1 .\" Copyright (c) 1983, 1991, 1993
2 .\" The Regents of the University of California.
3 .\" Copyright (c) 2010-2011 The FreeBSD Foundation
4 .\" All rights reserved.
6 .\" Portions of this documentation were written at the Centre for Advanced
7 .\" Internet Architectures, Swinburne University of Technology, Melbourne,
8 .\" Australia by David Hayes under sponsorship from the FreeBSD Foundation.
10 .\" Redistribution and use in source and binary forms, with or without
11 .\" modification, are permitted provided that the following conditions
13 .\" 1. Redistributions of source code must retain the above copyright
14 .\" notice, this list of conditions and the following disclaimer.
15 .\" 2. Redistributions in binary form must reproduce the above copyright
16 .\" notice, this list of conditions and the following disclaimer in the
17 .\" documentation and/or other materials provided with the distribution.
18 .\" 3. Neither the name of the University nor the names of its contributors
19 .\" may be used to endorse or promote products derived from this software
20 .\" without specific prior written permission.
22 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 .\" From: @(#)tcp.4 8.1 (Berkeley) 6/5/93
42 .Nd Internet Transmission Control Protocol
49 .Fn socket AF_INET SOCK_STREAM 0
53 protocol provides reliable, flow-controlled, two-way
55 It is a byte-stream protocol used to
61 Internet address format and, in addition, provides a per-host
63 .Dq "port addresses" .
64 Thus, each address is composed
65 of an Internet address specifying the host and network,
68 port on the host identifying the peer entity.
76 Active sockets initiate connections to passive
80 sockets are created active; to create a
83 system call must be used
84 after binding the socket with the
87 Only passive sockets may use the
89 call to accept incoming connections.
90 Only active sockets may use the
92 call to initiate connections.
96 their location to match
97 incoming connection requests from multiple networks.
98 This technique, termed
99 .Dq "wildcard addressing" ,
101 server to provide service to clients on multiple networks.
102 To create a socket which listens on all networks, the Internet
108 port may still be specified
109 at this time; if the port is not specified, the system will assign one.
110 Once a connection has been established, the socket's address is
111 fixed by the peer entity's location.
112 The address assigned to the
113 socket is the address associated with the network interface
114 through which packets are being transmitted and received.
115 Normally, this address corresponds to the peer entity's network.
118 supports a number of socket options which can be set with
122 .Bl -tag -width ".Dv TCP_FUNCTION_BLK"
124 Information about a socket's underlying TCP session may be retrieved
125 by passing the read-only option
129 It accepts a single argument: a pointer to an instance of
130 .Vt "struct tcp_info" .
132 This API is subject to change; consult the source to determine
133 which fields are currently filled out by this option.
135 specific additions include
139 bandwidth-controlled window space.
141 Set or query congestion control algorithm specific parameters.
145 .It Dv TCP_CONGESTION
146 Select or query the congestion control algorithm that TCP will use for the
152 Enable or disable TCP Fast Open (TFO).
153 To use this option, the kernel must be built with the
157 This option can be set on the socket either before or after the
160 Clearing this option on a listen socket after it has been set has no effect on
161 existing TFO connections or TFO connections in progress; it only prevents new
162 TFO connections from being established.
164 For passively-created sockets, the
166 socket option can be queried to determine whether the connection was established
168 Note that connections that are established via a TFO
170 but that fall back to using a non-TFO
176 In addition to the facilities defined in RFC7413, this implementation supports a
177 pre-shared key (PSK) mode of operation in which the TFO server requires the
178 client to be in posession of a shared secret in order for the client to be able
179 to successfully open TFO connections with the server.
180 This is useful, for example, in environments where TFO servers are exposed to
181 both internal and external clients and only wish to allow TFO connections from
184 In the PSK mode of operation, the server generates and sends TFO cookies to
185 requesting clients as usual.
186 However, when validating cookies received in TFO SYNs from clients, the server
187 requires the client-supplied cookie to equal
188 .Bd -literal -offset left
189 SipHash24(key=\fI16-byte-psk\fP, msg=\fIcookie-sent-to-client\fP)
192 Multiple concurrent valid pre-shared keys are supported so that time-based
193 rolling PSK invalidation policies can be implemented in the system.
