Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | # |
| 2 | # IP configuration |
| 3 | # |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 4 | config IP_MULTICAST |
| 5 | bool "IP: multicasting" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 6 | help |
| 7 | This is code for addressing several networked computers at once, |
| 8 | enlarging your kernel by about 2 KB. You need multicasting if you |
| 9 | intend to participate in the MBONE, a high bandwidth network on top |
| 10 | of the Internet which carries audio and video broadcasts. More |
| 11 | information about the MBONE is on the WWW at |
Adrian Bunk | 936bb14 | 2007-02-17 19:49:13 +0100 | [diff] [blame] | 12 | <http://www.savetz.com/mbone/>. Information about the multicast |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 13 | capabilities of the various network cards is contained in |
| 14 | <file:Documentation/networking/multicast.txt>. For most people, it's |
| 15 | safe to say N. |
| 16 | |
| 17 | config IP_ADVANCED_ROUTER |
| 18 | bool "IP: advanced router" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 19 | ---help--- |
| 20 | If you intend to run your Linux box mostly as a router, i.e. as a |
| 21 | computer that forwards and redistributes network packets, say Y; you |
| 22 | will then be presented with several options that allow more precise |
| 23 | control about the routing process. |
| 24 | |
| 25 | The answer to this question won't directly affect the kernel: |
| 26 | answering N will just cause the configurator to skip all the |
| 27 | questions about advanced routing. |
| 28 | |
| 29 | Note that your box can only act as a router if you enable IP |
| 30 | forwarding in your kernel; you can do that by saying Y to "/proc |
| 31 | file system support" and "Sysctl support" below and executing the |
| 32 | line |
| 33 | |
| 34 | echo "1" > /proc/sys/net/ipv4/ip_forward |
| 35 | |
| 36 | at boot time after the /proc file system has been mounted. |
| 37 | |
Jesper Dangaard Brouer | b2cc46a | 2009-02-22 00:06:20 -0800 | [diff] [blame] | 38 | If you turn on IP forwarding, you should consider the rp_filter, which |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 39 | automatically rejects incoming packets if the routing table entry |
| 40 | for their source address doesn't match the network interface they're |
| 41 | arriving on. This has security advantages because it prevents the |
| 42 | so-called IP spoofing, however it can pose problems if you use |
| 43 | asymmetric routing (packets from you to a host take a different path |
| 44 | than packets from that host to you) or if you operate a non-routing |
| 45 | host which has several IP addresses on different interfaces. To turn |
Dave Jones | d739437 | 2007-05-17 15:02:21 -0700 | [diff] [blame] | 46 | rp_filter on use: |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 47 | |
Dave Jones | d739437 | 2007-05-17 15:02:21 -0700 | [diff] [blame] | 48 | echo 1 > /proc/sys/net/ipv4/conf/<device>/rp_filter |
Jesper Dangaard Brouer | b2cc46a | 2009-02-22 00:06:20 -0800 | [diff] [blame] | 49 | and |
Dave Jones | d739437 | 2007-05-17 15:02:21 -0700 | [diff] [blame] | 50 | echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 51 | |
Jesper Dangaard Brouer | b2cc46a | 2009-02-22 00:06:20 -0800 | [diff] [blame] | 52 | Note that some distributions enable it in startup scripts. |
Jesper Dangaard Brouer | d18921a | 2009-02-23 04:40:43 +0000 | [diff] [blame] | 53 | For details about rp_filter strict and loose mode read |
| 54 | <file:Documentation/networking/ip-sysctl.txt>. |
Jesper Dangaard Brouer | b2cc46a | 2009-02-22 00:06:20 -0800 | [diff] [blame] | 55 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 56 | If unsure, say N here. |
| 57 | |
Jesper Dangaard Brouer | a6e8f27 | 2009-02-22 00:07:13 -0800 | [diff] [blame] | 58 | choice |
David S. Miller | bb298ca | 2005-06-24 17:50:53 -0700 | [diff] [blame] | 59 | prompt "Choose IP: FIB lookup algorithm (choose FIB_HASH if unsure)" |
| 60 | depends on IP_ADVANCED_ROUTER |
Adrian Bunk | 6876f95 | 2005-07-18 13:55:19 -0700 | [diff] [blame] | 61 | default ASK_IP_FIB_HASH |
David S. Miller | bb298ca | 2005-06-24 17:50:53 -0700 | [diff] [blame] | 62 | |
Adrian Bunk | 6876f95 | 2005-07-18 13:55:19 -0700 | [diff] [blame] | 63 | config ASK_IP_FIB_HASH |
David S. Miller | bb298ca | 2005-06-24 17:50:53 -0700 | [diff] [blame] | 64 | bool "FIB_HASH" |
| 65 | ---help--- |
Jesper Dangaard Brouer | a6e8f27 | 2009-02-22 00:07:13 -0800 | [diff] [blame] | 66 | Current FIB is very proven and good enough for most users. |
