1 .\" Copyright (c) 1983, 1991, 1993
2 .\" The Regents of the University of California.
3 .\" Copyright (c) 2010-2011 The FreeBSD Foundation
4 .\" All rights reserved.
6 .\" Portions of this documentation were written at the Centre for Advanced
7 .\" Internet Architectures, Swinburne University of Technology, Melbourne,
8 .\" Australia by David Hayes under sponsorship from the FreeBSD Foundation.
10 .\" Redistribution and use in source and binary forms, with or without
11 .\" modification, are permitted provided that the following conditions
13 .\" 1. Redistributions of source code must retain the above copyright
14 .\" notice, this list of conditions and the following disclaimer.
15 .\" 2. Redistributions in binary form must reproduce the above copyright
16 .\" notice, this list of conditions and the following disclaimer in the
17 .\" documentation and/or other materials provided with the distribution.
18 .\" 3. Neither the name of the University nor the names of its contributors
19 .\" may be used to endorse or promote products derived from this software
20 .\" without specific prior written permission.
22 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 .\" From: @(#)tcp.4 8.1 (Berkeley) 6/5/93
42 .Nd Internet Transmission Control Protocol
49 .Fn socket AF_INET SOCK_STREAM 0
53 protocol provides reliable, flow-controlled, two-way
55 It is a byte-stream protocol used to
61 Internet address format and, in addition, provides a per-host
63 .Dq "port addresses" .
64 Thus, each address is composed
65 of an Internet address specifying the host and network,
68 port on the host identifying the peer entity.
76 Active sockets initiate connections to passive
80 sockets are created active; to create a
83 system call must be used
84 after binding the socket with the
87 Only passive sockets may use the
89 call to accept incoming connections.
90 Only active sockets may use the
92 call to initiate connections.
96 their location to match
97 incoming connection requests from multiple networks.
98 This technique, termed
99 .Dq "wildcard addressing" ,
101 server to provide service to clients on multiple networks.
102 To create a socket which listens on all networks, the Internet
108 port may still be specified
109 at this time; if the port is not specified, the system will assign one.
110 Once a connection has been established, the socket's address is
111 fixed by the peer entity's location.
112 The address assigned to the
113 socket is the address associated with the network interface
114 through which packets are being transmitted and received.
115 Normally, this address corresponds to the peer entity's network.
118 supports a number of socket options which can be set with
122 .Bl -tag -width ".Dv TCP_CONGESTION"
124 Information about a socket's underlying TCP session may be retrieved
125 by passing the read-only option
129 It accepts a single argument: a pointer to an instance of
130 .Vt "struct tcp_info" .
132 This API is subject to change; consult the source to determine
133 which fields are currently filled out by this option.
135 specific additions include
139 bandwidth-controlled window space.
140 .It Dv TCP_CONGESTION
141 Select or query the congestion control algorithm that TCP will use for the
149 option accepts a per-socket timeout argument of
151 in seconds, for new, non-established
154 For the global default in milliseconds see
158 section further down.
162 option accepts an argument of
164 for the amount of time, in seconds, that the connection must be idle
165 before keepalive probes (if enabled) are sent for the connection of this
167 If set on a listening socket, the value is inherited by the newly created
170 For the global default in milliseconds see
174 section further down.
178 option accepts an argument of
180 to set the per-socket interval, in seconds, between keepalive probes sent
182 If set on a listening socket, the value is inherited by the newly created
185 For the global default in milliseconds see
189 section further down.
193 option accepts an argument of
195 and allows a per-socket tuning of the number of probes sent, with no response,
196 before the connection will be dropped.
197 If set on a listening socket, the value is inherited by the newly created
200 For the global default see the
204 section further down.
206 Under most circumstances,
208 sends data when it is presented;
209 when outstanding data has not yet been acknowledged, it gathers
210 small amounts of output to be sent in a single packet once
211 an acknowledgement is received.
212 For a small number of clients, such as window systems
213 that send a stream of mouse events which receive no replies,
214 this packetization may cause significant delays.
217 defeats this algorithm.
219 By default, a sender- and
220 .No receiver- Ns Tn TCP
221 will negotiate among themselves to determine the maximum segment size
222 to be used for each connection.
225 option allows the user to determine the result of this negotiation,
226 and to reduce it if desired.
229 usually sends a number of options in each packet, corresponding to
232 extensions which are provided in this implementation.
235 is provided to disable
237 option use on a per-connection basis.
