2 .\" This man page is Copyright (C) 1999 Andi Kleen <ak@muc.de>.
4 .\" %%%LICENSE_START(VERBATIM_ONE_PARA)
5 .\" Permission is granted to distribute possibly modified copies
6 .\" of this page provided the header is included verbatim,
7 .\" and in case of nontrivial modification author and date
8 .\" of the modification is added to the header.
11 .\" $Id: ip.7,v 1.19 2000/12/20 18:10:31 ak Exp $
13 .\" FIXME The following socket options are yet to be documented
15 .\" IP_XFRM_POLICY (2.5.48)
16 .\" Needs CAP_NET_ADMIN
18 .\" IP_IPSEC_POLICY (2.5.47)
19 .\" Needs CAP_NET_ADMIN
21 .\" IP_PASSSEC (2.6.17)
23 .\" commit 2c7946a7bf45ae86736ab3b43d0085e43947945c
24 .\" Author: Catherine Zhang <cxzhang@watson.ibm.com>
26 .\" IP_MINTTL (2.6.34)
27 .\" commit d218d11133d888f9745802146a50255a4781d37a
28 .\" Author: Stephen Hemminger <shemminger@vyatta.com>
30 .\" MCAST_JOIN_GROUP (2.4.22 / 2.6)
32 .\" MCAST_BLOCK_SOURCE (2.4.22 / 2.6)
34 .\" MCAST_UNBLOCK_SOURCE (2.4.22 / 2.6)
36 .\" MCAST_LEAVE_GROUP (2.4.22 / 2.6)
38 .\" MCAST_JOIN_SOURCE_GROUP (2.4.22 / 2.6)
40 .\" MCAST_LEAVE_SOURCE_GROUP (2.4.22 / 2.6)
42 .\" MCAST_MSFILTER (2.4.22 / 2.6)
44 .\" IP_UNICAST_IF (3.4)
45 .\" commit 76e21053b5bf33a07c76f99d27a74238310e3c71
46 .\" Author: Erich E. Hoover <ehoover@mines.edu>
48 .TH IP 7 2016-10-08 "Linux" "Linux Programmer's Manual"
50 ip \- Linux IPv4 protocol implementation
52 .B #include <sys/socket.h>
54 .\" .B #include <net/netinet.h> -- does not exist anymore
55 .\" .B #include <linux/errqueue.h> -- never include <linux/foo.h>
56 .B #include <netinet/in.h>
58 .B #include <netinet/ip.h> \fR/* superset of previous */
60 .IB tcp_socket " = socket(AF_INET, SOCK_STREAM, 0);"
62 .IB udp_socket " = socket(AF_INET, SOCK_DGRAM, 0);"
64 .IB raw_socket " = socket(AF_INET, SOCK_RAW, " protocol ");"
66 Linux implements the Internet Protocol, version 4,
67 described in RFC\ 791 and RFC\ 1122.
69 contains a level 2 multicasting implementation conforming to RFC\ 1112.
70 It also contains an IP router including a packet filter.
72 The programming interface is BSD-sockets compatible.
73 For more information on sockets, see
76 An IP socket is created using
79 socket(AF_INET, socket_type, protocol);
81 Valid socket types are
93 socket to access the IP protocol directly.
95 is the IP protocol in the IP header to be received or sent.
96 The only valid values for
100 for TCP sockets, and 0 and
105 you may specify a valid IANA IP protocol defined in
106 RFC\ 1700 assigned numbers.
108 When a process wants to receive new incoming packets or connections, it
109 should bind a socket to a local interface address using
111 In this case, only one IP socket may be bound to any given local
112 (address, port) pair.
115 is specified in the bind call, the socket will be bound to
120 is called on an unbound socket, the socket is automatically bound
121 to a random free port with the local address set to
125 is called on an unbound socket, the socket is automatically bound
126 to a random free port or to a usable shared port with the local address
130 A TCP local socket address that has been bound is unavailable for
131 some time after closing, unless the
134 Care should be taken when using this flag as it makes TCP less reliable.
136 An IP socket address is defined as a combination of an IP interface
137 address and a 16-bit port number.
138 The basic IP protocol does not supply port numbers, they
139 are implemented by higher level protocols like
145 is set to the IP protocol.
150 sa_family_t sin_family; /* address family: AF_INET */
151 in_port_t sin_port; /* port in network byte order */
152 struct in_addr sin_addr; /* internet address */
155 /* Internet address. */
157 uint32_t s_addr; /* address in network byte order */
165 This is required; in Linux 2.2 most networking functions return
167 when this setting is missing.
