| Jiri Pirko | c9f9e0e | 2013-01-17 23:05:08 +0000 | [diff] [blame] | 1 | /proc/sys/net/netfilter/nf_conntrack_* Variables: |
| 2 | |
| 3 | nf_conntrack_acct - BOOLEAN |
| 4 | 0 - disabled (default) |
| 5 | not 0 - enabled |
| 6 | |
| 7 | Enable connection tracking flow accounting. 64-bit byte and packet |
| 8 | counters per flow are added. |
| 9 | |
| Florian Westphal | 3183ab8 | 2016-06-22 13:26:10 +0200 | [diff] [blame] | 10 | nf_conntrack_buckets - INTEGER |
| Jiri Pirko | c9f9e0e | 2013-01-17 23:05:08 +0000 | [diff] [blame] | 11 | Size of hash table. If not specified as parameter during module |
| 12 | loading, the default size is calculated by dividing total memory |
| 13 | by 16384 to determine the number of buckets but the hash table will |
| Marcelo Leitner | 88eab47 | 2014-12-03 17:30:19 -0200 | [diff] [blame] | 14 | never have fewer than 32 and limited to 16384 buckets. For systems |
| 15 | with more than 4GB of memory it will be 65536 buckets. |
| Florian Westphal | 3183ab8 | 2016-06-22 13:26:10 +0200 | [diff] [blame] | 16 | This sysctl is only writeable in the initial net namespace. |
| Jiri Pirko | c9f9e0e | 2013-01-17 23:05:08 +0000 | [diff] [blame] | 17 | |
| 18 | nf_conntrack_checksum - BOOLEAN |
| 19 | 0 - disabled |
| 20 | not 0 - enabled (default) |
| 21 | |
| 22 | Verify checksum of incoming packets. Packets with bad checksums are |
| 23 | in INVALID state. If this is enabled, such packets will not be |
| 24 | considered for connection tracking. |
| 25 | |
| 26 | nf_conntrack_count - INTEGER (read-only) |
| 27 | Number of currently allocated flow entries. |
| 28 | |
| 29 | nf_conntrack_events - BOOLEAN |
| 30 | 0 - disabled |
| 31 | not 0 - enabled (default) |
| 32 | |
| 33 | If this option is enabled, the connection tracking code will |
| 34 | provide userspace with connection tracking events via ctnetlink. |
| 35 | |
| 36 | nf_conntrack_events_retry_timeout - INTEGER (seconds) |
| 37 | default 15 |
| 38 | |
| 39 | This option is only relevant when "reliable connection tracking |
| 40 | events" are used. Normally, ctnetlink is "lossy", that is, |
| 41 | events are normally dropped when userspace listeners can't keep up. |
| 42 | |
| 43 | Userspace can request "reliable event mode". When this mode is |
| 44 | active, the conntrack will only be destroyed after the event was |
| 45 | delivered. If event delivery fails, the kernel periodically |
| 46 | re-tries to send the event to userspace. |
| 47 | |
| 48 | This is the maximum interval the kernel should use when re-trying |
| 49 | to deliver the destroy event. |
| 50 | |
| 51 | A higher number means there will be fewer delivery retries and it |
| 52 | will take longer for a backlog to be processed. |
| 53 | |
| 54 | nf_conntrack_expect_max - INTEGER |
| 55 | Maximum size of expectation table. Default value is |
| 56 | nf_conntrack_buckets / 256. Minimum is 1. |
| 57 | |
| 58 | nf_conntrack_frag6_high_thresh - INTEGER |
| 59 | default 262144 |
| 60 | |
| 61 | Maximum memory used to reassemble IPv6 fragments. When |
| 62 | nf_conntrack_frag6_high_thresh bytes of memory is allocated for this |
| 63 | purpose, the fragment handler will toss packets until |
| 64 | nf_conntrack_frag6_low_thresh is reached. |
| 65 | |
| 66 | nf_conntrack_frag6_low_thresh - INTEGER |
| 67 | default 196608 |
| 68 | |
| 69 | See nf_conntrack_frag6_low_thresh |
| 70 | |
| 71 | nf_conntrack_frag6_timeout - INTEGER (seconds) |
| 72 | default 60 |
| 73 | |
