1 .\" Copyright (c) 1983, 1991, 1993
2 .\" The Regents of the University of California.
3 .\" Copyright (c) 2010-2011 The FreeBSD Foundation
4 .\" All rights reserved.
6 .\" Portions of this documentation were written at the Centre for Advanced
7 .\" Internet Architectures, Swinburne University of Technology, Melbourne,
8 .\" Australia by David Hayes under sponsorship from the FreeBSD Foundation.
10 .\" Redistribution and use in source and binary forms, with or without
11 .\" modification, are permitted provided that the following conditions
13 .\" 1. Redistributions of source code must retain the above copyright
14 .\" notice, this list of conditions and the following disclaimer.
15 .\" 2. Redistributions in binary form must reproduce the above copyright
16 .\" notice, this list of conditions and the following disclaimer in the
17 .\" documentation and/or other materials provided with the distribution.
18 .\" 3. Neither the name of the University nor the names of its contributors
19 .\" may be used to endorse or promote products derived from this software
20 .\" without specific prior written permission.
22 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 .\" From: @(#)tcp.4 8.1 (Berkeley) 6/5/93
42 .Nd Internet Transmission Control Protocol
49 .Fn socket AF_INET SOCK_STREAM 0
53 protocol provides reliable, flow-controlled, two-way
55 It is a byte-stream protocol used to
61 Internet address format and, in addition, provides a per-host
63 .Dq "port addresses" .
64 Thus, each address is composed
65 of an Internet address specifying the host and network,
68 port on the host identifying the peer entity.
76 Active sockets initiate connections to passive
80 sockets are created active; to create a
83 system call must be used
84 after binding the socket with the
87 Only passive sockets may use the
89 call to accept incoming connections.
90 Only active sockets may use the
92 call to initiate connections.
96 their location to match
97 incoming connection requests from multiple networks.
98 This technique, termed
99 .Dq "wildcard addressing" ,
101 server to provide service to clients on multiple networks.
102 To create a socket which listens on all networks, the Internet
108 port may still be specified
109 at this time; if the port is not specified, the system will assign one.
110 Once a connection has been established, the socket's address is
111 fixed by the peer entity's location.
112 The address assigned to the
113 socket is the address associated with the network interface
114 through which packets are being transmitted and received.
115 Normally, this address corresponds to the peer entity's network.
118 supports a number of socket options which can be set with
122 .Bl -tag -width ".Dv TCP_FUNCTION_BLK"
124 Information about a socket's underlying TCP session may be retrieved
125 by passing the read-only option
129 It accepts a single argument: a pointer to an instance of
130 .Vt "struct tcp_info" .
132 This API is subject to change; consult the source to determine
133 which fields are currently filled out by this option.
135 specific additions include
139 bandwidth-controlled window space.
141 Set or query congestion control algorithm specific parameters.
145 .It Dv TCP_CONGESTION
146 Select or query the congestion control algorithm that TCP will use for the
151 .It Dv TCP_FUNCTION_BLK
152 Select or query the set of functions that TCP will use for this connection.
153 This allows a user to select an alternate TCP stack.
154 The alternate TCP stack must already be loaded in the kernel.
155 To list the available TCP stacks, see
156 .Va functions_available
159 section further down.
160 To list the default TCP stack, see
161 .Va functions_default
168 option accepts a per-socket timeout argument of
170 in seconds, for new, non-established
173 For the global default in milliseconds see
177 section further down.
181 option accepts an argument of
183 for the amount of time, in seconds, that the connection must be idle
184 before keepalive probes (if enabled) are sent for the connection of this
186 If set on a listening socket, the value is inherited by the newly created
189 For the global default in milliseconds see
193 section further down.
197 option accepts an argument of
199 to set the per-socket interval, in seconds, between keepalive probes sent
201 If set on a listening socket, the value is inherited by the newly created
204 For the global default in milliseconds see
208 section further down.
212 option accepts an argument of
214 and allows a per-socket tuning of the number of probes sent, with no response,
215 before the connection will be dropped.
216 If set on a listening socket, the value is inherited by the newly created
219 For the global default see the
223 section further down.
225 Under most circumstances,
227 sends data when it is presented;
228 when outstanding data has not yet been acknowledged, it gathers
229 small amounts of output to be sent in a single packet once
230 an acknowledgement is received.
231 For a small number of clients, such as window systems
232 that send a stream of mouse events which receive no replies,
233 this packetization may cause significant delays.