169 contains the port in network byte order.
170 The port numbers below 1024 are called
171 .IR "privileged ports"
173 .IR "reserved ports" ).
174 Only a privileged process
175 (on Linux: a process that has the
176 .B CAP_NET_BIND_SERVICE
177 capability in the user namespace governing its network namespace) may
180 Note that the raw IPv4 protocol as such has no concept of a
181 port, they are implemented only by higher protocols like
187 is the IP host address.
192 contains the host interface address in network byte order.
194 should be assigned one of the
201 .BR inet_makeaddr (3)
202 library functions or directly with the name resolver (see
203 .BR gethostbyname (3)).
205 IPv4 addresses are divided into unicast, broadcast,
206 and multicast addresses.
207 Unicast addresses specify a single interface of a host,
208 broadcast addresses specify all hosts on a network, and multicast
209 addresses address all hosts in a multicast group.
210 Datagrams to broadcast addresses can be sent or received only when the
213 In the current implementation, connection-oriented sockets are allowed
214 to use only unicast addresses.
215 .\" Leave a loophole for XTP @)
217 Note that the address and the port are always stored in
219 In particular, this means that you need to call
221 on the number that is assigned to a port.
222 All address/port manipulation
223 functions in the standard library work in network byte order.
225 There are several special addresses:
228 always refers to the local host via the loopback device;
231 means any address for binding;
234 means any host and has the same effect on bind as
236 for historical reasons.
238 IP supports some protocol-specific socket options that can be set with
242 The socket option level for IP is
244 .\" or SOL_IP on Linux
245 A boolean integer flag is zero when it is false, otherwise true.
247 When an invalid socket option is specified,
254 .BR IP_ADD_MEMBERSHIP " (since Linux 1.2)"
255 Join a multicast group.
263 struct in_addr imr_multiaddr; /* IP multicast group
265 struct in_addr imr_address; /* IP address of local
267 int imr_ifindex; /* interface index */
273 contains the address of the multicast group the application
274 wants to join or leave.
275 It must be a valid multicast address
276 .\" (i.e., within the 224.0.0.0-239.255.255.255 range)
282 is the address of the local interface with which the system
283 should join the multicast group; if it is equal to
285 an appropriate interface is chosen by the system.
287 is the interface index of the interface that should join/leave the
289 group, or 0 to indicate any interface.
293 structure is available only since Linux 2.2.
294 For compatibility, the old
296 structure (present since Linux 1.2) is still supported;
299 only by not including the
302 (The kernel determines which structure is being passed based
303 on the size passed in
311 .BR IP_ADD_SOURCE_MEMBERSHIP " (since Linux 2.4.22 / 2.5.68)"
312 Join a multicast group and allow receiving data only
313 from a specified source.
320 struct ip_mreq_source {
321 struct in_addr imr_multiaddr; /* IP multicast group
323 struct in_addr imr_interface; /* IP address of local
325 struct in_addr imr_sourceaddr; /* IP address of
333 structure is similar to
336 .BR IP_ADD_MEMBERSIP .
339 field contains the address of the multicast group the application
340 wants to join or leave.
343 field is the address of the local interface with which
344 the system should join the multicast group.
347 field contains the address of the source the
348 application wants to receive data from.
350 This option can be used multiple times to allow
351 receiving data from more than one source.
353 .BR IP_BIND_ADDRESS_NO_PORT " (since Linux 4.2)"
354 .\" commit 90c337da1524863838658078ec34241f45d8394d
355 Inform the kernel to not reserve an ephemeral port when using
357 with a port number of 0.
358 The port will later be automatically chosen at
361 in a way that allows sharing a source port as long as the 4-tuple is unique.
363 .BR IP_BLOCK_SOURCE " (since Linux 2.4.22 / 2.5.68)"
364 Stop receiving multicast data from a specific source in a given group.
365 This is valid only after the application has subscribed
366 to the multicast group using either
367 .BR IP_ADD_MEMBERSHIP
369 .BR IP_ADD_SOURCE_MEMBERSHIP .
373 structure as described under
374 .BR IP_ADD_SOURCE_MEMBERSHIP .
376 .BR IP_DROP_MEMBERSHIP " (since Linux 1.2)"
377 Leave a multicast group.
383 .BR IP_ADD_MEMBERSHIP .