240 .No sender- Ns Tn TCP
243 bit, and begin transmission immediately (if permitted) at the end of
248 When this option is set to a non-zero value,
250 will delay sending any data at all until either the socket is closed,
251 or the internal send buffer is filled.
253 This option enables the use of MD5 digests (also known as TCP-MD5)
254 on writes to the specified socket.
255 Outgoing traffic is digested;
256 digests on incoming traffic are verified if the
257 .Va net.inet.tcp.signature_verify_input
259 The current default behavior for the system is to respond to a system
260 advertising this option with TCP-MD5; this may change.
262 One common use for this in a
264 router deployment is to enable
265 based routers to interwork with Cisco equipment at peering points.
266 Support for this feature conforms to RFC 2385.
269 sessions are supported.
271 In order for this option to function correctly, it is necessary for the
272 administrator to add a tcp-md5 key entry to the system's security
273 associations database (SADB) using the
276 This entry must have an SPI of 0x1000 and can therefore only be specified
277 on a per-host basis at this time.
279 If an SADB entry cannot be found for the destination, the outgoing traffic
280 will have an invalid digest option prepended, and the following error message
281 will be visible on the system console:
282 .Em "tcp_signature_compute: SADB lookup failed for %d.%d.%d.%d" .
285 The option level for the
287 call is the protocol number for
290 .Xr getprotobyname 3 ,
293 All options are declared in
298 transport level may be used with
302 Incoming connection requests that are source-routed are noted,
303 and the reverse source route is used in responding.
305 The default congestion control algorithm for
309 Other congestion control algorithms can be made available using the
315 protocol implements a number of variables in the
320 .Bl -tag -width ".Va TCPCTL_DO_RFC1323"
321 .It Dv TCPCTL_DO_RFC1323
323 Implement the window scaling and timestamp options of RFC 1323
325 .It Dv TCPCTL_MSSDFLT
327 The default value used for the maximum segment size
329 when no advice to the contrary is received from MSS negotiation.
330 .It Dv TCPCTL_SENDSPACE
335 .It Dv TCPCTL_RECVSPACE
341 Log any connection attempts to ports where there is not a socket
342 accepting connections.
343 The value of 1 limits the logging to
345 (connection establishment) packets only.
346 That of 2 results in any
348 packets to closed ports being logged.
349 Any value unlisted above disables the logging
350 (default is 0, i.e., the logging is disabled).
352 The Maximum Segment Lifetime, in milliseconds, for a packet.
354 Timeout, in milliseconds, for new, non-established
357 The default is 75000 msec.
359 Amount of time, in milliseconds, that the connection must be idle
360 before keepalive probes (if enabled) are sent.
361 The default is 7200000 msec (2 hours).
363 The interval, in milliseconds, between keepalive probes sent to remote
364 machines, when no response is received on a
367 The default is 75000 msec.
369 Number of probes sent, with no response, before a connection
371 The default is 8 packets.
372 .It Va always_keepalive
377 connections, the kernel will
378 periodically send a packet to the remote host to verify the connection
383 unreachable messages may abort connections in
389 reassembly queue if the system is low on mbufs.
391 If enabled, disable sending of RST when a connection is attempted
392 to a port where there is not a socket accepting connections.
396 Delay ACK to try and piggyback it onto a data packet.
398 Maximum amount of time, in milliseconds, before a delayed ACK is sent.
399 .It Va path_mtu_discovery
400 Enable Path MTU Discovery.
404 control-block hash table
406 This may be tuned using the kernel option
409 .Va net.inet.tcp.tcbhashsize
413 Number of active process control blocks
416 Determines whether or not
418 cookies should be generated for outbound
422 cookies are a great help during
424 flood attacks, and are enabled by default.
427 .It Va isn_reseed_interval
428 The interval (in seconds) specifying how often the secret data used in
429 RFC 1948 initial sequence number calculations should be reseeded.
430 By default, this variable is set to zero, indicating that
431 no reseeding will occur.
432 Reseeding should not be necessary, and will break
434 recycling for a few minutes.