194 The default number of concurrent pre-shared keys is 2.
196 This can be adjusted with the
197 .Dv TCP_RFC7413_MAX_PSKS
199 .It Dv TCP_FUNCTION_BLK
200 Select or query the set of functions that TCP will use for this connection.
201 This allows a user to select an alternate TCP stack.
202 The alternate TCP stack must already be loaded in the kernel.
203 To list the available TCP stacks, see
204 .Va functions_available
206 .Sx MIB (sysctl) Variables
207 section further down.
208 To list the default TCP stack, see
209 .Va functions_default
211 .Sx MIB (sysctl) Variables
216 option accepts a per-socket timeout argument of
218 in seconds, for new, non-established
221 For the global default in milliseconds see
224 .Sx MIB (sysctl) Variables
225 section further down.
229 option accepts an argument of
231 for the amount of time, in seconds, that the connection must be idle
232 before keepalive probes (if enabled) are sent for the connection of this
234 If set on a listening socket, the value is inherited by the newly created
237 For the global default in milliseconds see
240 .Sx MIB (sysctl) Variables
241 section further down.
245 option accepts an argument of
247 to set the per-socket interval, in seconds, between keepalive probes sent
249 If set on a listening socket, the value is inherited by the newly created
252 For the global default in milliseconds see
255 .Sx MIB (sysctl) Variables
256 section further down.
260 option accepts an argument of
262 and allows a per-socket tuning of the number of probes sent, with no response,
263 before the connection will be dropped.
264 If set on a listening socket, the value is inherited by the newly created
267 For the global default see the
270 .Sx MIB (sysctl) Variables
271 section further down.
273 Under most circumstances,
275 sends data when it is presented;
276 when outstanding data has not yet been acknowledged, it gathers
277 small amounts of output to be sent in a single packet once
278 an acknowledgement is received.
279 For a small number of clients, such as window systems
280 that send a stream of mouse events which receive no replies,
281 this packetization may cause significant delays.
284 defeats this algorithm.
287 By default, a sender- and
288 .No receiver- Ns Tn TCP
289 will negotiate among themselves to determine the maximum segment size
290 to be used for each connection.
293 option allows the user to determine the result of this negotiation,
294 and to reduce it if desired.
295 .It Dv TCP_MAXUNACKTIME
298 option accepts an argument of
300 to set the per-socket interval, in seconds, in which the connection must
301 make progress. Progress is defined by at least 1 byte being acknowledged within
302 the set time period. If a connection fails to make progress, then the
304 stack will terminate the connection with a reset. Note that the default
305 value for this is zero which indicates no progress checks should be made.
308 usually sends a number of options in each packet, corresponding to
311 extensions which are provided in this implementation.
314 is provided to disable
316 option use on a per-connection basis.
319 .No sender- Ns Tn TCP
322 bit, and begin transmission immediately (if permitted) at the end of
327 When this option is set to a non-zero value,
329 will delay sending any data at all until either the socket is closed,
330 or the internal send buffer is filled.
332 This option enables the use of MD5 digests (also known as TCP-MD5)
333 on writes to the specified socket.
334 Outgoing traffic is digested;
335 digests on incoming traffic are verified.
336 When this option is enabled on a socket, all inbound and outgoing
337 TCP segments must be signed with MD5 digests.
339 One common use for this in a
341 router deployment is to enable
342 based routers to interwork with Cisco equipment at peering points.
343 Support for this feature conforms to RFC 2385.
345 In order for this option to function correctly, it is necessary for the
346 administrator to add a tcp-md5 key entry to the system's security
347 associations database (SADB) using the
350 This entry can only be specified on a per-host basis at this time.
352 If an SADB entry cannot be found for the destination,
353 the system does not send any outgoing segments and drops any inbound segments.
354 However, during connection negotiation, a non-signed segment will be accepted if
355 an SADB entry does not exist between hosts.
356 When a non-signed segment is accepted, the established connection is not
357 protected with MD5 digests.