David S. Miller | bb298ca | 2005-06-24 17:50:53 -0700 | [diff] [blame] | 67 | |
| 68 | config IP_FIB_TRIE |
| 69 | bool "FIB_TRIE" |
| 70 | ---help--- |
Jesper Dangaard Brouer | a6e8f27 | 2009-02-22 00:07:13 -0800 | [diff] [blame] | 71 | Use new experimental LC-trie as FIB lookup algorithm. |
| 72 | This improves lookup performance if you have a large |
| 73 | number of routes. |
David S. Miller | bb298ca | 2005-06-24 17:50:53 -0700 | [diff] [blame] | 74 | |
Jesper Dangaard Brouer | a6e8f27 | 2009-02-22 00:07:13 -0800 | [diff] [blame] | 75 | LC-trie is a longest matching prefix lookup algorithm which |
| 76 | performs better than FIB_HASH for large routing tables. |
| 77 | But, it consumes more memory and is more complex. |
| 78 | |
| 79 | LC-trie is described in: |
| 80 | |
| 81 | IP-address lookup using LC-tries. Stefan Nilsson and Gunnar Karlsson |
| 82 | IEEE Journal on Selected Areas in Communications, 17(6):1083-1092, |
| 83 | June 1999 |
| 84 | |
| 85 | An experimental study of compression methods for dynamic tries |
| 86 | Stefan Nilsson and Matti Tikkanen. Algorithmica, 33(1):19-33, 2002. |
| 87 | http://www.nada.kth.se/~snilsson/public/papers/dyntrie2/ |
| 88 | |
David S. Miller | bb298ca | 2005-06-24 17:50:53 -0700 | [diff] [blame] | 89 | endchoice |
| 90 | |
David S. Miller | bb298ca | 2005-06-24 17:50:53 -0700 | [diff] [blame] | 91 | config IP_FIB_HASH |
Adrian Bunk | 6876f95 | 2005-07-18 13:55:19 -0700 | [diff] [blame] | 92 | def_bool ASK_IP_FIB_HASH || !IP_ADVANCED_ROUTER |
David S. Miller | bb298ca | 2005-06-24 17:50:53 -0700 | [diff] [blame] | 93 | |
Stephen Hemminger | 66a2f7f | 2008-01-12 21:23:17 -0800 | [diff] [blame] | 94 | config IP_FIB_TRIE_STATS |
| 95 | bool "FIB TRIE statistics" |
| 96 | depends on IP_FIB_TRIE |
| 97 | ---help--- |
| 98 | Keep track of statistics on structure of FIB TRIE table. |
| 99 | Useful for testing and measuring TRIE performance. |
| 100 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 101 | config IP_MULTIPLE_TABLES |
| 102 | bool "IP: policy routing" |
| 103 | depends on IP_ADVANCED_ROUTER |
Thomas Graf | e1ef4bf | 2006-08-04 03:39:22 -0700 | [diff] [blame] | 104 | select FIB_RULES |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 105 | ---help--- |
| 106 | Normally, a router decides what to do with a received packet based |
| 107 | solely on the packet's final destination address. If you say Y here, |
| 108 | the Linux router will also be able to take the packet's source |
| 109 | address into account. Furthermore, the TOS (Type-Of-Service) field |
| 110 | of the packet can be used for routing decisions as well. |
| 111 | |
| 112 | If you are interested in this, please see the preliminary |
| 113 | documentation at <http://www.compendium.com.ar/policy-routing.txt> |
| 114 | and <ftp://post.tepkom.ru/pub/vol2/Linux/docs/advanced-routing.tex>. |
| 115 | You will need supporting software from |
| 116 | <ftp://ftp.tux.org/pub/net/ip-routing/>. |
| 117 | |
| 118 | If unsure, say N. |
| 119 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 120 | config IP_ROUTE_MULTIPATH |
| 121 | bool "IP: equal cost multipath" |
| 122 | depends on IP_ADVANCED_ROUTER |
| 123 | help |
| 124 | Normally, the routing tables specify a single action to be taken in |
| 125 | a deterministic manner for a given packet. If you say Y here |
| 126 | however, it becomes possible to attach several actions to a packet |
| 127 | pattern, in effect specifying several alternative paths to travel |
| 128 | for those packets. The router considers all these paths to be of |
| 129 | equal "cost" and chooses one of them in a non-deterministic fashion |
| 130 | if a matching packet arrives. |
| 131 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 132 | config IP_ROUTE_VERBOSE |
| 133 | bool "IP: verbose route monitoring" |
| 134 | depends on IP_ADVANCED_ROUTER |
| 135 | help |
| 136 | If you say Y here, which is recommended, then the kernel will print |
| 137 | verbose messages regarding the routing, for example warnings about |
| 138 | received packets which look strange and could be evidence of an |
| 139 | attack or a misconfigured system somewhere. The information is |
| 140 | handled by the klogd daemon which is responsible for kernel messages |
| 141 | ("man klogd"). |
| 142 | |
| 143 | config IP_PNP |
| 144 | bool "IP: kernel level autoconfiguration" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 145 | help |
| 146 | This enables automatic configuration of IP addresses of devices and |
| 147 | of the routing table during kernel boot, based on either information |
