blob: 4fb51d32fccc2acd4ebaa1347dcf51fb49cab90d [file] [log] [blame]
Jiri Pirkoc9f9e0e2013-01-17 23:05:08 +00001/proc/sys/net/netfilter/nf_conntrack_* Variables:
2
3nf_conntrack_acct - BOOLEAN
4 0 - disabled (default)
5 not 0 - enabled
6
7 Enable connection tracking flow accounting. 64-bit byte and packet
8 counters per flow are added.
9
Florian Westphal3183ab82016-06-22 13:26:10 +020010nf_conntrack_buckets - INTEGER
Jiri Pirkoc9f9e0e2013-01-17 23:05:08 +000011 Size of hash table. If not specified as parameter during module
12 loading, the default size is calculated by dividing total memory
13 by 16384 to determine the number of buckets but the hash table will
Marcelo Leitner88eab472014-12-03 17:30:19 -020014 never have fewer than 32 and limited to 16384 buckets. For systems
15 with more than 4GB of memory it will be 65536 buckets.
Florian Westphal3183ab82016-06-22 13:26:10 +020016 This sysctl is only writeable in the initial net namespace.
Jiri Pirkoc9f9e0e2013-01-17 23:05:08 +000017
18nf_conntrack_checksum - BOOLEAN
19 0 - disabled
20 not 0 - enabled (default)
21
22 Verify checksum of incoming packets. Packets with bad checksums are
23 in INVALID state. If this is enabled, such packets will not be
24 considered for connection tracking.
25
26nf_conntrack_count - INTEGER (read-only)
27 Number of currently allocated flow entries.
28
29nf_conntrack_events - BOOLEAN
30 0 - disabled
31 not 0 - enabled (default)
32
33 If this option is enabled, the connection tracking code will
34 provide userspace with connection tracking events via ctnetlink.
35
36nf_conntrack_events_retry_timeout - INTEGER (seconds)
37 default 15
38
39 This option is only relevant when "reliable connection tracking
40 events" are used. Normally, ctnetlink is "lossy", that is,
41 events are normally dropped when userspace listeners can't keep up.
42
43 Userspace can request "reliable event mode". When this mode is
44 active, the conntrack will only be destroyed after the event was
45 delivered. If event delivery fails, the kernel periodically
46 re-tries to send the event to userspace.
47
48 This is the maximum interval the kernel should use when re-trying
49 to deliver the destroy event.
50
51 A higher number means there will be fewer delivery retries and it
52 will take longer for a backlog to be processed.
53
54nf_conntrack_expect_max - INTEGER
55 Maximum size of expectation table. Default value is
56 nf_conntrack_buckets / 256. Minimum is 1.
57
58nf_conntrack_frag6_high_thresh - INTEGER
59 default 262144
60
61 Maximum memory used to reassemble IPv6 fragments. When
62 nf_conntrack_frag6_high_thresh bytes of memory is allocated for this
63 purpose, the fragment handler will toss packets until
64 nf_conntrack_frag6_low_thresh is reached.
65
66nf_conntrack_frag6_low_thresh - INTEGER
67 default 196608
68
69 See nf_conntrack_frag6_low_thresh
70
71nf_conntrack_frag6_timeout - INTEGER (seconds)
72 default 60
73
74 Time to keep an IPv6 fragment in memory.
75
76nf_conntrack_generic_timeout - INTEGER (seconds)
77 default 600
78
79 Default for generic timeout. This refers to layer 4 unknown/unsupported
80 protocols.
81
82nf_conntrack_helper - BOOLEAN
83 0 - disabled
84 not 0 - enabled (default)
85
86 Enable automatic conntrack helper assignment.
87
88nf_conntrack_icmp_timeout - INTEGER (seconds)
89 default 30
90
91 Default for ICMP timeout.
92
93nf_conntrack_icmpv6_timeout - INTEGER (seconds)
94 default 30
95
96 Default for ICMP6 timeout.
97
98nf_conntrack_log_invalid - INTEGER
99 0 - disable (default)
100 1 - log ICMP packets
101 6 - log TCP packets
102 17 - log UDP packets
103 33 - log DCCP packets
104 41 - log ICMPv6 packets
105 136 - log UDPLITE packets
106 255 - log packets of any protocol
107
108 Log invalid packets of a type specified by value.
109
110nf_conntrack_max - INTEGER
111 Size of connection tracking table. Default value is
112 nf_conntrack_buckets value * 4.
113
114nf_conntrack_tcp_be_liberal - BOOLEAN
115 0 - disabled (default)
116 not 0 - enabled
117
118 Be conservative in what you do, be liberal in what you accept from others.
119 If it's non-zero, we mark only out of window RST segments as INVALID.
120
121nf_conntrack_tcp_loose - BOOLEAN
122 0 - disabled
123 not 0 - enabled (default)
124
125 If it is set to zero, we disable picking up already established
126 connections.
127
128nf_conntrack_tcp_max_retrans - INTEGER
129 default 3
130
131 Maximum number of packets that can be retransmitted without
132 received an (acceptable) ACK from the destination. If this number
133 is reached, a shorter timer will be started.
134
135nf_conntrack_tcp_timeout_close - INTEGER (seconds)
136 default 10
137
138nf_conntrack_tcp_timeout_close_wait - INTEGER (seconds)
139 default 60
140
141nf_conntrack_tcp_timeout_established - INTEGER (seconds)
142 default 432000 (5 days)
143
144nf_conntrack_tcp_timeout_fin_wait - INTEGER (seconds)
145 default 120
146
147nf_conntrack_tcp_timeout_last_ack - INTEGER (seconds)
148 default 30
149
150nf_conntrack_tcp_timeout_max_retrans - INTEGER (seconds)
151 default 300
152
153nf_conntrack_tcp_timeout_syn_recv - INTEGER (seconds)
154 default 60
155
156nf_conntrack_tcp_timeout_syn_sent - INTEGER (seconds)
157 default 120
158
159nf_conntrack_tcp_timeout_time_wait - INTEGER (seconds)
160 default 120
161
162nf_conntrack_tcp_timeout_unacknowledged - INTEGER (seconds)
163 default 300
164
165nf_conntrack_timestamp - BOOLEAN
166 0 - disabled (default)
167 not 0 - enabled
168
169 Enable connection tracking flow timestamping.
170
171nf_conntrack_udp_timeout - INTEGER (seconds)
172 default 30
173
174nf_conntrack_udp_timeout_stream2 - INTEGER (seconds)
175 default 180
176
177 This extended timeout will be used in case there is an UDP stream
178 detected.