385 .BR IP_DROP_SOURCE_MEMBERSHIP " (since Linux 2.4.22 / 2.5.68)"
386 Leave a source-specific group\(emthat is, stop receiving data from
387 a given multicast group that come from a given source.
388 If the application has subscribed to multiple sources within
389 the same group, data from the remaining sources will still be delivered.
390 To stop receiving data from all sources at once, use
391 .BR IP_DROP_MEMBERSHIP .
395 structure as described under
396 .BR IP_ADD_SOURCE_MEMBERSHIP .
398 .BR IP_FREEBIND " (since Linux 2.4)"
399 .\" Precisely: 2.4.0-test10
400 If enabled, this boolean option allows binding to an IP address
401 that is nonlocal or does not (yet) exist.
402 This permits listening on a socket,
403 without requiring the underlying network interface or the
404 specified dynamic IP address to be up at the time that
405 the application is trying to bind to it.
406 This option is the per-socket equivalent of the
409 interface described below.
411 .BR IP_HDRINCL " (since Linux 2.0)"
413 the user supplies an IP header in front of the user data.
418 for more information.
419 When this flag is enabled, the values set by
426 .BR IP_MSFILTER " (since Linux 2.4.22 / 2.5.68)"
427 This option provides access to the advanced full-state filtering API.
435 struct in_addr imsf_multiaddr; /* IP multicast group
437 struct in_addr imsf_interface; /* IP address of local
439 uint32_t imsf_fmode; /* Filter-mode */
441 uint32_t imsf_numsrc; /* Number of sources in
442 the following array */
443 struct in_addr imsf_slist[1]; /* Array of source
449 There are two macros,
453 which can be used to specify the filtering mode.
455 .BR IP_MSFILTER_SIZE (n)
456 macro exists to determine how much memory is needed to store
460 sources in the source list.
462 For the full description of multicast source filtering
465 .BR IP_MTU " (since Linux 2.2)"
466 .\" Precisely: 2.1.124
467 Retrieve the current known path MTU of the current socket.
473 and can be employed only when the socket has been connected.
475 .BR IP_MTU_DISCOVER " (since Linux 2.2)"
476 .\" Precisely: 2.1.124
477 Set or receive the Path MTU Discovery setting for a socket.
478 When enabled, Linux will perform Path MTU Discovery
479 as defined in RFC\ 1191 on
486 forces the don't-fragment flag to be set on all outgoing packets.
487 It is the user's responsibility to packetize the data
488 in MTU-sized chunks and to do the retransmits if necessary.
489 The kernel will reject (with
491 datagrams that are bigger than the known path MTU.
493 will fragment a datagram if needed according to the path MTU,
494 or will set the don't-fragment flag otherwise.
496 The system-wide default can be toggled between
500 by writing (respectively, zero and nonzero values) to the
501 .I /proc/sys/net/ipv4/ip_no_pmtu_disc
507 Path MTU discovery value:Meaning
508 IP_PMTUDISC_WANT:Use per-route settings.
509 IP_PMTUDISC_DONT:Never do Path MTU Discovery.
510 IP_PMTUDISC_DO:Always do Path MTU Discovery.
511 IP_PMTUDISC_PROBE:Set DF but ignore Path MTU.
514 When PMTU discovery is enabled, the kernel automatically keeps track of
515 the path MTU per destination host.
516 When it is connected to a specific peer with
518 the currently known path MTU can be retrieved conveniently using the
520 socket option (e.g., after an
523 The path MTU may change over time.
524 For connectionless sockets with many destinations,
525 the new MTU for a given destination can also be accessed using the
528 A new error will be queued for every incoming MTU update.
530 While MTU discovery is in progress, initial packets from datagram sockets
532 Applications using UDP should be aware of this and not
533 take it into account for their packet retransmit strategy.
535 To bootstrap the path MTU discovery process on unconnected sockets, it
536 is possible to start with a big datagram size
537 (up to 64K-headers bytes long) and let it shrink by updates of the path MTU.
539 To get an initial estimate of the
540 path MTU, connect a datagram socket to the destination address using
542 and retrieve the MTU by calling
548 It is possible to implement RFC 4821 MTU probing with
552 sockets by setting a value of
553 .BR IP_PMTUDISC_PROBE
554 (available since Linux 2.6.22).
555 This is also particularly useful for diagnostic tools such as
557 that wish to deliberately send probe packets larger than
558 the observed Path MTU.