| 148 | supplied on the kernel command line or by BOOTP or RARP protocols. |
| 149 | You need to say Y only for diskless machines requiring network |
| 150 | access to boot (in which case you want to say Y to "Root file system |
| 151 | on NFS" as well), because all other machines configure the network |
| 152 | in their startup scripts. |
| 153 | |
| 154 | config IP_PNP_DHCP |
| 155 | bool "IP: DHCP support" |
| 156 | depends on IP_PNP |
| 157 | ---help--- |
| 158 | If you want your Linux box to mount its whole root file system (the |
| 159 | one containing the directory /) from some other computer over the |
| 160 | net via NFS and you want the IP address of your computer to be |
| 161 | discovered automatically at boot time using the DHCP protocol (a |
| 162 | special protocol designed for doing this job), say Y here. In case |
| 163 | the boot ROM of your network card was designed for booting Linux and |
| 164 | does DHCP itself, providing all necessary information on the kernel |
| 165 | command line, you can say N here. |
| 166 | |
| 167 | If unsure, say Y. Note that if you want to use DHCP, a DHCP server |
| 168 | must be operating on your network. Read |
J. Bruce Fields | 6ded55d | 2008-04-07 15:59:03 -0400 | [diff] [blame] | 169 | <file:Documentation/filesystems/nfsroot.txt> for details. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 170 | |
| 171 | config IP_PNP_BOOTP |
| 172 | bool "IP: BOOTP support" |
| 173 | depends on IP_PNP |
| 174 | ---help--- |
| 175 | If you want your Linux box to mount its whole root file system (the |
| 176 | one containing the directory /) from some other computer over the |
| 177 | net via NFS and you want the IP address of your computer to be |
| 178 | discovered automatically at boot time using the BOOTP protocol (a |
| 179 | special protocol designed for doing this job), say Y here. In case |
| 180 | the boot ROM of your network card was designed for booting Linux and |
| 181 | does BOOTP itself, providing all necessary information on the kernel |
| 182 | command line, you can say N here. If unsure, say Y. Note that if you |
| 183 | want to use BOOTP, a BOOTP server must be operating on your network. |
J. Bruce Fields | 6ded55d | 2008-04-07 15:59:03 -0400 | [diff] [blame] | 184 | Read <file:Documentation/filesystems/nfsroot.txt> for details. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 185 | |
| 186 | config IP_PNP_RARP |
| 187 | bool "IP: RARP support" |
| 188 | depends on IP_PNP |
| 189 | help |
| 190 | If you want your Linux box to mount its whole root file system (the |
| 191 | one containing the directory /) from some other computer over the |
| 192 | net via NFS and you want the IP address of your computer to be |
| 193 | discovered automatically at boot time using the RARP protocol (an |
| 194 | older protocol which is being obsoleted by BOOTP and DHCP), say Y |
| 195 | here. Note that if you want to use RARP, a RARP server must be |
J. Bruce Fields | 6ded55d | 2008-04-07 15:59:03 -0400 | [diff] [blame] | 196 | operating on your network. Read |
| 197 | <file:Documentation/filesystems/nfsroot.txt> for details. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 198 | |
| 199 | # not yet ready.. |
Jesper Dangaard Brouer | a6e8f27 | 2009-02-22 00:07:13 -0800 | [diff] [blame] | 200 | # bool ' IP: ARP support' CONFIG_IP_PNP_ARP |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 201 | config NET_IPIP |
| 202 | tristate "IP: tunneling" |
Herbert Xu | d2acc34 | 2006-03-28 01:12:13 -0800 | [diff] [blame] | 203 | select INET_TUNNEL |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 204 | ---help--- |
| 205 | Tunneling means encapsulating data of one protocol type within |
| 206 | another protocol and sending it over a channel that understands the |
| 207 | encapsulating protocol. This particular tunneling driver implements |
| 208 | encapsulation of IP within IP, which sounds kind of pointless, but |
| 209 | can be useful if you want to make your (or some other) machine |
| 210 | appear on a different network than it physically is, or to use |
| 211 | mobile-IP facilities (allowing laptops to seamlessly move between |
| 212 | networks without changing their IP addresses). |
| 213 | |
| 214 | Saying Y to this option will produce two modules ( = code which can |
| 215 | be inserted in and removed from the running kernel whenever you |
| 216 | want). Most people won't need this and can say N. |
| 217 | |
| 218 | config NET_IPGRE |
| 219 | tristate "IP: GRE tunnels over IP" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 220 | help |