359 Manage collection of connection level statistics using the
363 Each dropped segment is taken into account in the TCP protocol statistics.
364 .It Dv TCP_TXTLS_ENABLE
365 Enable in-kernel Transport Layer Security (TLS) for data written to this
370 .It Dv TCP_TXTLS_MODE
371 The integer argument can be used to get or set the current TLS transmit mode
376 .It Dv TCP_RXTLS_ENABLE
377 Enable in-kernel TLS for data read from this socket.
381 .It Dv TCP_REUSPORT_LB_NUMA
382 Changes NUMA affinity filtering for an established TCP listen
384 This option takes a single integer argument which specifies
385 the NUMA domain to filter on for this listen socket.
386 The argument can also have the follwing special values:
387 .Bl -tag -width "Dv TCP_REUSPORT_LB_NUMA"
388 .It Dv TCP_REUSPORT_LB_NUMA_NODOM
389 Remove NUMA filtering for this listen socket.
390 .It Dv TCP_REUSPORT_LB_NUMA_CURDOM
391 Filter traffic associated with the domain where the calling thread is
393 This is typically used after a process or thread inherits a listen
394 socket from its parent, and sets its CPU affinity to a particular core.
396 .It Dv TCP_REMOTE_UDP_ENCAPS_PORT
397 Set and get the remote UDP encapsulation port.
398 It can only be set on a closed TCP socket.
401 The option level for the
403 call is the protocol number for
406 .Xr getprotobyname 3 ,
409 All options are declared in
414 transport level may be used with
418 Incoming connection requests that are source-routed are noted,
419 and the reverse source route is used in responding.
421 The default congestion control algorithm for
425 Other congestion control algorithms can be made available using the
428 .Ss MIB (sysctl) Variables
431 protocol implements a number of variables in the
435 MIB, which can also be read or modified with
437 .Bl -tag -width ".Va v6pmtud_blackhole_mss"
438 .It Va always_keepalive
443 connections, the kernel will
444 periodically send a packet to the remote host to verify the connection
447 If enabled, disable sending of RST when a connection is attempted
448 to a port where there is no socket accepting connections.
451 .It Va blackhole_local
455 A number of variables for congestion control are under the
461 Variables for NewReno congestion control are under the
462 .Va net.inet.tcp.cc.newreno
467 Maximum amount of time, in milliseconds, before a delayed ACK is sent.
469 Delay ACK to try and piggyback it onto a data packet or another ACK.
471 Enable Lost Retransmission Detection for SACK-enabled sessions, disabled by
473 Under severe congestion, a retransmission can be lost which then leads to a
474 mandatory Retransmission Timeout (RTO), followed by slow-start.
475 LRD will try to resend the repeatedly lost packet, preventing the time-consuming
476 RTO and performance reducing slow-start.
478 Perform SACK loss recovery using the Proportional Rate Reduction (PRR) algorithm
479 described in RFC6937.
480 This improves the effectiveness of retransmissions particular in environments
481 with ACK thinning or burst loss events, as chances to run out of the ACK clock
482 are reduced, preventing lengthy and performance reducing RTO based loss recovery
484 .It Va do_prr_conservative
485 While doing Proportional Rate Reduction, remain strictly in a packet conserving
486 mode, sending only one new packet for each ACK received.
487 Helpful when a misconfigured token bucket traffic policer causes persistent
488 high losses leading to RTO, but reduces PRR effectiveness in more common settings
493 reassembly queue if the system is low on mbufs.
495 Drop TCP packets with both SYN and FIN set.
497 Enable support for TCP Explicit Congestion Notification (ECN).
498 ECN allows a TCP sender to reduce the transmission rate in order to
504 Allow incoming connections to request ECN.
505 Outgoing connections will request ECN.
507 Allow incoming connections to request ECN.
508 Outgoing connections will not request ECN.
511 Negotiate on incoming connection for Accurate ECN, ECN, or no ECN.
512 Outgoing connections will request Accurate ECN and fall back to
513 ECN depending on the capabilities of the server.
515 Negotiate on incoming connection for Accurate ECN, ECN, or no ECN.
516 Outgoing connections will not request ECN.
518 .It Va ecn.maxretries
519 Number of retries (SYN or SYN/ACK retransmits) before disabling ECN on a
521 This is needed to help with connection establishment
522 when a broken firewall is in the network path.