| 74 | Time to keep an IPv6 fragment in memory. |
| 75 | |
| 76 | nf_conntrack_generic_timeout - INTEGER (seconds) |
| 77 | default 600 |
| 78 | |
| 79 | Default for generic timeout. This refers to layer 4 unknown/unsupported |
| 80 | protocols. |
| 81 | |
| 82 | nf_conntrack_helper - BOOLEAN |
| 83 | 0 - disabled |
| 84 | not 0 - enabled (default) |
| 85 | |
| 86 | Enable automatic conntrack helper assignment. |
| 87 | |
| 88 | nf_conntrack_icmp_timeout - INTEGER (seconds) |
| 89 | default 30 |
| 90 | |
| 91 | Default for ICMP timeout. |
| 92 | |
| 93 | nf_conntrack_icmpv6_timeout - INTEGER (seconds) |
| 94 | default 30 |
| 95 | |
| 96 | Default for ICMP6 timeout. |
| 97 | |
| 98 | nf_conntrack_log_invalid - INTEGER |
| 99 | 0 - disable (default) |
| 100 | 1 - log ICMP packets |
| 101 | 6 - log TCP packets |
| 102 | 17 - log UDP packets |
| 103 | 33 - log DCCP packets |
| 104 | 41 - log ICMPv6 packets |
| 105 | 136 - log UDPLITE packets |
| 106 | 255 - log packets of any protocol |
| 107 | |
| 108 | Log invalid packets of a type specified by value. |
| 109 | |
| 110 | nf_conntrack_max - INTEGER |
| 111 | Size of connection tracking table. Default value is |
| 112 | nf_conntrack_buckets value * 4. |
| 113 | |
| 114 | nf_conntrack_tcp_be_liberal - BOOLEAN |
| 115 | 0 - disabled (default) |
| 116 | not 0 - enabled |
| 117 | |
| 118 | Be conservative in what you do, be liberal in what you accept from others. |
| 119 | If it's non-zero, we mark only out of window RST segments as INVALID. |
| 120 | |
| 121 | nf_conntrack_tcp_loose - BOOLEAN |
| 122 | 0 - disabled |
| 123 | not 0 - enabled (default) |
| 124 | |
| 125 | If it is set to zero, we disable picking up already established |
| 126 | connections. |
| 127 | |
| 128 | nf_conntrack_tcp_max_retrans - INTEGER |
| 129 | default 3 |
| 130 | |
| 131 | Maximum number of packets that can be retransmitted without |
| 132 | received an (acceptable) ACK from the destination. If this number |
| 133 | is reached, a shorter timer will be started. |
| 134 | |
| 135 | nf_conntrack_tcp_timeout_close - INTEGER (seconds) |
| 136 | default 10 |
| 137 | |
| 138 | nf_conntrack_tcp_timeout_close_wait - INTEGER (seconds) |
| 139 | default 60 |
| 140 | |
| 141 | nf_conntrack_tcp_timeout_established - INTEGER (seconds) |
| 142 | default 432000 (5 days) |
| 143 | |
| 144 | nf_conntrack_tcp_timeout_fin_wait - INTEGER (seconds) |
| 145 | default 120 |
| 146 | |
| 147 | nf_conntrack_tcp_timeout_last_ack - INTEGER (seconds) |
| 148 | default 30 |
| 149 | |
| 150 | nf_conntrack_tcp_timeout_max_retrans - INTEGER (seconds) |
| 151 | default 300 |
| 152 | |
| 153 | nf_conntrack_tcp_timeout_syn_recv - INTEGER (seconds) |
| 154 | default 60 |
| 155 | |
| 156 | nf_conntrack_tcp_timeout_syn_sent - INTEGER (seconds) |
| 157 | default 120 |
| 158 | |
| 159 | nf_conntrack_tcp_timeout_time_wait - INTEGER (seconds) |
| 160 | default 120 |
| 161 | |
| 162 | nf_conntrack_tcp_timeout_unacknowledged - INTEGER (seconds) |
| 163 | default 300 |
| 164 | |
| 165 | nf_conntrack_timestamp - BOOLEAN |
| 166 | 0 - disabled (default) |
| 167 | not 0 - enabled |
| 168 | |
| 169 | Enable connection tracking flow timestamping. |
| 170 | |
| 171 | nf_conntrack_udp_timeout - INTEGER (seconds) |
| 172 | default 30 |
| 173 | |
| 174 | nf_conntrack_udp_timeout_stream2 - INTEGER (seconds) |
| 175 | default 180 |
| 176 | |
| 177 | This extended timeout will be used in case there is an UDP stream |
| 178 | detected. |