| 221 | Tunneling means encapsulating data of one protocol type within |
| 222 | another protocol and sending it over a channel that understands the |
| 223 | encapsulating protocol. This particular tunneling driver implements |
| 224 | GRE (Generic Routing Encapsulation) and at this time allows |
| 225 | encapsulating of IPv4 or IPv6 over existing IPv4 infrastructure. |
| 226 | This driver is useful if the other endpoint is a Cisco router: Cisco |
| 227 | likes GRE much better than the other Linux tunneling driver ("IP |
| 228 | tunneling" above). In addition, GRE allows multicast redistribution |
| 229 | through the tunnel. |
| 230 | |
| 231 | config NET_IPGRE_BROADCAST |
| 232 | bool "IP: broadcast GRE over IP" |
| 233 | depends on IP_MULTICAST && NET_IPGRE |
| 234 | help |
| 235 | One application of GRE/IP is to construct a broadcast WAN (Wide Area |
| 236 | Network), which looks like a normal Ethernet LAN (Local Area |
| 237 | Network), but can be distributed all over the Internet. If you want |
| 238 | to do that, say Y here and to "IP multicast routing" below. |
| 239 | |
| 240 | config IP_MROUTE |
| 241 | bool "IP: multicast routing" |
| 242 | depends on IP_MULTICAST |
| 243 | help |
| 244 | This is used if you want your machine to act as a router for IP |
| 245 | packets that have several destination addresses. It is needed on the |
| 246 | MBONE, a high bandwidth network on top of the Internet which carries |
| 247 | audio and video broadcasts. In order to do that, you would most |
| 248 | likely run the program mrouted. Information about the multicast |
| 249 | capabilities of the various network cards is contained in |
| 250 | <file:Documentation/networking/multicast.txt>. If you haven't heard |
| 251 | about it, you don't need it. |
| 252 | |
| 253 | config IP_PIMSM_V1 |
| 254 | bool "IP: PIM-SM version 1 support" |
| 255 | depends on IP_MROUTE |
| 256 | help |
| 257 | Kernel side support for Sparse Mode PIM (Protocol Independent |
| 258 | Multicast) version 1. This multicast routing protocol is used widely |
| 259 | because Cisco supports it. You need special software to use it |
| 260 | (pimd-v1). Please see <http://netweb.usc.edu/pim/> for more |
| 261 | information about PIM. |
| 262 | |
| 263 | Say Y if you want to use PIM-SM v1. Note that you can say N here if |
| 264 | you just want to use Dense Mode PIM. |
| 265 | |
| 266 | config IP_PIMSM_V2 |
| 267 | bool "IP: PIM-SM version 2 support" |
| 268 | depends on IP_MROUTE |
| 269 | help |
| 270 | Kernel side support for Sparse Mode PIM version 2. In order to use |
| 271 | this, you need an experimental routing daemon supporting it (pimd or |
| 272 | gated-5). This routing protocol is not used widely, so say N unless |
| 273 | you want to play with it. |
| 274 | |
| 275 | config ARPD |
| 276 | bool "IP: ARP daemon support (EXPERIMENTAL)" |
Sam Ravnborg | 6a2e9b7 | 2005-07-11 21:13:56 -0700 | [diff] [blame] | 277 | depends on EXPERIMENTAL |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 278 | ---help--- |
| 279 | Normally, the kernel maintains an internal cache which maps IP |
| 280 | addresses to hardware addresses on the local network, so that |
| 281 | Ethernet/Token Ring/ etc. frames are sent to the proper address on |
| 282 | the physical networking layer. For small networks having a few |
| 283 | hundred directly connected hosts or less, keeping this address |
| 284 | resolution (ARP) cache inside the kernel works well. However, |
| 285 | maintaining an internal ARP cache does not work well for very large |
| 286 | switched networks, and will use a lot of kernel memory if TCP/IP |
| 287 | connections are made to many machines on the network. |
| 288 | |
| 289 | If you say Y here, the kernel's internal ARP cache will never grow |
| 290 | to more than 256 entries (the oldest entries are expired in a LIFO |
| 291 | manner) and communication will be attempted with the user space ARP |
| 292 | daemon arpd. Arpd then answers the address resolution request either |
| 293 | from its own cache or by asking the net. |
| 294 | |
| 295 | This code is experimental and also obsolete. If you want to use it, |
| 296 | you need to find a version of the daemon arpd on the net somewhere, |
| 297 | and you should also say Y to "Kernel/User network link driver", |
| 298 | below. If unsure, say N. |
| 299 | |
| 300 | config SYN_COOKIES |
| 301 | bool "IP: TCP syncookie support (disabled per default)" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 302 | ---help--- |
| 303 | Normal TCP/IP networking is open to an attack known as "SYN |
