blob: f55599c62c9d61335005202146fdad75c8c133b9 [file] [log] [blame]
Jiri Pirkoc9f9e0e2013-01-17 23:05:08 +00001/proc/sys/net/netfilter/nf_conntrack_* Variables:
2
3nf_conntrack_acct - BOOLEAN
4 0 - disabled (default)
5 not 0 - enabled
6
7 Enable connection tracking flow accounting. 64-bit byte and packet
8 counters per flow are added.
9
10nf_conntrack_buckets - INTEGER (read-only)
11 Size of hash table. If not specified as parameter during module
12 loading, the default size is calculated by dividing total memory
13 by 16384 to determine the number of buckets but the hash table will
Marcelo Leitner88eab472014-12-03 17:30:19 -020014 never have fewer than 32 and limited to 16384 buckets. For systems
15 with more than 4GB of memory it will be 65536 buckets.
Jiri Pirkoc9f9e0e2013-01-17 23:05:08 +000016
17nf_conntrack_checksum - BOOLEAN
18 0 - disabled
19 not 0 - enabled (default)
20
21 Verify checksum of incoming packets. Packets with bad checksums are
22 in INVALID state. If this is enabled, such packets will not be
23 considered for connection tracking.
24
25nf_conntrack_count - INTEGER (read-only)
26 Number of currently allocated flow entries.
27
28nf_conntrack_events - BOOLEAN
29 0 - disabled
30 not 0 - enabled (default)
31
32 If this option is enabled, the connection tracking code will
33 provide userspace with connection tracking events via ctnetlink.
34
35nf_conntrack_events_retry_timeout - INTEGER (seconds)
36 default 15
37
38 This option is only relevant when "reliable connection tracking
39 events" are used. Normally, ctnetlink is "lossy", that is,
40 events are normally dropped when userspace listeners can't keep up.
41
42 Userspace can request "reliable event mode". When this mode is
43 active, the conntrack will only be destroyed after the event was
44 delivered. If event delivery fails, the kernel periodically
45 re-tries to send the event to userspace.
46
47 This is the maximum interval the kernel should use when re-trying
48 to deliver the destroy event.
49
50 A higher number means there will be fewer delivery retries and it
51 will take longer for a backlog to be processed.
52
53nf_conntrack_expect_max - INTEGER
54 Maximum size of expectation table. Default value is
55 nf_conntrack_buckets / 256. Minimum is 1.
56
57nf_conntrack_frag6_high_thresh - INTEGER
58 default 262144
59
60 Maximum memory used to reassemble IPv6 fragments. When
61 nf_conntrack_frag6_high_thresh bytes of memory is allocated for this
62 purpose, the fragment handler will toss packets until
63 nf_conntrack_frag6_low_thresh is reached.
64
65nf_conntrack_frag6_low_thresh - INTEGER
66 default 196608
67
68 See nf_conntrack_frag6_low_thresh
69
70nf_conntrack_frag6_timeout - INTEGER (seconds)
71 default 60
72
73 Time to keep an IPv6 fragment in memory.
74
75nf_conntrack_generic_timeout - INTEGER (seconds)
76 default 600
77
78 Default for generic timeout. This refers to layer 4 unknown/unsupported
79 protocols.
80
81nf_conntrack_helper - BOOLEAN
82 0 - disabled
83 not 0 - enabled (default)
84
85 Enable automatic conntrack helper assignment.
86
87nf_conntrack_icmp_timeout - INTEGER (seconds)
88 default 30
89
90 Default for ICMP timeout.
91
92nf_conntrack_icmpv6_timeout - INTEGER (seconds)
93 default 30
94
95 Default for ICMP6 timeout.
96
97nf_conntrack_log_invalid - INTEGER
98 0 - disable (default)
99 1 - log ICMP packets
100 6 - log TCP packets
101 17 - log UDP packets
102 33 - log DCCP packets
103 41 - log ICMPv6 packets
104 136 - log UDPLITE packets
105 255 - log packets of any protocol
106
107 Log invalid packets of a type specified by value.
108
109nf_conntrack_max - INTEGER
110 Size of connection tracking table. Default value is
111 nf_conntrack_buckets value * 4.
112
113nf_conntrack_tcp_be_liberal - BOOLEAN
114 0 - disabled (default)
115 not 0 - enabled
116
117 Be conservative in what you do, be liberal in what you accept from others.
118 If it's non-zero, we mark only out of window RST segments as INVALID.
119
120nf_conntrack_tcp_loose - BOOLEAN
121 0 - disabled
122 not 0 - enabled (default)
123
124 If it is set to zero, we disable picking up already established
125 connections.
126
127nf_conntrack_tcp_max_retrans - INTEGER
128 default 3
129
130 Maximum number of packets that can be retransmitted without
131 received an (acceptable) ACK from the destination. If this number
132 is reached, a shorter timer will be started.
133
134nf_conntrack_tcp_timeout_close - INTEGER (seconds)
135 default 10
136
137nf_conntrack_tcp_timeout_close_wait - INTEGER (seconds)
138 default 60
139
140nf_conntrack_tcp_timeout_established - INTEGER (seconds)
141 default 432000 (5 days)
142
143nf_conntrack_tcp_timeout_fin_wait - INTEGER (seconds)
144 default 120
145
146nf_conntrack_tcp_timeout_last_ack - INTEGER (seconds)
147 default 30
148
149nf_conntrack_tcp_timeout_max_retrans - INTEGER (seconds)
150 default 300
151
152nf_conntrack_tcp_timeout_syn_recv - INTEGER (seconds)
153 default 60
154
155nf_conntrack_tcp_timeout_syn_sent - INTEGER (seconds)
156 default 120
157
158nf_conntrack_tcp_timeout_time_wait - INTEGER (seconds)
159 default 120
160
161nf_conntrack_tcp_timeout_unacknowledged - INTEGER (seconds)
162 default 300
163
164nf_conntrack_timestamp - BOOLEAN
165 0 - disabled (default)
166 not 0 - enabled
167
168 Enable connection tracking flow timestamping.
169
170nf_conntrack_udp_timeout - INTEGER (seconds)
171 default 30
172
173nf_conntrack_udp_timeout_stream2 - INTEGER (seconds)
174 default 180
175
176 This extended timeout will be used in case there is an UDP stream
177 detected.