236 defeats this algorithm.
238 By default, a sender- and
239 .No receiver- Ns Tn TCP
240 will negotiate among themselves to determine the maximum segment size
241 to be used for each connection.
244 option allows the user to determine the result of this negotiation,
245 and to reduce it if desired.
248 usually sends a number of options in each packet, corresponding to
251 extensions which are provided in this implementation.
254 is provided to disable
256 option use on a per-connection basis.
259 .No sender- Ns Tn TCP
262 bit, and begin transmission immediately (if permitted) at the end of
267 When this option is set to a non-zero value,
269 will delay sending any data at all until either the socket is closed,
270 or the internal send buffer is filled.
272 This option enables the use of MD5 digests (also known as TCP-MD5)
273 on writes to the specified socket.
274 Outgoing traffic is digested;
275 digests on incoming traffic are verified.
276 When this option is enabled on a socket, all inbound and outgoing
277 TCP segments must be signed with MD5 digests.
279 One common use for this in a
281 router deployment is to enable
282 based routers to interwork with Cisco equipment at peering points.
283 Support for this feature conforms to RFC 2385.
285 In order for this option to function correctly, it is necessary for the
286 administrator to add a tcp-md5 key entry to the system's security
287 associations database (SADB) using the
290 This entry can only be specified on a per-host basis at this time.
292 If an SADB entry cannot be found for the destination,
293 the system does not send any outgoing segments and drops any inbound segments.
295 Manage collection of connection level statistics using the
299 Each dropped segment is taken into account in the TCP protocol statistics.
300 .It Dv TCP_TXTLS_ENABLE
301 Enable in-kernel Transport Layer Security (TLS) for data written to this
306 .It Dv TCP_TXTLS_MODE
307 The integer argument can be used to get or set the current TLS transmit mode
312 .It Dv TCP_RXTLS_ENABLE
313 Enable in-kernel TLS for data read from this socket.
317 .It Dv TCP_REUSPORT_LB_NUMA
318 Changes NUMA affinity filtering for an established TCP listen
320 This option takes a single integer argument which specifies
321 the NUMA domain to filter on for this listen socket.
322 The argument can also have the follwing special values:
323 .Bl -tag -width "Dv TCP_REUSPORT_LB_NUMA"
324 .It Dv TCP_REUSPORT_LB_NUMA_NODOM
325 Remove NUMA filtering for this listen socket.
326 .It Dv TCP_REUSPORT_LB_NUMA_CURDOM
327 Filter traffic associated with the domain where the calling thread is
329 This is typically used after a process or thread inherits a listen
330 socket from its parent, and sets its CPU affinity to a particular core.
332 .It Dv TCP_REMOTE_UDP_ENCAPS_PORT
333 Set and get the remote UDP encapsulation port.
334 It can only be set on a closed TCP socket.
337 The option level for the
339 call is the protocol number for
342 .Xr getprotobyname 3 ,
345 All options are declared in
350 transport level may be used with
354 Incoming connection requests that are source-routed are noted,
355 and the reverse source route is used in responding.
357 The default congestion control algorithm for
361 Other congestion control algorithms can be made available using the
367 protocol implements a number of variables in the
372 .Bl -tag -width ".Va TCPCTL_DO_RFC1323"
373 .It Dv TCPCTL_DO_RFC1323
375 Implement the window scaling and timestamp options of RFC 1323/RFC 7323
377 .It Va tolerate_missing_ts
378 Tolerate the missing of timestamps (RFC 1323/RFC 7323) for
380 segments belonging to
382 connections for which support of
384 timestamps has been negotiated.
385 As of June 2021, several TCP stacks are known to violate RFC 7323, including
386 modern widely deployed ones.
387 Therefore the default is 1, i.e., the missing of timestamps is tolerated.
388 .It Dv TCPCTL_MSSDFLT
390 The default value used for the maximum segment size
392 when no advice to the contrary is received from MSS negotiation.
393 .It Dv TCPCTL_SENDSPACE
398 .It Dv TCPCTL_RECVSPACE
404 Log any connection attempts to ports where there is not a socket
405 accepting connections.
406 The value of 1 limits the logging to
408 (connection establishment) packets only.
409 That of 2 results in any
411 packets to closed ports being logged.
412 Any value unlisted above disables the logging
413 (default is 0, i.e., the logging is disabled).