560 .BR IP_MULTICAST_ALL " (since Linux 2.6.31)"
561 This option can be used to modify the delivery policy of multicast messages
562 to sockets bound to the wildcard
565 The argument is a boolean integer (defaults to 1).
567 the socket will receive messages from all the groups that have been joined
568 globally on the whole system.
569 Otherwise, it will deliver messages only from
570 the groups that have been explicitly joined (for example via the
572 option) on this particular socket.
574 .BR IP_MULTICAST_IF " (since Linux 1.2)"
575 Set the local device for a multicast socket.
581 .\" net: IP_MULTICAST_IF setsockopt now recognizes struct mreq
582 .\" Commit: 3a084ddb4bf299a6e898a9a07c89f3917f0713f7
586 .BR IP_ADD_MEMBERSHIP ,
590 (The kernel determines which structure is being passed based
591 on the size passed in
599 .BR IP_MULTICAST_LOOP " (since Linux 1.2)"
600 Set or read a boolean integer argument that determines whether
601 sent multicast packets should be looped back to the local sockets.
603 .BR IP_MULTICAST_TTL " (since Linux 1.2)"
604 Set or read the time-to-live value of outgoing multicast packets for this
606 It is very important for multicast packets to set the smallest TTL possible.
607 The default is 1 which means that multicast packets don't leave the local
608 network unless the user program explicitly requests it.
609 Argument is an integer.
611 .BR IP_NODEFRAG " (since Linux 2.6.36)"
612 If enabled (argument is nonzero),
613 the reassembly of outgoing packets is disabled in the netfilter layer.
614 The argument is an integer.
616 This option is valid only for
620 .BR IP_OPTIONS " (since Linux 2.0)"
621 .\" Precisely: 1.3.30
622 Set or get the IP options to be sent with every packet from this socket.
623 The arguments are a pointer to a memory buffer containing the options
624 and the option length.
627 call sets the IP options associated with a socket.
628 The maximum option size for IPv4 is 40 bytes.
629 See RFC\ 791 for the allowed options.
630 When the initial connection request packet for a
632 socket contains IP options, the IP options will be set automatically
633 to the options from the initial packet with routing headers reversed.
634 Incoming packets are not allowed to change options after the connection
636 The processing of all incoming source routing options
637 is disabled by default and can be enabled by using the
638 .I accept_source_route
641 Other options like timestamps are still handled.
642 For datagram sockets, IP options can be only set by the local user.
647 puts the current IP options used for sending into the supplied buffer.
649 .BR IP_PKTINFO " (since Linux 2.2)"
650 .\" Precisely: 2.1.68
653 ancillary message that contains a
655 structure that supplies some information about the incoming packet.
656 This only works for datagram oriented sockets.
657 The argument is a flag that tells the socket whether the
659 message should be passed or not.
660 The message itself can only be sent/retrieved
661 as control message with a packet using
669 unsigned int ipi_ifindex; /* Interface index */
670 struct in_addr ipi_spec_dst; /* Local address */
671 struct in_addr ipi_addr; /* Header Destination
678 is the unique index of the interface the packet was received on.
680 is the local address of the packet and
682 is the destination address in the packet header.
688 .\" This field is grossly misnamed
690 is not zero, then it is used as the local source address for the routing
691 table lookup and for setting up IP source route options.
694 is not zero, the primary local address of the interface specified by the
697 for the routing table lookup.
699 .BR IP_RECVERR " (since Linux 2.2)"
700 .\" Precisely: 2.1.15
701 Enable extended reliable error message passing.
702 When enabled on a datagram socket, all
703 generated errors will be queued in a per-socket error queue.
704 When the user receives an error from a socket operation,
705 the errors can be received by calling
712 structure describing the error will be passed in an ancillary message with
717 .\" or SOL_IP on Linux
718 This is useful for reliable error handling on unconnected sockets.
719 The received data portion of the error queue contains the error packet.
723 control message contains a
730 #define SO_EE_ORIGIN_NONE 0
731 #define SO_EE_ORIGIN_LOCAL 1
732 #define SO_EE_ORIGIN_ICMP 2
733 #define SO_EE_ORIGIN_ICMP6 3
735 struct sock_extended_err {
736 uint32_t ee_errno; /* error number */
737 uint8_t ee_origin; /* where the error originated */
738 uint8_t ee_type; /* type */
739 uint8_t ee_code; /* code */
741 uint32_t ee_info; /* additional information */
742 uint32_t ee_data; /* other data */
743 /* More data may follow */
746 struct sockaddr *SO_EE_OFFENDER(struct sock_extended_err *);
753 number of the queued error.