| 304 | flooding". This denial-of-service attack prevents legitimate remote |
| 305 | users from being able to connect to your computer during an ongoing |
| 306 | attack and requires very little work from the attacker, who can |
| 307 | operate from anywhere on the Internet. |
| 308 | |
| 309 | SYN cookies provide protection against this type of attack. If you |
| 310 | say Y here, the TCP/IP stack will use a cryptographic challenge |
| 311 | protocol known as "SYN cookies" to enable legitimate users to |
| 312 | continue to connect, even when your machine is under attack. There |
| 313 | is no need for the legitimate users to change their TCP/IP software; |
| 314 | SYN cookies work transparently to them. For technical information |
| 315 | about SYN cookies, check out <http://cr.yp.to/syncookies.html>. |
| 316 | |
| 317 | If you are SYN flooded, the source address reported by the kernel is |
| 318 | likely to have been forged by the attacker; it is only reported as |
| 319 | an aid in tracing the packets to their actual source and should not |
| 320 | be taken as absolute truth. |
| 321 | |
| 322 | SYN cookies may prevent correct error reporting on clients when the |
| 323 | server is really overloaded. If this happens frequently better turn |
| 324 | them off. |
| 325 | |
| 326 | If you say Y here, note that SYN cookies aren't enabled by default; |
| 327 | you can enable them by saying Y to "/proc file system support" and |
| 328 | "Sysctl support" below and executing the command |
| 329 | |
| 330 | echo 1 >/proc/sys/net/ipv4/tcp_syncookies |
| 331 | |
| 332 | at boot time after the /proc file system has been mounted. |
| 333 | |
| 334 | If unsure, say N. |
| 335 | |
| 336 | config INET_AH |
| 337 | tristate "IP: AH transformation" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 338 | select XFRM |
| 339 | select CRYPTO |
| 340 | select CRYPTO_HMAC |
| 341 | select CRYPTO_MD5 |
| 342 | select CRYPTO_SHA1 |
| 343 | ---help--- |
| 344 | Support for IPsec AH. |
| 345 | |
| 346 | If unsure, say Y. |
| 347 | |
| 348 | config INET_ESP |
| 349 | tristate "IP: ESP transformation" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 350 | select XFRM |
| 351 | select CRYPTO |
Herbert Xu | ed58dd4 | 2008-03-04 14:29:21 -0800 | [diff] [blame] | 352 | select CRYPTO_AUTHENC |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 353 | select CRYPTO_HMAC |
| 354 | select CRYPTO_MD5 |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 355 | select CRYPTO_CBC |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 356 | select CRYPTO_SHA1 |
| 357 | select CRYPTO_DES |
| 358 | ---help--- |
| 359 | Support for IPsec ESP. |
| 360 | |
| 361 | If unsure, say Y. |
| 362 | |
| 363 | config INET_IPCOMP |
| 364 | tristate "IP: IPComp transformation" |
Herbert Xu | d2acc34 | 2006-03-28 01:12:13 -0800 | [diff] [blame] | 365 | select INET_XFRM_TUNNEL |
Herbert Xu | 6fccab6 | 2008-07-25 02:54:40 -0700 | [diff] [blame] | 366 | select XFRM_IPCOMP |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 367 | ---help--- |
| 368 | Support for IP Payload Compression Protocol (IPComp) (RFC3173), |
| 369 | typically needed for IPsec. |
Jesper Dangaard Brouer | a6e8f27 | 2009-02-22 00:07:13 -0800 | [diff] [blame] | 370 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 371 | If unsure, say Y. |
| 372 | |
Herbert Xu | d2acc34 | 2006-03-28 01:12:13 -0800 | [diff] [blame] | 373 | config INET_XFRM_TUNNEL |
| 374 | tristate |
| 375 | select INET_TUNNEL |
| 376 | default n |
| 377 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 378 | config INET_TUNNEL |
Herbert Xu | d2acc34 | 2006-03-28 01:12:13 -0800 | [diff] [blame] | 379 | tristate |
| 380 | default n |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 381 | |
Herbert Xu | b59f45d | 2006-05-27 23:05:54 -0700 | [diff] [blame] | 382 | config INET_XFRM_MODE_TRANSPORT |
| 383 | tristate "IP: IPsec transport mode" |
| 384 | default y |
| 385 | select XFRM |
| 386 | ---help--- |
| 387 | Support for IPsec transport mode. |
| 388 | |
| 389 | If unsure, say Y. |
| 390 | |
| 391 | config INET_XFRM_MODE_TUNNEL |
| 392 | tristate "IP: IPsec tunnel mode" |
| 393 | default y |
| 394 | select XFRM |
| 395 | ---help--- |
| 396 | Support for IPsec tunnel mode. |
| 397 | |
| 398 | If unsure, say Y. |
| 399 | |
Diego Beltrami | 0a69452 | 2006-10-03 23:47:05 -0700 | [diff] [blame] | 400 | config INET_XFRM_MODE_BEET |
| 401 | tristate "IP: IPsec BEET mode" |
| 402 | default y |
| 403 | select XFRM |
| 404 | ---help--- |
| 405 | Support for IPsec BEET mode. |
| 406 | |
| 407 | If unsure, say Y. |