523 .It Va fast_finwait2_recycle
527 connections faster when the socket is marked as
529 (no user process has the socket open, data received on
530 the socket cannot be read).
531 The timeout used here is
532 .Va finwait2_timeout .
533 .It Va fastopen.acceptany
534 When non-zero, all client-supplied TFO cookies will be considered to be valid.
536 .It Va fastopen.autokey
538 .Va net.inet.tcp.fastopen.server_enable
539 are non-zero, a new key will be automatically generated after this specified
542 .It Va fastopen.ccache_bucket_limit
543 The maximum number of entries in a client cookie cache bucket.
544 The default value can be tuned with the
545 .Dv TCP_FASTOPEN_CCACHE_BUCKET_LIMIT_DEFAULT
546 kernel option or by setting
547 .Va net.inet.tcp.fastopen_ccache_bucket_limit
550 .It Va fastopen.ccache_buckets
551 The number of client cookie cache buckets.
553 The value can be tuned with the
554 .Dv TCP_FASTOPEN_CCACHE_BUCKETS_DEFAULT
555 kernel option or by setting
556 .Va fastopen.ccache_buckets
559 .It Va fastopen.ccache_list
560 Print the client cookie cache.
562 .It Va fastopen.client_enable
563 When zero, no new active (i.e., client) TFO connections can be created.
564 On the transition from enabled to disabled, the client cookie cache is cleared
566 The transition from enabled to disabled does not affect any active TFO
567 connections in progress; it only prevents new ones from being established.
569 .It Va fastopen.keylen
570 The key length in bytes.
572 .It Va fastopen.maxkeys
573 The maximum number of keys supported.
575 .It Va fastopen.maxpsks
576 The maximum number of pre-shared keys supported.
578 .It Va fastopen.numkeys
579 The current number of keys installed.
581 .It Va fastopen.numpsks
582 The current number of pre-shared keys installed.
584 .It Va fastopen.path_disable_time
585 When a failure occurs while trying to create a new active (i.e., client) TFO
586 connection, new active connections on the same path, as determined by the tuple
587 .Brq client_ip, server_ip, server_port ,
588 will be forced to be non-TFO for this many seconds.
589 Note that the path disable mechanism relies on state stored in client cookie
590 cache entries, so it is possible for the disable time for a given path to be
591 reduced if the corresponding client cookie cache entry is reused due to resource
592 pressure before the disable period has elapsed.
594 .Dv TCP_FASTOPEN_PATH_DISABLE_TIME_DEFAULT .
595 .It Va fastopen.psk_enable
596 When non-zero, pre-shared key (PSK) mode is enabled for all TFO servers.
597 On the transition from enabled to disabled, all installed pre-shared keys are
600 .It Va fastopen.server_enable
601 When zero, no new passive (i.e., server) TFO connections can be created.
602 On the transition from enabled to disabled, all installed keys and pre-shared
604 On the transition from disabled to enabled, if
606 is non-zero and there are no keys installed, a new key will be generated
608 The transition from enabled to disabled does not affect any passive TFO
609 connections in progress; it only prevents new ones from being established.
611 .It Va fastopen.setkey
612 Install a new key by writing
613 .Va net.inet.tcp.fastopen.keylen
614 bytes to this sysctl.
615 .It Va fastopen.setpsk
616 Install a new pre-shared key by writing
617 .Va net.inet.tcp.fastopen.keylen
618 bytes to this sysctl.
619 .It Va finwait2_timeout
620 Timeout to use for fast recycling of
624 .Pq Va fast_finwait2_recycle .
625 Defaults to 60 seconds.
626 .It Va functions_available
627 List of available TCP function blocks (TCP stacks).
628 .It Va functions_default
629 The default TCP function block (TCP stack).
630 .It Va functions_inherit_listen_socket_stack
631 Determines whether to inherit listen socket's TCP stack or use the current
632 system default TCP stack, as defined by
633 .Va functions_default .
636 The TCP host cache is used to cache connection details and metrics to
637 improve future performance of connections between the same hosts.
638 At the completion of a TCP connection, a host will cache information
639 for the connection for some defined period of time.
640 There are a number of
642 variables under this node.