755 is the origin code of where the error originated.
756 The other fields are protocol-specific.
759 returns a pointer to the address of the network object
760 where the error originated from given a pointer to the ancillary message.
761 If this address is not known, the
767 and the other fields of the
773 structure as follows:
777 for errors received as an ICMP packet, or
778 .B SO_EE_ORIGIN_LOCAL
779 for locally generated errors.
780 Unknown values should be ignored.
784 are set from the type and code fields of the ICMP header.
786 contains the discovered MTU for
789 The message also contains the
790 .I sockaddr_in of the node
791 caused the error, which can be accessed with the
800 when the source was unknown.
801 When the error originated from the network, all IP options
802 .RB ( IP_OPTIONS ", " IP_TTL ", "
803 etc.) enabled on the socket and contained in the
804 error packet are passed as control messages.
805 The payload of the packet causing the error is returned as normal payload.
806 .\" FIXME . Is it a good idea to document that? It is a dubious feature.
811 .\" has slightly different semantics. Instead of
812 .\" saving the errors for the next timeout, it passes all incoming
813 .\" errors immediately to the user.
814 .\" This might be useful for very short-lived TCP connections which
815 .\" need fast error handling. Use this option with care:
816 .\" it makes TCP unreliable
817 .\" by not allowing it to recover properly from routing
818 .\" shifts and other normal
819 .\" conditions and breaks the protocol specification.
820 Note that TCP has no error queue;
826 is valid for TCP, but all errors are returned by socket function return or
832 enables passing of all received ICMP errors to the
833 application, otherwise errors are only reported on connected sockets
835 It sets or retrieves an integer boolean flag.
839 .BR IP_RECVOPTS " (since Linux 2.2)"
840 .\" Precisely: 2.1.15
841 Pass all incoming IP options to the user in a
844 The routing header and other options are already filled in
850 .BR IP_RECVORIGDSTADDR " (since Linux 2.6.29)"
851 .\" commit e8b2dfe9b4501ed0047459b2756ba26e5a940a69
852 This boolean option enables the
856 in which the kernel returns the original destination address
857 of the datagram being received.
858 The ancillary message contains a
859 .IR "struct sockaddr_in" .
861 .BR IP_RECVTOS " (since Linux 2.2)"
862 .\" Precisely: 2.1.68
865 ancillary message is passed with incoming packets.
866 It contains a byte which specifies the Type of Service/Precedence
867 field of the packet header.
868 Expects a boolean integer flag.
870 .BR IP_RECVTTL " (since Linux 2.2)"
871 .\" Precisely: 2.1.68
872 When this flag is set, pass a
874 control message with the time-to-live
875 field of the received packet as a byte.
880 .BR IP_RETOPTS " (since Linux 2.2)"
881 .\" Precisely: 2.1.15
884 but returns raw unprocessed options with timestamp and route record
885 options not filled in for this hop.
887 .BR IP_ROUTER_ALERT " (since Linux 2.2)"
888 .\" Precisely: 2.1.68
889 Pass all to-be forwarded packets with the
890 IP Router Alert option set to this socket.
891 Valid only for raw sockets.
892 This is useful, for instance, for user-space RSVP daemons.
893 The tapped packets are not forwarded by the kernel; it is
894 the user's responsibility to send them out again.
895 Socket binding is ignored,
896 such packets are only filtered by protocol.
897 Expects an integer flag.
899 .BR IP_TOS " (since Linux 1.0)"
900 Set or receive the Type-Of-Service (TOS) field that is sent
901 with every IP packet originating from this socket.
902 It is used to prioritize packets on the network.
904 There are some standard TOS flags defined:
906 to minimize delays for interactive traffic,
908 to optimize throughput,
910 to optimize for reliability,
912 should be used for "filler data" where slow transmission doesn't matter.
913 At most one of these TOS values can be specified.
914 Other bits are invalid and shall be cleared.
917 datagrams first by default,
918 but the exact behavior depends on the configured queueing discipline.
