nf_conntrack-sysctl.rst 4.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179
  1. .. SPDX-License-Identifier: GPL-2.0
  2. ===================================
  3. Netfilter Conntrack Sysfs variables
  4. ===================================
  5. /proc/sys/net/netfilter/nf_conntrack_* Variables:
  6. =================================================
  7. nf_conntrack_acct - BOOLEAN
  8. - 0 - disabled (default)
  9. - not 0 - enabled
  10. Enable connection tracking flow accounting. 64-bit byte and packet
  11. counters per flow are added.
  12. nf_conntrack_buckets - INTEGER
  13. Size of hash table. If not specified as parameter during module
  14. loading, the default size is calculated by dividing total memory
  15. by 16384 to determine the number of buckets but the hash table will
  16. never have fewer than 32 and limited to 16384 buckets. For systems
  17. with more than 4GB of memory it will be 65536 buckets.
  18. This sysctl is only writeable in the initial net namespace.
  19. nf_conntrack_checksum - BOOLEAN
  20. - 0 - disabled
  21. - not 0 - enabled (default)
  22. Verify checksum of incoming packets. Packets with bad checksums are
  23. in INVALID state. If this is enabled, such packets will not be
  24. considered for connection tracking.
  25. nf_conntrack_count - INTEGER (read-only)
  26. Number of currently allocated flow entries.
  27. nf_conntrack_events - BOOLEAN
  28. - 0 - disabled
  29. - not 0 - enabled (default)
  30. If this option is enabled, the connection tracking code will
  31. provide userspace with connection tracking events via ctnetlink.
  32. nf_conntrack_expect_max - INTEGER
  33. Maximum size of expectation table. Default value is
  34. nf_conntrack_buckets / 256. Minimum is 1.
  35. nf_conntrack_frag6_high_thresh - INTEGER
  36. default 262144
  37. Maximum memory used to reassemble IPv6 fragments. When
  38. nf_conntrack_frag6_high_thresh bytes of memory is allocated for this
  39. purpose, the fragment handler will toss packets until
  40. nf_conntrack_frag6_low_thresh is reached.
  41. nf_conntrack_frag6_low_thresh - INTEGER
  42. default 196608
  43. See nf_conntrack_frag6_low_thresh
  44. nf_conntrack_frag6_timeout - INTEGER (seconds)
  45. default 60
  46. Time to keep an IPv6 fragment in memory.
  47. nf_conntrack_generic_timeout - INTEGER (seconds)
  48. default 600
  49. Default for generic timeout. This refers to layer 4 unknown/unsupported
  50. protocols.
  51. nf_conntrack_helper - BOOLEAN
  52. - 0 - disabled (default)
  53. - not 0 - enabled
  54. Enable automatic conntrack helper assignment.
  55. If disabled it is required to set up iptables rules to assign
  56. helpers to connections. See the CT target description in the
  57. iptables-extensions(8) man page for further information.
  58. nf_conntrack_icmp_timeout - INTEGER (seconds)
  59. default 30
  60. Default for ICMP timeout.
  61. nf_conntrack_icmpv6_timeout - INTEGER (seconds)
  62. default 30
  63. Default for ICMP6 timeout.
  64. nf_conntrack_log_invalid - INTEGER
  65. - 0 - disable (default)
  66. - 1 - log ICMP packets
  67. - 6 - log TCP packets
  68. - 17 - log UDP packets
  69. - 33 - log DCCP packets
  70. - 41 - log ICMPv6 packets
  71. - 136 - log UDPLITE packets
  72. - 255 - log packets of any protocol
  73. Log invalid packets of a type specified by value.
  74. nf_conntrack_max - INTEGER
  75. Size of connection tracking table. Default value is
  76. nf_conntrack_buckets value * 4.
  77. nf_conntrack_tcp_be_liberal - BOOLEAN
  78. - 0 - disabled (default)
  79. - not 0 - enabled
  80. Be conservative in what you do, be liberal in what you accept from others.
  81. If it's non-zero, we mark only out of window RST segments as INVALID.
  82. nf_conntrack_tcp_loose - BOOLEAN
  83. - 0 - disabled
  84. - not 0 - enabled (default)
  85. If it is set to zero, we disable picking up already established
  86. connections.
  87. nf_conntrack_tcp_max_retrans - INTEGER
  88. default 3
  89. Maximum number of packets that can be retransmitted without
  90. received an (acceptable) ACK from the destination. If this number
  91. is reached, a shorter timer will be started.
  92. nf_conntrack_tcp_timeout_close - INTEGER (seconds)
  93. default 10
  94. nf_conntrack_tcp_timeout_close_wait - INTEGER (seconds)
  95. default 60
  96. nf_conntrack_tcp_timeout_established - INTEGER (seconds)
  97. default 432000 (5 days)
  98. nf_conntrack_tcp_timeout_fin_wait - INTEGER (seconds)
  99. default 120
  100. nf_conntrack_tcp_timeout_last_ack - INTEGER (seconds)
  101. default 30
  102. nf_conntrack_tcp_timeout_max_retrans - INTEGER (seconds)
  103. default 300
  104. nf_conntrack_tcp_timeout_syn_recv - INTEGER (seconds)
  105. default 60
  106. nf_conntrack_tcp_timeout_syn_sent - INTEGER (seconds)
  107. default 120
  108. nf_conntrack_tcp_timeout_time_wait - INTEGER (seconds)
  109. default 120
  110. nf_conntrack_tcp_timeout_unacknowledged - INTEGER (seconds)
  111. default 300
  112. nf_conntrack_timestamp - BOOLEAN
  113. - 0 - disabled (default)
  114. - not 0 - enabled
  115. Enable connection tracking flow timestamping.
  116. nf_conntrack_udp_timeout - INTEGER (seconds)
  117. default 30
  118. nf_conntrack_udp_timeout_stream - INTEGER (seconds)
  119. default 120
  120. This extended timeout will be used in case there is an UDP stream
  121. detected.
  122. nf_conntrack_gre_timeout - INTEGER (seconds)
  123. default 30
  124. nf_conntrack_gre_timeout_stream - INTEGER (seconds)
  125. default 180
  126. This extended timeout will be used in case there is an GRE stream
  127. detected.