644 .Va hostcache.enable .
645 .It Va hostcache.bucketlimit
646 The maximum number of entries for the same hash.
648 .It Va hostcache.cachelimit
649 Overall entry limit for hostcache.
654 .It Va hostcache.count
655 The current number of entries in the host cache.
656 .It Va hostcache.enable
657 Enable/disable the host cache:
660 Disable the host cache.
662 Enable the host cache. (default)
664 .It Va hostcache.expire
665 Time in seconds, how long a entry should be kept in the
666 host cache since last accessed.
667 Defaults to 3600 (1 hour).
668 .It Va hostcache.hashsize
669 Size of TCP hostcache hashtable.
670 This number has to be a power of two, or will be rejected.
672 .It Va hostcache.histo
673 Provide a Histogram of the hostcache hash utilization.
674 .It Va hostcache.list
675 Provide a complete list of all current entries in the host
677 .It Va hostcache.prune
678 Time in seconds between pruning expired host cache entries.
679 Defaults to 300 (5 minutes).
680 .It Va hostcache.purge
681 Expire all entires on next pruning of host cache entries.
682 Any non-zero setting will be reset to zero, once the purge
686 Do not purge all entries when pruning the host cache (default).
688 Purge all entries when doing the next pruning.
690 Purge all entries and also reseed the hash salt.
692 .It Va hostcache.purgenow
693 Immediately purge all entries once set to any value.
694 Setting this to 2 will also reseed the hash salt.
698 unreachable messages may abort connections in
701 .It Va initcwnd_segments
702 Enable the ability to specify initial congestion window in number of segments.
703 The default value is 10 as suggested by RFC 6928.
704 Changing the value on the fly would not affect connections
705 using congestion window from the hostcache.
707 This regulates the burst of packets allowed to be sent in the first RTT.
708 The value should be relative to the link capacity.
709 Start with small values for lower-capacity links.
710 Large bursts can cause buffer overruns and packet drops if routers have small
711 buffers or the link is experiencing congestion.
713 Use criteria defined in RFC793 instead of RFC5961 for accepting RST segments.
716 Use criteria defined in RFC793 instead of RFC5961 for accepting SYN segments.
718 .It Va isn_reseed_interval
719 The interval (in seconds) specifying how often the secret data used in
720 RFC 1948 initial sequence number calculations should be reseeded.
721 By default, this variable is set to zero, indicating that
722 no reseeding will occur.
723 Reseeding should not be necessary, and will break
725 recycling for a few minutes.
727 Number of keepalive probes sent, with no response, before a connection
729 The default is 8 packets.
731 Amount of time, in milliseconds, that the connection must be idle
732 before sending keepalive probes (if enabled).
733 The default is 7200000 msec (7.2M msec, 2 hours).
735 Timeout, in milliseconds, for new, non-established
738 The default is 75000 msec (75K msec, 75 sec).
740 The interval, in milliseconds, between keepalive probes sent to remote
741 machines, when no response is received on a
744 The default is 75000 msec (75K msec, 75 sec).
746 Log any connection attempts to ports where there is no socket
747 accepting connections.
748 The value of 1 limits the logging to
750 (connection establishment) packets only.
751 A value of 2 results in any
753 packets to closed ports being logged.
754 Any value not listed above disables the logging
755 (default is 0, i.e., the logging is disabled).
757 Minimum TCP Maximum Segment Size; used to prevent a denial of service attack
758 from an unreasonably low MSS.
760 The Maximum Segment Lifetime, in milliseconds, for a packet.
762 The default value used for the TCP Maximum Segment Size
764 for IPv4 when no advice to the contrary is received from MSS negotiation.
766 Enable the New Congestion Window Validation mechanism as described in RFC 7661.
767 This gently reduces the congestion window during periods, where TCP is
768 application limited and the network bandwidth is not utilized completely.
769 That prevents self-inflicted packet losses once the application starts to
770 transmit data at a higher speed.
771 .It Va nolocaltimewait
772 Suppress creation of TCP
774 states for connections in
775 which both endpoints are local.