| 408 | |
Jan-Bernd Themann | 71c87e0 | 2007-08-08 22:38:05 -0700 | [diff] [blame] | 409 | config INET_LRO |
David S. Miller | e81963b | 2009-05-08 12:45:26 -0700 | [diff] [blame^] | 410 | bool "Large Receive Offload (ipv4/tcp)" |
Jan-Bernd Themann | 71c87e0 | 2007-08-08 22:38:05 -0700 | [diff] [blame] | 411 | |
| 412 | ---help--- |
| 413 | Support for Large Receive Offload (ipv4/tcp). |
| 414 | |
| 415 | If unsure, say Y. |
| 416 | |
Arnaldo Carvalho de Melo | 17b085e | 2005-08-12 12:59:17 -0300 | [diff] [blame] | 417 | config INET_DIAG |
| 418 | tristate "INET: socket monitoring interface" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 419 | default y |
| 420 | ---help--- |
Arnaldo Carvalho de Melo | 73c1f4a | 2005-08-12 12:51:49 -0300 | [diff] [blame] | 421 | Support for INET (TCP, DCCP, etc) socket monitoring interface used by |
| 422 | native Linux tools such as ss. ss is included in iproute2, currently |
Baruch Even | f4b9479 | 2007-02-21 19:32:37 -0800 | [diff] [blame] | 423 | downloadable at <http://linux-net.osdl.org/index.php/Iproute2>. |
Jesper Dangaard Brouer | a6e8f27 | 2009-02-22 00:07:13 -0800 | [diff] [blame] | 424 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 425 | If unsure, say Y. |
| 426 | |
Arnaldo Carvalho de Melo | 17b085e | 2005-08-12 12:59:17 -0300 | [diff] [blame] | 427 | config INET_TCP_DIAG |
| 428 | depends on INET_DIAG |
| 429 | def_tristate INET_DIAG |
| 430 | |
Stephen Hemminger | 3d2573f | 2006-09-24 20:11:58 -0700 | [diff] [blame] | 431 | menuconfig TCP_CONG_ADVANCED |
David S. Miller | a648404 | 2005-06-24 18:07:51 -0700 | [diff] [blame] | 432 | bool "TCP: advanced congestion control" |
David S. Miller | a648404 | 2005-06-24 18:07:51 -0700 | [diff] [blame] | 433 | ---help--- |
| 434 | Support for selection of various TCP congestion control |
| 435 | modules. |
| 436 | |
| 437 | Nearly all users can safely say no here, and a safe default |
Stephen Hemminger | 597811e | 2006-09-24 20:13:03 -0700 | [diff] [blame] | 438 | selection will be made (CUBIC with new Reno as a fallback). |
David S. Miller | a648404 | 2005-06-24 18:07:51 -0700 | [diff] [blame] | 439 | |
| 440 | If unsure, say N. |
| 441 | |
Stephen Hemminger | 3d2573f | 2006-09-24 20:11:58 -0700 | [diff] [blame] | 442 | if TCP_CONG_ADVANCED |
Stephen Hemminger | 8380303 | 2005-06-23 12:23:25 -0700 | [diff] [blame] | 443 | |
| 444 | config TCP_CONG_BIC |
| 445 | tristate "Binary Increase Congestion (BIC) control" |
Stephen Hemminger | 597811e | 2006-09-24 20:13:03 -0700 | [diff] [blame] | 446 | default m |
Stephen Hemminger | 8380303 | 2005-06-23 12:23:25 -0700 | [diff] [blame] | 447 | ---help--- |
| 448 | BIC-TCP is a sender-side only change that ensures a linear RTT |
| 449 | fairness under large windows while offering both scalability and |
| 450 | bounded TCP-friendliness. The protocol combines two schemes |
| 451 | called additive increase and binary search increase. When the |
| 452 | congestion window is large, additive increase with a large |
| 453 | increment ensures linear RTT fairness as well as good |
| 454 | scalability. Under small congestion windows, binary search |
| 455 | increase provides TCP friendliness. |
| 456 | See http://www.csc.ncsu.edu/faculty/rhee/export/bitcp/ |
| 457 | |
Stephen Hemminger | df3271f | 2005-12-13 23:13:28 -0800 | [diff] [blame] | 458 | config TCP_CONG_CUBIC |
| 459 | tristate "CUBIC TCP" |
Stephen Hemminger | 597811e | 2006-09-24 20:13:03 -0700 | [diff] [blame] | 460 | default y |
Stephen Hemminger | df3271f | 2005-12-13 23:13:28 -0800 | [diff] [blame] | 461 | ---help--- |
| 462 | This is version 2.0 of BIC-TCP which uses a cubic growth function |
| 463 | among other techniques. |
| 464 | See http://www.csc.ncsu.edu/faculty/rhee/export/bitcp/cubic-paper.pdf |
| 465 | |
Stephen Hemminger | 8727076 | 2005-06-23 12:24:09 -0700 | [diff] [blame] | 466 | config TCP_CONG_WESTWOOD |
| 467 | tristate "TCP Westwood+" |
Stephen Hemminger | 8727076 | 2005-06-23 12:24:09 -0700 | [diff] [blame] | 468 | default m |
| 469 | ---help--- |
| 470 | TCP Westwood+ is a sender-side only modification of the TCP Reno |
| 471 | protocol stack that optimizes the performance of TCP congestion |
| 472 | control. It is based on end-to-end bandwidth estimation to set |
| 473 | congestion window and slow start threshold after a congestion |
| 474 | episode. Using this estimation, TCP Westwood+ adaptively sets a |
| 475 | slow start threshold and a congestion window which takes into |
| 476 | account the bandwidth used at the time congestion is experienced. |
