SLinus Torvalds to more than 256 entries (the oldest entries are expired in a LIFO 3241da177e4SLinus Torvalds manner) and communication will be attempted with the user space ARP 3251da177e4SLinus Torvalds daemon arpd. Arpd then answers the address resolution request either 3261da177e4SLinus Torvalds from its own cache or by asking the net. 3271da177e4SLinus Torvalds 3281da177e4SLinus Torvalds This code is experimental and also obsolete. If you want to use it, 3291da177e4SLinus Torvalds you need to find a version of the daemon arpd on the net somewhere, 3301da177e4SLinus Torvalds and you should also say Y to "Kernel/User network link driver", 3311da177e4SLinus Torvalds below. If unsure, say N. 3321da177e4SLinus Torvalds 3331da177e4SLinus Torvaldsconfig SYN_COOKIES 3341da177e4SLinus Torvalds bool "IP: TCP syncookie support (disabled per default)" 3351da177e4SLinus Torvalds depends on INET 3361da177e4SLinus Torvalds ---help--- 3371da177e4SLinus Torvalds Normal TCP/IP networking is open to an attack known as "SYN 3381da177e4SLinus Torvalds flooding". This denial-of-service attack prevents legitimate remote 3391da177e4SLinus Torvalds users from being able to connect to your computer during an ongoing 3401da177e4SLinus Torvalds attack and requires very little work from the attacker, who can 3411da177e4SLinus Torvalds operate from anywhere on the Internet. 3421da177e4SLinus Torvalds 3431da177e4SLinus Torvalds SYN cookies provide protection against this type of attack. If you 3441da177e4SLinus Torvalds say Y here, the TCP/IP stack will use a cryptographic challenge 3451da177e4SLinus Torvalds protocol known as "SYN cookies" to enable legitimate users to 3461da177e4SLinus Torvalds continue to connect, even when your machine is under attack. There 3471da177e4SLinus Torvalds is no need for the legitimate users to change their TCP/IP software; 3481da177e4SLinus Torvalds SYN cookies work transparently to them. For technical information 3491da177e4SLinus Torvalds about SYN cookies, check out <http://cr.yp.to/syncookies.html>. 3501da177e4SLinus Torvalds 3511da177e4SLinus Torvalds If you are SYN flooded, the source address reported by the kernel is 3521da177e4SLinus Torvalds likely to have been forged by the attacker; it is only reported as 3531da177e4SLinus Torvalds an aid in tracing the packets to their actual source and should not 3541da177e4SLinus Torvalds be taken as absolute truth. 3551da177e4SLinus Torvalds 3561da177e4SLinus Torvalds SYN cookies may prevent correct error reporting on clients when the 3571da177e4SLinus Torvalds server is really overloaded. If this happens frequently better turn 3581da177e4SLinus Torvalds them off. 3591da177e4SLinus Torvalds 3601da177e4SLinus Torvalds If you say Y here, note that SYN cookies aren't enabled by default; 3611da177e4SLinus Torvalds you can enable them by saying Y to "/proc file system support" and 3621da177e4SLinus Torvalds "Sysctl support" below and executing the command 3631da177e4SLinus Torvalds 3641da177e4SLinus Torvalds echo 1 >/proc/sys/net/ipv4/tcp_syncookies 3651da177e4SLinus Torvalds 3661da177e4SLinus Torvalds at boot time after the /proc file system has been mounted. 3671da177e4SLinus Torvalds 3681da177e4SLinus Torvalds If unsure, say N. 3691da177e4SLinus Torvalds 3701da177e4SLinus Torvaldsconfig INET_AH 3711da177e4SLinus Torvalds tristate "IP: AH transformation" 3721da177e4SLinus Torvalds depends on INET 3731da177e4SLinus Torvalds select XFRM 3741da177e4SLinus Torvalds select CRYPTO 3751da177e4SLinus Torvalds select CRYPTO_HMAC 3761da177e4SLinus Torvalds select CRYPTO_MD5 3771da177e4SLinus Torvalds select CRYPTO_SHA1 3781da177e4SLinus Torvalds ---help--- 3791da177e4SLinus Torvalds Support for IPsec AH. 3801da177e4SLinus Torvalds 3811da177e4SLinus Torvalds If unsure, say Y. 3821da177e4SLinus Torvalds 3831da177e4SLinus Torvaldsconfig INET_ESP 3841da177e4SLinus Torvalds tristate "IP: ESP transformation" 3851da177e4SLinus Torvalds depends on INET 3861da177e4SLinus Torvalds select XFRM 3871da177e4SLinus Torvalds select CRYPTO 3881da177e4SLinus Torvalds select