776 .It Va path_mtu_discovery
777 Enable Path MTU Discovery.
779 Number of active protocol control blocks
781 .It Va perconn_stats_enable
782 Controls the default collection of statistics for all connections using the
785 0 disables, 1 enables, 2 enables random sampling across log id connection
786 groups with all connections in a group receiving the same setting.
787 .It Va perconn_stats_sample_rates
788 A CSV list of template_spec=percent key-value pairs which controls the per
789 template sampling rates when
793 Maximum persistence interval, msec.
795 Minimum persistence interval, msec.
796 .It Va pmtud_blackhole_detection
797 Enable automatic path MTU blackhole detection.
798 In case of retransmits of MSS sized segments,
799 the OS will lower the MSS to check if it's an MTU problem.
800 If the current MSS is greater than the configured value to try
801 .Po Va net.inet.tcp.pmtud_blackhole_mss
803 .Va net.inet.tcp.v6pmtud_blackhole_mss
805 it will be set to this value, otherwise,
806 the MSS will be set to the default values
807 .Po Va net.inet.tcp.mssdflt
809 .Va net.inet.tcp.v6mssdflt
814 Disable path MTU blackhole detection.
816 Enable path MTU blackhole detection for IPv4 and IPv6.
818 Enable path MTU blackhole detection only for IPv4.
820 Enable path MTU blackhole detection only for IPv6.
822 .It Va pmtud_blackhole_mss
823 MSS to try for IPv4 if PMTU blackhole detection is turned on.
824 .It Va reass.cursegments
825 The current total number of segments present in all reassembly queues.
826 .It Va reass.maxqueuelen
827 The maximum number of segments allowed in each reassembly queue.
828 By default, the system chooses a limit based on each TCP connection's
829 receive buffer size and maximum segment size (MSS).
830 The actual limit applied to a session's reassembly queue will be the lower of
831 the system-calculated automatic limit and the user-specified
832 .Va reass.maxqueuelen
834 .It Va reass.maxsegments
835 The maximum limit on the total number of segments across all reassembly
837 The limit can be adjusted as a tunable.
839 Enable automatic receive buffer sizing as a connection progresses.
841 Maximum size of automatic receive buffer.
845 receive window (buffer size).
847 Maximum number of consecutive timer based retransmits sent after a data
848 segment is lost (default and maximum is 12).
849 .It Va rexmit_drop_options
850 Drop TCP options from third and later retransmitted SYN segments
852 .It Va rexmit_initial , rexmit_min , rexmit_slop
853 Adjust the retransmit timer calculation for
856 typically added to the raw calculation to take into account
857 occasional variances that the
859 (smoothed round-trip time)
860 is unable to accommodate, while the minimum specifies an
865 second minimum, these RFCs tend to focus on streaming behavior,
866 and fail to deal with the fact that a 1 second minimum has severe
867 detrimental effects over lossy interactive connections, such
868 as a 802.11b wireless link, and over very fast but lossy
869 connections for those cases not covered by the fast retransmit
871 For this reason, we use 200ms of slop and a near-0
872 minimum, which gives us an effective minimum of 200ms (similar to
874 The initial value is used before an RTT measurement has been performed.
876 Implement the window scaling and timestamp options of RFC 1323/RFC 7323
881 Disable window scaling and timestamp option.
883 Enable window scaling and timestamp option.
885 Enable only window scaling.
887 Enable only timestamp option.
890 Enable the Limited Transmit algorithm as described in RFC 3042.
891 It helps avoid timeouts on lossy links and also when the congestion window
892 is small, as happens on short transfers.
894 Enable support for RFC 3390, which allows for a variable-sized
895 starting congestion window on new connections, depending on the
896 maximum segment size.
897 This helps throughput in general, but
898 particularly affects short transfers and high-bandwidth large
899 propagation-delay connections.
901 Deprecated and superseded by
904 Enable support for RFC 2018, TCP Selective Acknowledgment option,
905 which allows the receiver to inform the sender about all successfully
906 arrived segments, allowing the sender to retransmit the missing segments
908 .It Va sack.globalholes
909 Global number of TCP SACK holes currently allocated.
910 .It Va sack.globalmaxholes
911 Maximum number of SACK holes per system, across all connections.
914 Maximum number of SACK holes per connection.
917 Enables three updated mechanisms from RFC6675 (default is true).
918 Calculate the bytes in flight using the algorithm described in RFC 6675, and
919 is also an improvement when Proportional Rate Reduction is enabled.