| 477 | TCP Westwood+ significantly increases fairness wrt TCP Reno in |
| 478 | wired networks and throughput over wireless links. |
| 479 | |
Baruch Even | a7868ea | 2005-06-23 12:28:11 -0700 | [diff] [blame] | 480 | config TCP_CONG_HTCP |
| 481 | tristate "H-TCP" |
Baruch Even | a7868ea | 2005-06-23 12:28:11 -0700 | [diff] [blame] | 482 | default m |
| 483 | ---help--- |
| 484 | H-TCP is a send-side only modifications of the TCP Reno |
| 485 | protocol stack that optimizes the performance of TCP |
| 486 | congestion control for high speed network links. It uses a |
| 487 | modeswitch to change the alpha and beta parameters of TCP Reno |
| 488 | based on network conditions and in a way so as to be fair with |
| 489 | other Reno and H-TCP flows. |
| 490 | |
John Heffner | a628d29 | 2005-06-23 12:24:58 -0700 | [diff] [blame] | 491 | config TCP_CONG_HSTCP |
| 492 | tristate "High Speed TCP" |
Sam Ravnborg | 6a2e9b7 | 2005-07-11 21:13:56 -0700 | [diff] [blame] | 493 | depends on EXPERIMENTAL |
John Heffner | a628d29 | 2005-06-23 12:24:58 -0700 | [diff] [blame] | 494 | default n |
| 495 | ---help--- |
| 496 | Sally Floyd's High Speed TCP (RFC 3649) congestion control. |
| 497 | A modification to TCP's congestion control mechanism for use |
| 498 | with large congestion windows. A table indicates how much to |
| 499 | increase the congestion window by when an ACK is received. |
| 500 | For more detail see http://www.icir.org/floyd/hstcp.html |
| 501 | |
Daniele Lacamera | 835b3f0 | 2005-06-23 12:26:34 -0700 | [diff] [blame] | 502 | config TCP_CONG_HYBLA |
| 503 | tristate "TCP-Hybla congestion control algorithm" |
Sam Ravnborg | 6a2e9b7 | 2005-07-11 21:13:56 -0700 | [diff] [blame] | 504 | depends on EXPERIMENTAL |
Daniele Lacamera | 835b3f0 | 2005-06-23 12:26:34 -0700 | [diff] [blame] | 505 | default n |
| 506 | ---help--- |
| 507 | TCP-Hybla is a sender-side only change that eliminates penalization of |
| 508 | long-RTT, large-bandwidth connections, like when satellite legs are |
Matt LaPlante | 44c0920 | 2006-10-03 22:34:14 +0200 | [diff] [blame] | 509 | involved, especially when sharing a common bottleneck with normal |
Daniele Lacamera | 835b3f0 | 2005-06-23 12:26:34 -0700 | [diff] [blame] | 510 | terrestrial connections. |
| 511 | |
Stephen Hemminger | b87d856 | 2005-06-23 12:27:19 -0700 | [diff] [blame] | 512 | config TCP_CONG_VEGAS |
| 513 | tristate "TCP Vegas" |
Sam Ravnborg | 6a2e9b7 | 2005-07-11 21:13:56 -0700 | [diff] [blame] | 514 | depends on EXPERIMENTAL |
Stephen Hemminger | b87d856 | 2005-06-23 12:27:19 -0700 | [diff] [blame] | 515 | default n |
| 516 | ---help--- |
| 517 | TCP Vegas is a sender-side only change to TCP that anticipates |
| 518 | the onset of congestion by estimating the bandwidth. TCP Vegas |
| 519 | adjusts the sending rate by modifying the congestion |
| 520 | window. TCP Vegas should provide less packet loss, but it is |
| 521 | not as aggressive as TCP Reno. |
| 522 | |
John Heffner | 0e57976 | 2005-06-23 12:29:07 -0700 | [diff] [blame] | 523 | config TCP_CONG_SCALABLE |
| 524 | tristate "Scalable TCP" |
Sam Ravnborg | 6a2e9b7 | 2005-07-11 21:13:56 -0700 | [diff] [blame] | 525 | depends on EXPERIMENTAL |
John Heffner | 0e57976 | 2005-06-23 12:29:07 -0700 | [diff] [blame] | 526 | default n |
| 527 | ---help--- |
| 528 | Scalable TCP is a sender-side only change to TCP which uses a |
| 529 | MIMD congestion control algorithm which has some nice scaling |
| 530 | properties, though is known to have fairness issues. |
Baruch Even | f4b9479 | 2007-02-21 19:32:37 -0800 | [diff] [blame] | 531 | See http://www.deneholme.net/tom/scalable/ |
Baruch Even | a7868ea | 2005-06-23 12:28:11 -0700 | [diff] [blame] | 532 | |
Wong Hoi Sing Edison | 7c106d7 | 2006-06-05 17:27:58 -0700 | [diff] [blame] | 533 | config TCP_CONG_LP |
| 534 | tristate "TCP Low Priority" |
| 535 | depends on EXPERIMENTAL |
| 536 | default n |
| 537 | ---help--- |
| 538 | TCP Low Priority (TCP-LP), a distributed algorithm whose goal is |
Matt LaPlante | cab0089 | 2006-10-03 22:36:44 +0200 | [diff] [blame] | 539 | to utilize only the excess network bandwidth as compared to the |
Wong Hoi Sing Edison | 7c106d7 | 2006-06-05 17:27:58 -0700 | [diff] [blame] | 540 | ``fair share`` of bandwidth as targeted by TCP. |
| 541 | See http://www-ece.rice.edu/networks/TCP-LP/ |
| 542 | |
Bin Zhou | 76f1017 | 2006-06-05 17:28:30 -0700 | [diff] [blame] | 543 | config TCP_CONG_VENO |
| 544 | tristate "TCP Veno" |
| 545 | depends on EXPERIMENTAL |
| 546 | default n |
| 547 | ---help--- |
| 548 | TCP Veno is a sender-side only enhancement of TCP to obtain better |