415 The Maximum Segment Lifetime, in milliseconds, for a packet.
417 Timeout, in milliseconds, for new, non-established
420 The default is 75000 msec.
422 Amount of time, in milliseconds, that the connection must be idle
423 before keepalive probes (if enabled) are sent.
424 The default is 7200000 msec (2 hours).
426 The interval, in milliseconds, between keepalive probes sent to remote
427 machines, when no response is received on a
430 The default is 75000 msec.
432 Number of probes sent, with no response, before a connection
434 The default is 8 packets.
435 .It Va always_keepalive
440 connections, the kernel will
441 periodically send a packet to the remote host to verify the connection
446 unreachable messages may abort connections in
452 reassembly queue if the system is low on mbufs.
454 If enabled, disable sending of RST when a connection is attempted
455 to a port where there is not a socket accepting connections.
459 Delay ACK to try and piggyback it onto a data packet.
461 Maximum amount of time, in milliseconds, before a delayed ACK is sent.
462 .It Va path_mtu_discovery
463 Enable Path MTU Discovery.
467 control-block hash table
469 This may be tuned using the kernel option
472 .Va net.inet.tcp.tcbhashsize
476 Number of active process control blocks
479 Determines whether or not
481 cookies should be generated for outbound
485 cookies are a great help during
487 flood attacks, and are enabled by default.
490 .It Va isn_reseed_interval
491 The interval (in seconds) specifying how often the secret data used in
492 RFC 1948 initial sequence number calculations should be reseeded.
493 By default, this variable is set to zero, indicating that
494 no reseeding will occur.
495 Reseeding should not be necessary, and will break
497 recycling for a few minutes.
498 .It Va reass.cursegments
499 The current total number of segments present in all reassembly queues.
500 .It Va reass.maxsegments
501 The maximum limit on the total number of segments across all reassembly
503 The limit can be adjusted as a tunable.
504 .It Va reass.maxqueuelen
505 The maximum number of segments allowed in each reassembly queue.
506 By default, the system chooses a limit based on each TCP connection's
507 receive buffer size and maximum segment size (MSS).
508 The actual limit applied to a session's reassembly queue will be the lower of
509 the system-calculated automatic limit and the user-specified
510 .Va reass.maxqueuelen
512 .It Va rexmit_initial , rexmit_min , rexmit_slop
513 Adjust the retransmit timer calculation for
516 typically added to the raw calculation to take into account
517 occasional variances that the
519 (smoothed round-trip time)
520 is unable to accommodate, while the minimum specifies an
525 second minimum, these RFCs tend to focus on streaming behavior,
526 and fail to deal with the fact that a 1 second minimum has severe
527 detrimental effects over lossy interactive connections, such
528 as a 802.11b wireless link, and over very fast but lossy
529 connections for those cases not covered by the fast retransmit
531 For this reason, we use 200ms of slop and a near-0
532 minimum, which gives us an effective minimum of 200ms (similar to
534 The initial value is used before an RTT measurement has been performed.
535 .It Va initcwnd_segments
536 Enable the ability to specify initial congestion window in number of segments.
537 The default value is 10 as suggested by RFC 6928.
538 Changing the value on fly would not affect connections using congestion window
541 This regulates the burst of packets allowed to be sent in the first RTT.
542 The value should be relative to the link capacity.
543 Start with small values for lower-capacity links.
544 Large bursts can cause buffer overruns and packet drops if routers have small
545 buffers or the link is experiencing congestion.
547 Enable the New Congestion Window Validation mechanism as described in RFC 7661.
548 This gently reduces the congestion window during periods, where TCP is
549 application limited and the network bandwidth is not utilized completely.
550 That prevents self-inflicted packet losses once the application starts to
551 transmit data at a higher speed.
553 Enable Lost Retransmission Detection for SACK-enabled sessions, disabled by
555 Under severe congestion, a retransmission can be lost which then leads to a
556 mandatory Retransmission Timeout (RTO), followed by slow-start.
557 LRD will try to resend the repeatedly lost packet, preventing the time-consuming
558 RTO and performance reducing slow-start.
560 Perform SACK loss recovery using the Proportional Rate Reduction (PRR) algorithm
561 described in RFC6937.
562 This improves the effectiveness of retransmissions particular in environments
563 with ACK thinning or burst loss events, as chances to run out of the ACK clock
564 are reduced, preventing lengthy and performance reducing RTO based loss recovery
566 .It Va do_prr_conservative
567 While doing Proportional Rate Reduction, remain strictly in a packet conserving
568 mode, sending only one new packet for each ACK received.