CRYPTO_HMAC 3891da177e4SLinus Torvalds select CRYPTO_MD5 3901da177e4SLinus Torvalds select CRYPTO_SHA1 3911da177e4SLinus Torvalds select CRYPTO_DES 3921da177e4SLinus Torvalds ---help--- 3931da177e4SLinus Torvalds Support for IPsec ESP. 3941da177e4SLinus Torvalds 3951da177e4SLinus Torvalds If unsure, say Y. 3961da177e4SLinus Torvalds 3971da177e4SLinus Torvaldsconfig INET_IPCOMP 3981da177e4SLinus Torvalds tristate "IP: IPComp transformation" 3991da177e4SLinus Torvalds depends on INET 4001da177e4SLinus Torvalds select XFRM 4011da177e4SLinus Torvalds select INET_TUNNEL 4021da177e4SLinus Torvalds select CRYPTO 4031da177e4SLinus Torvalds select CRYPTO_DEFLATE 4041da177e4SLinus Torvalds ---help--- 4051da177e4SLinus Torvalds Support for IP Payload Compression Protocol (IPComp) (RFC3173), 4061da177e4SLinus Torvalds typically needed for IPsec. 4071da177e4SLinus Torvalds 4081da177e4SLinus Torvalds If unsure, say Y. 4091da177e4SLinus Torvalds 4101da177e4SLinus Torvaldsconfig INET_TUNNEL 4111da177e4SLinus Torvalds tristate "IP: tunnel transformation" 4121da177e4SLinus Torvalds depends on INET 4131da177e4SLinus Torvalds select XFRM 4141da177e4SLinus Torvalds ---help--- 4151da177e4SLinus Torvalds Support for generic IP tunnel transformation, which is required by 4161da177e4SLinus Torvalds the IP tunneling module as well as tunnel mode IPComp. 4171da177e4SLinus Torvalds 4181da177e4SLinus Torvalds If unsure, say Y. 4191da177e4SLinus Torvalds 4201da177e4SLinus Torvaldsconfig IP_TCPDIAG 4211da177e4SLinus Torvalds tristate "IP: TCP socket monitoring interface" 4221da177e4SLinus Torvalds depends on INET 4231da177e4SLinus Torvalds default y 4241da177e4SLinus Torvalds ---help--- 4251da177e4SLinus Torvalds Support for TCP socket monitoring interface used by native Linux 4261da177e4SLinus Torvalds tools such as ss. ss is included in iproute2, currently downloadable 4271da177e4SLinus Torvalds at <http://developer.osdl.org/dev/iproute2>. If you want IPv6 support 4281da177e4SLinus Torvalds and have selected IPv6 as a module, you need to build this as a 4291da177e4SLinus Torvalds module too. 4301da177e4SLinus Torvalds 4311da177e4SLinus Torvalds If unsure, say Y. 4321da177e4SLinus Torvalds 4331da177e4SLinus Torvaldsconfig IP_TCPDIAG_IPV6 4341da177e4SLinus Torvalds def_bool (IP_TCPDIAG=y && IPV6=y) || (IP_TCPDIAG=m && IPV6) 4351da177e4SLinus Torvalds 43683803034SStephen Hemminger# TCP Reno is builtin (required as fallback) 43783803034SStephen Hemmingermenu "TCP congestion control" 43883803034SStephen Hemminger depends on INET 43983803034SStephen Hemminger 44083803034SStephen Hemmingerconfig TCP_CONG_BIC 44183803034SStephen Hemminger tristate "Binary Increase Congestion (BIC) control" 44283803034SStephen Hemminger depends on INET 44383803034SStephen Hemminger default y 44483803034SStephen Hemminger ---help--- 44583803034SStephen Hemminger BIC-TCP is a sender-side only change that ensures a linear RTT 44683803034SStephen Hemminger fairness under large windows while offering both scalability and 44783803034SStephen Hemminger bounded TCP-friendliness. The protocol combines two schemes 44883803034SStephen Hemminger called additive increase and binary search increase. When the 44983803034SStephen Hemminger congestion window is large, additive increase with a large 45083803034SStephen Hemminger increment ensures linear RTT fairness as well as good 45183803034SStephen Hemminger scalability. Under small congestion windows, binary search 45283803034SStephen Hemminger increase provides TCP friendliness. 45383803034SStephen Hemminger See http://www.csc.ncsu.edu/faculty/rhee/export/bitcp/ 45483803034SStephen Hemminger 45587270762SStephen Hemmingerconfig TCP_CONG_WESTWOOD 45687270762SStephen Hemminger tristate "TCP Westwood+" 45787270762SStephen Hemminger depends on INET 45887270762SStephen Hemminger default m 45987270762SStephen Hemminger ---help--- 46087270762SStephen Hemminger TCP Westwood+ is a sender-side only modification of the TCP Reno 46187270762SStephen Hemminger protocol stack that optimizes the performance of TCP congestion 46287270762SStephen Hemminger control. It is based on end-to-end bandwidth estimation to set 46387270762SStephen Hemminger congestion window and slow start threshold after a congestion 46487270762SStephen Hemminger episode. Using this estimation, TCP Westwood+ adaptively sets a 46587270762SStephen Hemminger slow start threshold and a congestion window which takes into 46687270762SStephen Hemminger account the bandwidth used at the time congestion is experienced. 