[IPV4]: Safer reassembly

[net-next-2.6.git] / Documentation / networking / ip-sysctl.txt

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index ab65714d95fcec32b6103c384f05bd06ab84c506..2b7cf19a06adc03435b84a04ae1dee46aae7e9a1 100644 (file)
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -46,6 +46,29 @@ ipfrag_secret_interval - INTEGER
        for the hash secret) for IP fragments.
        Default: 600
 
+ipfrag_max_dist - INTEGER
+       ipfrag_max_dist is a non-negative integer value which defines the 
+       maximum "disorder" which is allowed among fragments which share a 
+       common IP source address. Note that reordering of packets is 
+       not unusual, but if a large number of fragments arrive from a source 
+       IP address while a particular fragment queue remains incomplete, it 
+       probably indicates that one or more fragments belonging to that queue 
+       have been lost. When ipfrag_max_dist is positive, an additional check 
+       is done on fragments before they are added to a reassembly queue - if 
+       ipfrag_max_dist (or more) fragments have arrived from a particular IP 
+       address between additions to any IP fragment queue using that source 
+       address, it's presumed that one or more fragments in the queue are 
+       lost. The existing fragment queue will be dropped, and a new one 
+       started. An ipfrag_max_dist value of zero disables this check.
+
+       Using a very small value, e.g. 1 or 2, for ipfrag_max_dist can
+       result in unnecessarily dropping fragment queues when normal
+       reordering of packets occurs, which could lead to poor application 
+       performance. Using a very large value, e.g. 50000, increases the 
+       likelihood of incorrectly reassembling IP fragments that originate 
+       from different IP datagrams, which could result in data corruption.
+       Default: 64
+
 INET peer storage:
 
 inet_peer_threshold - INTEGER
@@ -78,6 +101,11 @@ inet_peer_gc_maxtime - INTEGER
 
 TCP variables: 
 
+tcp_abc - INTEGER
+       Controls Appropriate Byte Count defined in RFC3465. If set to
+       0 then does congestion avoid once per ack. 1 is conservative
+       value, and 2 is more agressive.
+
 tcp_syn_retries - INTEGER
        Number of times initial SYNs for an active TCP connection attempt
        will be retransmitted. Should not be higher than 255. Default value
@@ -309,7 +337,7 @@ tcp_tso_win_divisor - INTEGER
        can be consumed by a single TSO frame.
        The setting of this parameter is a choice between burstiness and
        building larger TSO frames.
-       Default: 8
+       Default: 3
 
 tcp_frto - BOOLEAN
        Enables F-RTO, an enhanced recovery algorithm for TCP retransmission
@@ -355,10 +383,14 @@ ip_dynaddr - BOOLEAN
        Default: 0
 
 icmp_echo_ignore_all - BOOLEAN
+       If set non-zero, then the kernel will ignore all ICMP ECHO
+       requests sent to it.
+       Default: 0
+
 icmp_echo_ignore_broadcasts - BOOLEAN
-       If either is set to true, then the kernel will ignore either all
-       ICMP ECHO requests sent to it or just those to broadcast/multicast
-       addresses, respectively.
+       If set non-zero, then the kernel will ignore all ICMP ECHO and
+       TIMESTAMP requests sent to it via broadcast/multicast.
+       Default: 1
 
 icmp_ratelimit - INTEGER
        Limit the maximal rates for sending ICMP packets whose type matches