About Kernel Documentation Linux Kernel Contact Linux Resources Linux Blog

Documentation / networking / nf_conntrack-sysctl.txt




Custom Search

Based on kernel version 4.8. Page generated on 2016-10-06 23:18 EST.

1	/proc/sys/net/netfilter/nf_conntrack_* Variables:
2	
3	nf_conntrack_acct - BOOLEAN
4		0 - disabled (default)
5		not 0 - enabled
6	
7		Enable connection tracking flow accounting. 64-bit byte and packet
8		counters per flow are added.
9	
10	nf_conntrack_buckets - INTEGER
11		Size of hash table. If not specified as parameter during module
12		loading, the default size is calculated by dividing total memory
13		by 16384 to determine the number of buckets but the hash table will
14		never have fewer than 32 and limited to 16384 buckets. For systems
15		with more than 4GB of memory it will be 65536 buckets.
16		This sysctl is only writeable in the initial net namespace.
17	
18	nf_conntrack_checksum - BOOLEAN
19		0 - disabled
20		not 0 - enabled (default)
21	
22		Verify checksum of incoming packets. Packets with bad checksums are
23		in INVALID state. If this is enabled, such packets will not be
24		considered for connection tracking.
25	
26	nf_conntrack_count - INTEGER (read-only)
27		Number of currently allocated flow entries.
28	
29	nf_conntrack_events - BOOLEAN
30		0 - disabled
31		not 0 - enabled (default)
32	
33		If this option is enabled, the connection tracking code will
34		provide userspace with connection tracking events via ctnetlink.
35	
36	nf_conntrack_events_retry_timeout - INTEGER (seconds)
37		default 15
38	
39		This option is only relevant when "reliable connection tracking
40		events" are used.  Normally, ctnetlink is "lossy", that is,
41		events are normally dropped when userspace listeners can't keep up.
42	
43		Userspace can request "reliable event mode".  When this mode is
44		active, the conntrack will only be destroyed after the event was
45		delivered.  If event delivery fails, the kernel periodically
46		re-tries to send the event to userspace.
47	
48		This is the maximum interval the kernel should use when re-trying
49		to deliver the destroy event.
50	
51		A higher number means there will be fewer delivery retries and it
52		will take longer for a backlog to be processed.
53	
54	nf_conntrack_expect_max - INTEGER
55		Maximum size of expectation table.  Default value is
56		nf_conntrack_buckets / 256. Minimum is 1.
57	
58	nf_conntrack_frag6_high_thresh - INTEGER
59		default 262144
60	
61		Maximum memory used to reassemble IPv6 fragments.  When
62		nf_conntrack_frag6_high_thresh bytes of memory is allocated for this
63		purpose, the fragment handler will toss packets until
64		nf_conntrack_frag6_low_thresh is reached.
65	
66	nf_conntrack_frag6_low_thresh - INTEGER
67		default 196608
68	
69		See nf_conntrack_frag6_low_thresh
70	
71	nf_conntrack_frag6_timeout - INTEGER (seconds)
72		default 60
73	
74		Time to keep an IPv6 fragment in memory.
75	
76	nf_conntrack_generic_timeout - INTEGER (seconds)
77		default 600
78	
79		Default for generic timeout.  This refers to layer 4 unknown/unsupported
80		protocols.
81	
82	nf_conntrack_helper - BOOLEAN
83		0 - disabled
84		not 0 - enabled (default)
85	
86		Enable automatic conntrack helper assignment.
87	
88	nf_conntrack_icmp_timeout - INTEGER (seconds)
89		default 30
90	
91		Default for ICMP timeout.
92	
93	nf_conntrack_icmpv6_timeout - INTEGER (seconds)
94		default 30
95	
96		Default for ICMP6 timeout.
97	
98	nf_conntrack_log_invalid - INTEGER
99		0   - disable (default)
100		1   - log ICMP packets
101		6   - log TCP packets
102		17  - log UDP packets
103		33  - log DCCP packets
104		41  - log ICMPv6 packets
105		136 - log UDPLITE packets
106		255 - log packets of any protocol
107	
108		Log invalid packets of a type specified by value.
109	
110	nf_conntrack_max - INTEGER
111		Size of connection tracking table.  Default value is
112		nf_conntrack_buckets value * 4.
113	
114	nf_conntrack_tcp_be_liberal - BOOLEAN
115		0 - disabled (default)
116		not 0 - enabled
117	
118		Be conservative in what you do, be liberal in what you accept from others.
119		If it's non-zero, we mark only out of window RST segments as INVALID.
120	
121	nf_conntrack_tcp_loose - BOOLEAN
122		0 - disabled
123		not 0 - enabled (default)
124	
125		If it is set to zero, we disable picking up already established
126		connections.
127	
128	nf_conntrack_tcp_max_retrans - INTEGER
129		default 3
130	
131		Maximum number of packets that can be retransmitted without
132		received an (acceptable) ACK from the destination. If this number
133		is reached, a shorter timer will be started.
134	
135	nf_conntrack_tcp_timeout_close - INTEGER (seconds)
136		default 10
137	
138	nf_conntrack_tcp_timeout_close_wait - INTEGER (seconds)
139		default 60
140	
141	nf_conntrack_tcp_timeout_established - INTEGER (seconds)
142		default 432000 (5 days)
143	
144	nf_conntrack_tcp_timeout_fin_wait - INTEGER (seconds)
145		default 120
146	
147	nf_conntrack_tcp_timeout_last_ack - INTEGER (seconds)
148		default 30
149	
150	nf_conntrack_tcp_timeout_max_retrans - INTEGER (seconds)
151		default 300
152	
153	nf_conntrack_tcp_timeout_syn_recv - INTEGER (seconds)
154		default 60
155	
156	nf_conntrack_tcp_timeout_syn_sent - INTEGER (seconds)
157		default 120
158	
159	nf_conntrack_tcp_timeout_time_wait - INTEGER (seconds)
160		default 120
161	
162	nf_conntrack_tcp_timeout_unacknowledged - INTEGER (seconds)
163		default 300
164	
165	nf_conntrack_timestamp - BOOLEAN
166		0 - disabled (default)
167		not 0 - enabled
168	
169		Enable connection tracking flow timestamping.
170	
171	nf_conntrack_udp_timeout - INTEGER (seconds)
172		default 30
173	
174	nf_conntrack_udp_timeout_stream2 - INTEGER (seconds)
175		default 180
176	
177		This extended timeout will be used in case there is an UDP stream
178		detected.
Hide Line Numbers
About Kernel Documentation Linux Kernel Contact Linux Resources Linux Blog

Information is copyright its respective author. All material is available from the Linux Kernel Source distributed under a GPL License. This page is provided as a free service by mjmwired.net.