919 .\" FIXME elaborate on this
920 Some high-priority levels may require superuser privileges (the
923 .\" The priority can also be set in a protocol-independent way by the
924 .\" .RB ( SOL_SOCKET ", " SO_PRIORITY )
925 .\" socket option (see
928 .BR IP_TRANSPARENT " (since Linux 2.6.24)"
929 .\" commit f5715aea4564f233767ea1d944b2637a5fd7cd2e
930 .\" This patch introduces the IP_TRANSPARENT socket option: enabling that
931 .\" will make the IPv4 routing omit the non-local source address check on
932 .\" output. Setting IP_TRANSPARENT requires NET_ADMIN capability.
933 .\" http://lwn.net/Articles/252545/
934 Setting this boolean option enables transparent proxying on this socket.
935 This socket option allows
936 the calling application to bind to a nonlocal IP address and operate
937 both as a client and a server with the foreign address as the local endpoint.
938 NOTE: this requires that routing be set up in a way that
939 packets going to the foreign address are routed through the TProxy box
940 (i.e., the system hosting the application that employs the
943 Enabling this socket option requires superuser privileges
948 TProxy redirection with the iptables TPROXY target also requires that
949 this option be set on the redirected socket.
951 .BR IP_TTL " (since Linux 1.0)"
952 Set or retrieve the current time-to-live field that is used in every packet
953 sent from this socket.
955 .BR IP_UNBLOCK_SOURCE " (since Linux 2.4.22 / 2.5.68)"
956 Unblock previously blocked multicast source.
959 when given source is not being blocked.
963 structure as described under
964 .BR IP_ADD_SOURCE_MEMBERSHIP .
969 interfaces to configure some global parameters.
970 The parameters can be accessed by reading or writing files in the directory
971 .IR /proc/sys/net/ipv4/ .
972 .\" FIXME As at 2.6.12, 14 Jun 2005, the following are undocumented:
975 Interfaces described as
977 take an integer value, with a nonzero value ("true") meaning that
978 the corresponding option is enabled, and a zero value ("false")
979 meaning that the option is disabled.
982 .IR ip_always_defrag " (Boolean; since Linux 2.2.13)"
983 [New with kernel 2.2.13; in earlier kernel versions this feature
984 was controlled at compile time by the
985 .B CONFIG_IP_ALWAYS_DEFRAG
986 option; this option is not present in 2.4.x and later]
988 When this boolean flag is enabled (not equal 0), incoming fragments
990 that arose when some host between origin and destination decided
991 that the packets were too large and cut them into pieces) will be
992 reassembled (defragmented) before being processed, even if they are
993 about to be forwarded.
995 Enable only if running either a firewall that is the sole link
996 to your network or a transparent proxy; never ever use it for a
997 normal router or host.
998 Otherwise, fragmented communication can be disturbed
999 if the fragments travel over different links.
1000 Defragmentation also has a large memory and CPU time cost.
1002 This is automagically turned on when masquerading or transparent
1003 proxying are configured.
1006 .IR ip_autoconfig " (since Linux 2.2 to 2.6.17)"
1007 .\" Precisely: since 2.1.68
1008 .\" FIXME document ip_autoconfig
1012 .IR ip_default_ttl " (integer; default: 64; since Linux 2.2)"
1013 .\" Precisely: 2.1.15
1014 Set the default time-to-live value of outgoing packets.
1015 This can be changed per socket with the
1020 .IR ip_dynaddr " (Boolean; default: disabled; since Linux 2.0.31)"
1021 Enable dynamic socket address and masquerading entry rewriting on interface
1023 This is useful for dialup interface with changing IP addresses.
1024 0 means no rewriting, 1 turns it on and 2 enables verbose mode.
1027 .IR ip_forward " (Boolean; default: disabled; since Linux 1.2)"
1028 Enable IP forwarding with a boolean flag.
1029 IP forwarding can be also set on a per-interface basis.
1032 .IR ip_local_port_range " (since Linux 2.2)"
1033 .\" Precisely: since 2.1.68
1034 This file contains two integers that define the default local port range
1035 allocated to sockets that are not explicitly bound to a port number\(emthat
1036 is, the range used for
1037 .IR "ephemeral ports" .
1038 An ephemeral port is allocated to a socket in the following circumstances:
1041 the port number in a socket address is specified as 0 when calling
1045 is called on a stream socket that was not previously bound;
1048 was called on a socket that was not previously bound;
1051 is called on a datagram socket that was not previously bound.
1054 Allocation of ephemeral ports starts with the first number in
1055 .IR ip_local_port_range
1056 and ends with the second number.