| 549 | throughput over wireless networks. TCP Veno makes use of state |
| 550 | distinguishing to circumvent the difficult judgment of the packet loss |
| 551 | type. TCP Veno cuts down less congestion window in response to random |
| 552 | loss packets. |
| 553 | See http://www.ntu.edu.sg/home5/ZHOU0022/papers/CPFu03a.pdf |
| 554 | |
Angelo P. Castellani | 5ef8147 | 2007-02-22 00:23:05 -0800 | [diff] [blame] | 555 | config TCP_CONG_YEAH |
| 556 | tristate "YeAH TCP" |
| 557 | depends on EXPERIMENTAL |
David S. Miller | 2ff011e | 2007-05-17 00:07:47 -0700 | [diff] [blame] | 558 | select TCP_CONG_VEGAS |
Angelo P. Castellani | 5ef8147 | 2007-02-22 00:23:05 -0800 | [diff] [blame] | 559 | default n |
| 560 | ---help--- |
| 561 | YeAH-TCP is a sender-side high-speed enabled TCP congestion control |
| 562 | algorithm, which uses a mixed loss/delay approach to compute the |
| 563 | congestion window. It's design goals target high efficiency, |
| 564 | internal, RTT and Reno fairness, resilience to link loss while |
| 565 | keeping network elements load as low as possible. |
| 566 | |
| 567 | For further details look here: |
| 568 | http://wil.cs.caltech.edu/pfldnet2007/paper/YeAH_TCP.pdf |
| 569 | |
Stephen Hemminger | c462238 | 2007-04-20 17:07:51 -0700 | [diff] [blame] | 570 | config TCP_CONG_ILLINOIS |
| 571 | tristate "TCP Illinois" |
| 572 | depends on EXPERIMENTAL |
| 573 | default n |
| 574 | ---help--- |
Matt LaPlante | 01dd2fb | 2007-10-20 01:34:40 +0200 | [diff] [blame] | 575 | TCP-Illinois is a sender-side modification of TCP Reno for |
Stephen Hemminger | c462238 | 2007-04-20 17:07:51 -0700 | [diff] [blame] | 576 | high speed long delay links. It uses round-trip-time to |
| 577 | adjust the alpha and beta parameters to achieve a higher average |
| 578 | throughput and maintain fairness. |
| 579 | |
| 580 | For further details see: |
| 581 | http://www.ews.uiuc.edu/~shaoliu/tcpillinois/index.html |
| 582 | |
Stephen Hemminger | 3d2573f | 2006-09-24 20:11:58 -0700 | [diff] [blame] | 583 | choice |
| 584 | prompt "Default TCP congestion control" |
Stephen Hemminger | 597811e | 2006-09-24 20:13:03 -0700 | [diff] [blame] | 585 | default DEFAULT_CUBIC |
Stephen Hemminger | 3d2573f | 2006-09-24 20:11:58 -0700 | [diff] [blame] | 586 | help |
| 587 | Select the TCP congestion control that will be used by default |
| 588 | for all connections. |
| 589 | |
| 590 | config DEFAULT_BIC |
| 591 | bool "Bic" if TCP_CONG_BIC=y |
| 592 | |
| 593 | config DEFAULT_CUBIC |
| 594 | bool "Cubic" if TCP_CONG_CUBIC=y |
| 595 | |
| 596 | config DEFAULT_HTCP |
| 597 | bool "Htcp" if TCP_CONG_HTCP=y |
| 598 | |
| 599 | config DEFAULT_VEGAS |
| 600 | bool "Vegas" if TCP_CONG_VEGAS=y |
| 601 | |
| 602 | config DEFAULT_WESTWOOD |
| 603 | bool "Westwood" if TCP_CONG_WESTWOOD=y |
| 604 | |
| 605 | config DEFAULT_RENO |
| 606 | bool "Reno" |
| 607 | |
| 608 | endchoice |
| 609 | |
| 610 | endif |
Stephen Hemminger | 8380303 | 2005-06-23 12:23:25 -0700 | [diff] [blame] | 611 | |
Stephen Hemminger | 597811e | 2006-09-24 20:13:03 -0700 | [diff] [blame] | 612 | config TCP_CONG_CUBIC |
David S. Miller | 6c36076 | 2005-06-26 15:20:20 -0700 | [diff] [blame] | 613 | tristate |
David S. Miller | a648404 | 2005-06-24 18:07:51 -0700 | [diff] [blame] | 614 | depends on !TCP_CONG_ADVANCED |
| 615 | default y |
| 616 | |
Stephen Hemminger | 3d2573f | 2006-09-24 20:11:58 -0700 | [diff] [blame] | 617 | config DEFAULT_TCP_CONG |
| 618 | string |
| 619 | default "bic" if DEFAULT_BIC |
| 620 | default "cubic" if DEFAULT_CUBIC |
| 621 | default "htcp" if DEFAULT_HTCP |
| 622 | default "vegas" if DEFAULT_VEGAS |
| 623 | default "westwood" if DEFAULT_WESTWOOD |
| 624 | default "reno" if DEFAULT_RENO |
Stephen Hemminger | 597811e | 2006-09-24 20:13:03 -0700 | [diff] [blame] | 625 | default "cubic" |
Stephen Hemminger | 3d2573f | 2006-09-24 20:11:58 -0700 | [diff] [blame] | 626 | |
YOSHIFUJI Hideaki | cfb6eeb | 2006-11-14 19:07:45 -0800 | [diff] [blame] | 627 | config TCP_MD5SIG |
| 628 | bool "TCP: MD5 Signature Option support (RFC2385) (EXPERIMENTAL)" |
| 629 | depends on EXPERIMENTAL |
| 630 | select CRYPTO |
| 631 | select CRYPTO_MD5 |
| 632 | ---help--- |
David Sterba | 3dde6ad | 2007-05-09 07:12:20 +0200 | [diff] [blame] | 633 | RFC2385 specifies a method of giving MD5 protection to TCP sessions. |
YOSHIFUJI Hideaki | cfb6eeb | 2006-11-14 19:07:45 -0800 | [diff] [blame] | 634 | Its main (only?) use is to protect BGP sessions between core routers |
| 635 | on the Internet. |
| 636 | |
| 637 | If unsure, say N. |
| 638 | |