435 .It Va rexmit_min , rexmit_slop
436 Adjust the retransmit timer calculation for
439 typically added to the raw calculation to take into account
440 occasional variances that the
442 (smoothed round-trip time)
443 is unable to accommodate, while the minimum specifies an
448 second minimum, these RFCs tend to focus on streaming behavior,
449 and fail to deal with the fact that a 1 second minimum has severe
450 detrimental effects over lossy interactive connections, such
451 as a 802.11b wireless link, and over very fast but lossy
452 connections for those cases not covered by the fast retransmit
454 For this reason, we use 200ms of slop and a near-0
455 minimum, which gives us an effective minimum of 200ms (similar to
458 Enable the Limited Transmit algorithm as described in RFC 3042.
459 It helps avoid timeouts on lossy links and also when the congestion window
460 is small, as happens on short transfers.
462 Enable support for RFC 3390, which allows for a variable-sized
463 starting congestion window on new connections, depending on the
464 maximum segment size.
465 This helps throughput in general, but
466 particularly affects short transfers and high-bandwidth large
467 propagation-delay connections.
469 Enable support for RFC 2018, TCP Selective Acknowledgment option,
470 which allows the receiver to inform the sender about all successfully
471 arrived segments, allowing the sender to retransmit the missing segments
474 Maximum number of SACK holes per connection.
476 .It Va sack.globalmaxholes
477 Maximum number of SACK holes per system, across all connections.
480 When a TCP connection enters the
482 state, its associated socket structure is freed, since it is of
483 negligible size and use, and a new structure is allocated to contain a
484 minimal amount of information necessary for sustaining a connection in
485 this state, called the compressed TCP TIME_WAIT state.
486 Since this structure is smaller than a socket structure, it can save
487 a significant amount of system memory.
489 .Va net.inet.tcp.maxtcptw
490 MIB variable controls the maximum number of these structures allocated.
491 By default, it is initialized to
492 .Va kern.ipc.maxsockets
494 .It Va nolocaltimewait
495 Suppress creating of compressed TCP TIME_WAIT states for connections in
496 which both endpoints are local.
497 .It Va fast_finwait2_recycle
501 connections faster when the socket is marked as
503 (no user process has the socket open, data received on
504 the socket cannot be read).
505 The timeout used here is
506 .Va finwait2_timeout .
507 .It Va finwait2_timeout
508 Timeout to use for fast recycling of
512 Defaults to 60 seconds.
514 Enable support for TCP Explicit Congestion Notification (ECN).
515 ECN allows a TCP sender to reduce the transmission rate in order to
517 .It Va ecn.maxretries
518 Number of retries (SYN or SYN/ACK retransmits) before disabling ECN on a
520 This is needed to help with connection establishment
521 when a broken firewall is in the network path.
522 .It Va pmtud_blackhole_detection
523 Turn on automatic path MTU blackhole detection.
524 In case of retransmits OS will
525 lower the MSS to check if it's MTU problem.
526 If current MSS is greater than
527 configured value to try, it will be set to configured value, otherwise,
528 MSS will be set to default values
529 .Po Va net.inet.tcp.mssdflt
531 .Va net.inet.tcp.v6mssdflt
533 .It Va pmtud_blackhole_mss
534 MSS to try for IPv4 if PMTU blackhole detection is turned on.
535 .It Va v6pmtud_blackhole_mss
536 MSS to try for IPv6 if PMTU blackhole detection is turned on.
537 .It Va pmtud_blackhole_activated
538 Number of times configured values were used in an attempt to downshift.
539 .It Va pmtud_blackhole_activated_min_mss
540 Number of times default MSS was used in an attempt to downshift.
541 .It Va pmtud_blackhole_failed
542 Number of connections for which retransmits continued even after MSS
546 A socket operation may fail with one of the following errors returned:
549 when trying to establish a connection on a socket which
552 when the system runs out of memory for
553 an internal data structure;
555 when a connection was dropped
556 due to excessive retransmissions;
559 forces the connection to be closed;
560 .It Bq Er ECONNREFUSED
562 peer actively refuses connection establishment (usually because
563 no process is listening to the port);
566 is made to create a socket with a port which has already been
568 .It Bq Er EADDRNOTAVAIL
569 when an attempt is made to create a
570 socket with a network address for which no network interface
572 .It Bq Er EAFNOSUPPORT
573 when an attempt is made to bind or connect a socket to a multicast
592 .%T "TCP Extensions for High Performance"
597 .%T "Protection of BGP Sessions via the TCP MD5 Signature Option"
601 .%A "K. Ramakrishnan"
604 .%T "The Addition of Explicit Congestion Notification (ECN) to IP"
612 The RFC 1323 extensions for window scaling and timestamps were added
617 option was introduced in
620 .Em subject to change .
projects / FreeBSD / FreeBSD.git / blob