920 Next, Rescue Retransmission helps timely loss recovery, when the trailing segments
921 of a transmission are lost, while no additional data is ready to be sent.
922 In case a partial ACK without a SACK block is received during SACK loss
923 recovery, the trailing segment is immediately resent, rather than waiting
924 for a Retransmission timeout.
925 Finally, SACK loss recovery is also engaged, once two segments plus one byte are
926 SACKed - even if no traditional duplicate ACKs were observed.
928 Enable automatic send buffer sizing.
929 .It Va sendbuf_auto_lowat
930 Modify threshold for auto send buffer growth to account for
933 Incrementor step size of automatic send buffer.
935 Maximum size of automatic send buffer.
939 send window (buffer size).
942 .Va net.inet.tcp.syncache
943 node are documented in
946 Determines whether or not
948 cookies should be generated for outbound
952 cookies are a great help during
954 flood attacks, and are enabled by default.
957 .It Va syncookies_only
963 control-block hash table
965 This is tuned using the kernel option
968 .Va net.inet.tcp.tcbhashsize
971 .It Va tolerate_missing_ts
972 Tolerate the missing of timestamps (RFC 1323/RFC 7323) for
974 segments belonging to
976 connections for which support of
978 timestamps has been negotiated.
979 As of June 2021, several TCP stacks are known to violate RFC 7323, including
980 modern widely deployed ones.
981 Therefore the default is 1, i.e., the missing of timestamps is tolerated.
982 .It Va ts_offset_per_conn
983 When initializing the TCP timestamps, use a per connection offset instead of a
984 per host pair offset.
985 Default is to use per connection offsets as recommended in RFC 7323.
987 Enable TCP Segmentation Offload.
988 .It Va udp_tunneling_overhead
989 The overhead taken into account when using UDP encapsulation.
990 Since MSS clamping by middleboxes will most likely not work, values larger than
991 8 (the size of the UDP header) are also supported.
992 Supported values are between 8 and 1024.
994 .It Va udp_tunneling_port
995 The local UDP encapsulation port.
996 A value of 0 indicates that UDP encapsulation is disabled.
999 The default value used for the TCP Maximum Segment Size
1001 for IPv6 when no advice to the contrary is received from MSS negotiation.
1002 .It Va v6pmtud_blackhole_mss
1003 MSS to try for IPv6 if PMTU blackhole detection is turned on.
1005 .Va pmtud_blackhole_detection .
1008 A socket operation may fail with one of the following errors returned:
1011 when trying to establish a connection on a socket which
1013 .It Bo Er ENOBUFS Bc or Bo Er ENOMEM Bc
1014 when the system runs out of memory for
1015 an internal data structure;
1017 when a connection was dropped
1018 due to excessive retransmissions;
1019 .It Bq Er ECONNRESET
1020 when the remote peer
1021 forces the connection to be closed;
1022 .It Bq Er ECONNREFUSED
1024 peer actively refuses connection establishment (usually because
1025 no process is listening to the port);
1026 .It Bq Er EADDRINUSE
1028 is made to create a socket with a port which has already been
1030 .It Bq Er EADDRNOTAVAIL
1031 when an attempt is made to create a
1032 socket with a network address for which no network interface
1034 .It Bq Er EAFNOSUPPORT
1035 when an attempt is made to bind or connect a socket to a multicast
1038 when trying to change TCP function blocks at an invalid point in the session;
1040 when trying to use a TCP function block that is not available;
1064 .%T "TCP Extensions for High Performance"
1071 .%A "R. Scheffenegger"
1072 .%T "TCP Extensions for High Performance"
1077 .%T "Protection of BGP Sessions via the TCP MD5 Signature Option"
1081 .%A "K. Ramakrishnan"
1084 .%T "The Addition of Explicit Congestion Notification (ECN) to IP"
1090 protocol appeared in
1092 The RFC 1323 extensions for window scaling and timestamps were added
1097 option was introduced in
1100 .Em subject to change .
projects / FreeBSD / FreeBSD.git / blob