569 Helpful when a misconfigured token bucket traffic policer causes persistent
570 high losses leading to RTO, but reduces PRR effectiveness in more common settings
573 Deprecated and superseded by
576 Enable the Limited Transmit algorithm as described in RFC 3042.
577 It helps avoid timeouts on lossy links and also when the congestion window
578 is small, as happens on short transfers.
580 Enable support for RFC 3390, which allows for a variable-sized
581 starting congestion window on new connections, depending on the
582 maximum segment size.
583 This helps throughput in general, but
584 particularly affects short transfers and high-bandwidth large
585 propagation-delay connections.
587 Enable support for RFC 2018, TCP Selective Acknowledgment option,
588 which allows the receiver to inform the sender about all successfully
589 arrived segments, allowing the sender to retransmit the missing segments
592 Enables three updated mechanisms from RFC6675 (default is true).
593 Calculate the bytes in flight using the algorithm described in RFC 6675, and
594 is also an improvement when Proportional Rate Reduction is enabled.
595 Next, Rescue Retransmission helps timely loss recovery, when the trailing segments
596 of a transmission are lost, while no additional data is ready to be sent.
597 In case a partial ACK without a SACK block is received during SACK loss
598 recovery, the trailing segment is immediately resent, rather than waiting
599 for a Retransmission timeout.
600 Finally, SACK loss recovery is also engaged, once two segments plus one byte are
601 SACKed - even if no traditional duplicate ACKs were observed.
603 Maximum number of SACK holes per connection.
605 .It Va sack.globalmaxholes
606 Maximum number of SACK holes per system, across all connections.
609 When a TCP connection enters the
611 state, its associated socket structure is freed, since it is of
612 negligible size and use, and a new structure is allocated to contain a
613 minimal amount of information necessary for sustaining a connection in
614 this state, called the compressed TCP TIME_WAIT state.
615 Since this structure is smaller than a socket structure, it can save
616 a significant amount of system memory.
618 .Va net.inet.tcp.maxtcptw
619 MIB variable controls the maximum number of these structures allocated.
620 By default, it is initialized to
621 .Va kern.ipc.maxsockets
623 .It Va nolocaltimewait
624 Suppress creating of compressed TCP TIME_WAIT states for connections in
625 which both endpoints are local.
626 .It Va fast_finwait2_recycle
630 connections faster when the socket is marked as
632 (no user process has the socket open, data received on
633 the socket cannot be read).
634 The timeout used here is
635 .Va finwait2_timeout .
636 .It Va finwait2_timeout
637 Timeout to use for fast recycling of
641 Defaults to 60 seconds.
643 Enable support for TCP Explicit Congestion Notification (ECN).
644 ECN allows a TCP sender to reduce the transmission rate in order to
650 Allow incoming connections to request ECN.
651 Outgoing connections will request ECN.
653 Allow incoming connections to request ECN.
654 Outgoing connections will not request ECN.
657 .It Va ecn.maxretries
658 Number of retries (SYN or SYN/ACK retransmits) before disabling ECN on a
660 This is needed to help with connection establishment
661 when a broken firewall is in the network path.
662 .It Va pmtud_blackhole_detection
663 Enable automatic path MTU blackhole detection.
664 In case of retransmits of MSS sized segments,
665 the OS will lower the MSS to check if it's an MTU problem.
666 If the current MSS is greater than the configured value to try
667 .Po Va net.inet.tcp.pmtud_blackhole_mss
669 .Va net.inet.tcp.v6pmtud_blackhole_mss
671 it will be set to this value, otherwise,
672 the MSS will be set to the default values
673 .Po Va net.inet.tcp.mssdflt
675 .Va net.inet.tcp.v6mssdflt
680 Disable path MTU blackhole detection.
682 Enable path MTU blackhole detection for IPv4 and IPv6.
684 Enable path MTU blackhole detection only for IPv4.
686 Enable path MTU blackhole detection only for IPv6.
688 .It Va pmtud_blackhole_mss
689 MSS to try for IPv4 if PMTU blackhole detection is turned on.
690 .It Va v6pmtud_blackhole_mss
691 MSS to try for IPv6 if PMTU blackhole detection is turned on.
692 .It Va hostcache.enable
693 The TCP host cache is used to cache connection details and metrics to
694 improve future performance of connections between the same hosts.