46787270762SStephen Hemminger TCP Westwood+ significantly increases fairness wrt TCP Reno in 46887270762SStephen Hemminger wired networks and throughput over wireless links. 46987270762SStephen Hemminger 470a7868ea6SBaruch Evenconfig TCP_CONG_HTCP 471a7868ea6SBaruch Even tristate "H-TCP" 472a7868ea6SBaruch Even depends on INET 473a7868ea6SBaruch Even default m 474a7868ea6SBaruch Even ---help--- 475a7868ea6SBaruch Even H-TCP is a send-side only modifications of the TCP Reno 476a7868ea6SBaruch Even protocol stack that optimizes the performance of TCP 477a7868ea6SBaruch Even congestion control for high speed network links. It uses a 478a7868ea6SBaruch Even modeswitch to change the alpha and beta parameters of TCP Reno 479a7868ea6SBaruch Even based on network conditions and in a way so as to be fair with 480a7868ea6SBaruch Even other Reno and H-TCP flows. 481a7868ea6SBaruch Even 482a628d29bSJohn Heffnerconfig TCP_CONG_HSTCP 483a628d29bSJohn Heffner tristate "High Speed TCP" 484a628d29bSJohn Heffner depends on INET && EXPERIMENTAL 485a628d29bSJohn Heffner default n 486a628d29bSJohn Heffner ---help--- 487a628d29bSJohn Heffner Sally Floyd's High Speed TCP (RFC 3649) congestion control. 488a628d29bSJohn Heffner A modification to TCP's congestion control mechanism for use 489a628d29bSJohn Heffner with large congestion windows. A table indicates how much to 490a628d29bSJohn Heffner increase the congestion window by when an ACK is received. 491a628d29bSJohn Heffner For more detail see http://www.icir.org/floyd/hstcp.html 492a628d29bSJohn Heffner 493835b3f0cSDaniele Lacameraconfig TCP_CONG_HYBLA 494835b3f0cSDaniele Lacamera tristate "TCP-Hybla congestion control algorithm" 495835b3f0cSDaniele Lacamera depends on INET && EXPERIMENTAL 496835b3f0cSDaniele Lacamera default n 497835b3f0cSDaniele Lacamera ---help--- 498835b3f0cSDaniele Lacamera TCP-Hybla is a sender-side only change that eliminates penalization of 499835b3f0cSDaniele Lacamera long-RTT, large-bandwidth connections, like when satellite legs are 500835b3f0cSDaniele Lacamera involved, expecially when sharing a common bottleneck with normal 501835b3f0cSDaniele Lacamera terrestrial connections. 502835b3f0cSDaniele Lacamera 503b87d8561SStephen Hemmingerconfig TCP_CONG_VEGAS 504b87d8561SStephen Hemminger tristate "TCP Vegas" 505b87d8561SStephen Hemminger depends on INET && EXPERIMENTAL 506b87d8561SStephen Hemminger default n 507b87d8561SStephen Hemminger ---help--- 508b87d8561SStephen Hemminger TCP Vegas is a sender-side only change to TCP that anticipates 509b87d8561SStephen Hemminger the onset of congestion by estimating the bandwidth. TCP Vegas 510b87d8561SStephen Hemminger adjusts the sending rate by modifying the congestion 511b87d8561SStephen Hemminger window. TCP Vegas should provide less packet loss, but it is 512b87d8561SStephen Hemminger not as aggressive as TCP Reno. 513b87d8561SStephen Hemminger 5140e57976bSJohn Heffnerconfig TCP_CONG_SCALABLE 5150e57976bSJohn Heffner tristate "Scalable TCP" 5160e57976bSJohn Heffner depends on INET && EXPERIMENTAL 5170e57976bSJohn Heffner default n 5180e57976bSJohn Heffner ---help--- 5190e57976bSJohn Heffner Scalable TCP is a sender-side only change to TCP which uses a 5200e57976bSJohn Heffner MIMD congestion control algorithm which has some nice scaling 5210e57976bSJohn Heffner properties, though is known to have fairness issues. 5220e57976bSJohn Heffner See http://www-lce.eng.cam.ac.uk/~ctk21/scalable/ 523a7868ea6SBaruch Even 52483803034SStephen Hemmingerendmenu 52583803034SStephen Hemminger 5261da177e4SLinus Torvaldssource "net/ipv4/ipvs/Kconfig" 5271da177e4SLinus Torvalds 528