233 lines · plain
1.. SPDX-License-Identifier: GPL-2.02 3===================================4Netfilter Conntrack Sysfs variables5===================================6 7/proc/sys/net/netfilter/nf_conntrack_* Variables:8=================================================9 10nf_conntrack_acct - BOOLEAN11 - 0 - disabled (default)12 - not 0 - enabled13 14 Enable connection tracking flow accounting. 64-bit byte and packet15 counters per flow are added.16 17nf_conntrack_buckets - INTEGER18 Size of hash table. If not specified as parameter during module19 loading, the default size is calculated by dividing total memory20 by 16384 to determine the number of buckets. The hash table will21 never have fewer than 1024 and never more than 262144 buckets.22 This sysctl is only writeable in the initial net namespace.23 24nf_conntrack_checksum - BOOLEAN25 - 0 - disabled26 - not 0 - enabled (default)27 28 Verify checksum of incoming packets. Packets with bad checksums are29 in INVALID state. If this is enabled, such packets will not be30 considered for connection tracking.31 32nf_conntrack_count - INTEGER (read-only)33 Number of currently allocated flow entries.34 35nf_conntrack_events - BOOLEAN36 - 0 - disabled37 - 1 - enabled38 - 2 - auto (default)39 40 If this option is enabled, the connection tracking code will41 provide userspace with connection tracking events via ctnetlink.42 The default allocates the extension if a userspace program is43 listening to ctnetlink events.44 45nf_conntrack_expect_max - INTEGER46 Maximum size of expectation table. Default value is47 nf_conntrack_buckets / 256. Minimum is 1.48 49nf_conntrack_frag6_high_thresh - INTEGER50 default 26214451 52 Maximum memory used to reassemble IPv6 fragments. When53 nf_conntrack_frag6_high_thresh bytes of memory is allocated for this54 purpose, the fragment handler will toss packets until55 nf_conntrack_frag6_low_thresh is reached.56 57nf_conntrack_frag6_low_thresh - INTEGER58 default 19660859 60 See nf_conntrack_frag6_low_thresh61 62nf_conntrack_frag6_timeout - INTEGER (seconds)63 default 6064 65 Time to keep an IPv6 fragment in memory.66 67nf_conntrack_generic_timeout - INTEGER (seconds)68 default 60069 70 Default for generic timeout. This refers to layer 4 unknown/unsupported71 protocols.72 73nf_conntrack_icmp_timeout - INTEGER (seconds)74 default 3075 76 Default for ICMP timeout.77 78nf_conntrack_icmpv6_timeout - INTEGER (seconds)79 default 3080 81 Default for ICMP6 timeout.82 83nf_conntrack_log_invalid - INTEGER84 - 0 - disable (default)85 - 1 - log ICMP packets86 - 6 - log TCP packets87 - 17 - log UDP packets88 - 33 - log DCCP packets89 - 41 - log ICMPv6 packets90 - 136 - log UDPLITE packets91 - 255 - log packets of any protocol92 93 Log invalid packets of a type specified by value.94 95nf_conntrack_max - INTEGER96 Maximum number of allowed connection tracking entries. This value is set97 to nf_conntrack_buckets by default.98 Note that connection tracking entries are added to the table twice -- once99 for the original direction and once for the reply direction (i.e., with100 the reversed address). This means that with default settings a maxed-out101 table will have a average hash chain length of 2, not 1.102 103nf_conntrack_tcp_be_liberal - BOOLEAN104 - 0 - disabled (default)105 - not 0 - enabled106 107 Be conservative in what you do, be liberal in what you accept from others.108 If it's non-zero, we mark only out of window RST segments as INVALID.109 110nf_conntrack_tcp_ignore_invalid_rst - BOOLEAN111 - 0 - disabled (default)112 - 1 - enabled113 114 If it's 1, we don't mark out of window RST segments as INVALID.115 116nf_conntrack_tcp_loose - BOOLEAN117 - 0 - disabled118 - not 0 - enabled (default)119 120 If it is set to zero, we disable picking up already established121 connections.122 123nf_conntrack_tcp_max_retrans - INTEGER124 default 3125 126 Maximum number of packets that can be retransmitted without127 received an (acceptable) ACK from the destination. If this number128 is reached, a shorter timer will be started.129 130nf_conntrack_tcp_timeout_close - INTEGER (seconds)131 default 10132 133nf_conntrack_tcp_timeout_close_wait - INTEGER (seconds)134 default 60135 136nf_conntrack_tcp_timeout_established - INTEGER (seconds)137 default 432000 (5 days)138 139nf_conntrack_tcp_timeout_fin_wait - INTEGER (seconds)140 default 120141 142nf_conntrack_tcp_timeout_last_ack - INTEGER (seconds)143 default 30144 145nf_conntrack_tcp_timeout_max_retrans - INTEGER (seconds)146 default 300147 148nf_conntrack_tcp_timeout_syn_recv - INTEGER (seconds)149 default 60150 151nf_conntrack_tcp_timeout_syn_sent - INTEGER (seconds)152 default 120153 154nf_conntrack_tcp_timeout_time_wait - INTEGER (seconds)155 default 120156 157nf_conntrack_tcp_timeout_unacknowledged - INTEGER (seconds)158 default 300159 160nf_conntrack_timestamp - BOOLEAN161 - 0 - disabled (default)162 - not 0 - enabled163 164 Enable connection tracking flow timestamping.165 166nf_conntrack_sctp_timeout_closed - INTEGER (seconds)167 default 10168 169nf_conntrack_sctp_timeout_cookie_wait - INTEGER (seconds)170 default 3171 172nf_conntrack_sctp_timeout_cookie_echoed - INTEGER (seconds)173 default 3174 175nf_conntrack_sctp_timeout_established - INTEGER (seconds)176 default 210177 178 Default is set to (hb_interval * path_max_retrans + rto_max)179 180nf_conntrack_sctp_timeout_shutdown_sent - INTEGER (seconds)181 default 3182 183nf_conntrack_sctp_timeout_shutdown_recd - INTEGER (seconds)184 default 3185 186nf_conntrack_sctp_timeout_shutdown_ack_sent - INTEGER (seconds)187 default 3188 189nf_conntrack_sctp_timeout_heartbeat_sent - INTEGER (seconds)190 default 30191 192 This timeout is used to setup conntrack entry on secondary paths.193 Default is set to hb_interval.194 195nf_conntrack_udp_timeout - INTEGER (seconds)196 default 30197 198nf_conntrack_udp_timeout_stream - INTEGER (seconds)199 default 120200 201 This extended timeout will be used in case there is an UDP stream202 detected.203 204nf_conntrack_gre_timeout - INTEGER (seconds)205 default 30206 207nf_conntrack_gre_timeout_stream - INTEGER (seconds)208 default 180209 210 This extended timeout will be used in case there is an GRE stream211 detected.212 213nf_hooks_lwtunnel - BOOLEAN214 - 0 - disabled (default)215 - not 0 - enabled216 217 If this option is enabled, the lightweight tunnel netfilter hooks are218 enabled. This option cannot be disabled once it is enabled.219 220nf_flowtable_tcp_timeout - INTEGER (seconds)221 default 30222 223 Control offload timeout for tcp connections.224 TCP connections may be offloaded from nf conntrack to nf flow table.225 Once aged, the connection is returned to nf conntrack.226 227nf_flowtable_udp_timeout - INTEGER (seconds)228 default 30229 230 Control offload timeout for udp connections.231 UDP connections may be offloaded from nf conntrack to nf flow table.232 Once aged, the connection is returned to nf conntrack.233