695 At the completion of a TCP connection, a host will cache information
696 for the connection for some defined period of time.
699 Disable the host cache.
701 Enable the host cache. (default)
703 .It Va hostcache.purgenow
704 Immediately purge all entries once set to any value.
705 Setting this to 2 will also reseed the hash salt.
706 .It Va hostcache.purge
707 Expire all entires on next pruning of host cache entries.
708 Any non-zero setting will be reset to zero, once the pruge
712 Do not purge all entries when pruning the host cache. (default)
714 Purge all entries when doing the next pruning.
716 Purge all entries, and also reseed the hash salt.
718 .It Va hostcache.prune
719 Time in seconds between pruning expired host cache entries.
720 Defaults to 300 (5 minutes).
721 .It Va hostcache.expire
722 Time in seconds, how long a entry should be kept in the
723 host cache since last accessed.
724 Defaults to 3600 (1 hour).
725 .It Va hostcache.count
726 The current number of entries in the host cache.
727 .It Va hostcache.bucketlimit
728 The maximum number of entries for the same hash.
730 .It Va hostcache.hashsize
731 Size of TCP hostcache hashtable.
732 This number has to be a power of two, or will be rejected.
734 .It Va hostcache.cachelimit
735 Overall entry limit for hostcache.
736 Defaults to hashsize * bucketlimit.
737 .It Va hostcache.histo
738 Provide a Histogram of the hostcache hash utilization.
739 .It Va hostcache.list
740 Provide a complete list of all current entries in the host
742 .It Va functions_available
743 List of available TCP function blocks (TCP stacks).
744 .It Va functions_default
745 The default TCP function block (TCP stack).
746 .It Va functions_inherit_listen_socket_stack
747 Determines whether to inherit listen socket's tcp stack or use the current
748 system default tcp stack, as defined by
749 .Va functions_default .
752 Use criteria defined in RFC793 instead of RFC5961 for accepting RST segments.
755 Use criteria defined in RFC793 instead of RFC5961 for accepting SYN segments.
757 .It Va ts_offset_per_conn
758 When initializing the TCP timestamps, use a per connection offset instead of a
759 per host pair offset.
760 Default is to use per connection offsets as recommended in RFC 7323.
761 .It Va perconn_stats_enable
762 Controls the default collection of statistics for all connections using the
765 0 disables, 1 enables, 2 enables random sampling across log id connection
766 groups with all connections in a group receiving the same setting.
767 .It Va perconn_stats_sample_rates
768 A CSV list of template_spec=percent key-value pairs which controls the per
769 template sampling rates when
772 .It Va udp_tunneling_port
773 The local UDP encapsulation port.
774 A value of 0 indicates that UDP encapsulation is disabled.
776 .It Va udp_tunneling_overhead
777 The overhead taken into account when using UDP encapsulation.
778 Since MSS clamping by middleboxes will most likely not work, values larger than
779 8 (the size of the UDP header) are also supported.
780 Supported values are between 8 and 1024.
784 A socket operation may fail with one of the following errors returned:
787 when trying to establish a connection on a socket which
789 .It Bo Er ENOBUFS Bc or Bo Er ENOMEM Bc
790 when the system runs out of memory for
791 an internal data structure;
793 when a connection was dropped
794 due to excessive retransmissions;
797 forces the connection to be closed;
798 .It Bq Er ECONNREFUSED
800 peer actively refuses connection establishment (usually because
801 no process is listening to the port);
804 is made to create a socket with a port which has already been
806 .It Bq Er EADDRNOTAVAIL
807 when an attempt is made to create a
808 socket with a network address for which no network interface
810 .It Bq Er EAFNOSUPPORT
811 when an attempt is made to bind or connect a socket to a multicast
814 when trying to change TCP function blocks at an invalid point in the session;
816 when trying to use a TCP function block that is not available;
838 .%T "TCP Extensions for High Performance"
845 .%A "R. Scheffenegger"
846 .%T "TCP Extensions for High Performance"
851 .%T "Protection of BGP Sessions via the TCP MD5 Signature Option"
855 .%A "K. Ramakrishnan"
858 .%T "The Addition of Explicit Congestion Notification (ECN) to IP"
866 The RFC 1323 extensions for window scaling and timestamps were added
871 option was introduced in
874 .Em subject to change .
projects / FreeBSD / FreeBSD.git / blob