1057 If the range of ephemeral ports is exhausted,
1058 then the relevant system call returns an error (but see BUGS).
1060 Note that the port range in
1061 .IR ip_local_port_range
1062 should not conflict with the ports used by masquerading
1063 (although the case is handled).
1064 Also, arbitrary choices may cause problems with some firewall packet
1065 filters that make assumptions about the local ports in use.
1066 The first number should be at least greater than 1024,
1067 or better, greater than 4096, to avoid clashes
1068 with well known ports and to minimize firewall problems.
1071 .IR ip_no_pmtu_disc " (Boolean; default: disabled; since Linux 2.2)"
1072 .\" Precisely: 2.1.15
1073 If enabled, don't do Path MTU Discovery for TCP sockets by default.
1074 Path MTU discovery may fail if misconfigured firewalls (that drop
1075 all ICMP packets) or misconfigured interfaces (e.g., a point-to-point
1076 link where the both ends don't agree on the MTU) are on the path.
1077 It is better to fix the broken routers on the path than to turn off
1078 Path MTU Discovery globally, because not doing it incurs a high cost
1081 .\" The following is from 2.6.12: Documentation/networking/ip-sysctl.txt
1083 .IR ip_nonlocal_bind " (Boolean; default: disabled; since Linux 2.4)"
1084 .\" Precisely: patch-2.4.0-test10
1085 If set, allows processes to
1087 to nonlocal IP addresses,
1088 which can be quite useful, but may break some applications.
1090 .\" The following is from 2.6.12: Documentation/networking/ip-sysctl.txt
1092 .IR ip6frag_time " (integer; default: 30)"
1093 Time in seconds to keep an IPv6 fragment in memory.
1095 .\" The following is from 2.6.12: Documentation/networking/ip-sysctl.txt
1097 .IR ip6frag_secret_interval " (integer; default: 600)"
1098 Regeneration interval (in seconds) of the hash secret (or lifetime
1099 for the hash secret) for IPv6 fragments.
1101 .IR ipfrag_high_thresh " (integer), " ipfrag_low_thresh " (integer)"
1102 If the amount of queued IP fragments reaches
1103 .IR ipfrag_high_thresh ,
1104 the queue is pruned down to
1105 .IR ipfrag_low_thresh .
1106 Contains an integer with the number of bytes.
1111 .\" FIXME Document the conf/*/* interfaces
1113 .\" FIXME Document the route/* interfaces
1115 All ioctls described in
1120 .\" commented out the following because ipchains is obsolete
1122 .\" The ioctls to configure firewalling are documented in
1128 Ioctls to configure generic device parameters are described in
1130 .\" FIXME Add a discussion of multicasting
1132 .\" FIXME document all errors.
1133 .\" We should really fix the kernels to give more uniform
1134 .\" error returns (ENOMEM vs ENOBUFS, EPERM vs EACCES etc.)
1137 The user tried to execute an operation without the necessary permissions.
1139 sending a packet to a broadcast address without having the
1142 sending a packet via a
1145 modifying firewall settings without superuser privileges (the
1148 binding to a privileged port without superuser privileges (the
1149 .B CAP_NET_BIND_SERVICE
1153 Tried to bind to an address already in use.
1156 A nonexistent interface was requested or the requested source
1157 address was not local.
1160 Operation on a nonblocking socket would block.
1163 A connection operation on a nonblocking socket is already in progress.
1166 A connection was closed during an
1170 No valid routing table entry matches the destination address.
1171 This error can be caused by a ICMP message from a remote router or
1172 for the local routing table.
1175 Invalid argument passed.
1176 For send operations this can be caused by sending to a
1182 was called on an already connected socket.
1185 Datagram is bigger than an MTU on the path and it cannot be fragmented.
1187 .BR ENOBUFS ", " ENOMEM
1188 Not enough free memory.
1189 This often means that the memory allocation is limited by the socket
1190 buffer limits, not by the system memory, but this is not 100% consistent.
1194 was called on a socket where no packet arrived.
1197 A kernel subsystem was not configured.
1199 .BR ENOPROTOOPT " and " EOPNOTSUPP
1200 Invalid socket option passed.
1203 The operation is defined only on a connected socket, but the socket wasn't
1207 User doesn't have permission to set high priority, change configuration,
1208 or send signals to the requested process or group.
1211 The connection was unexpectedly closed or shut down by the other end.
1214 The socket is not configured or an unknown socket type was requested.
1216 Other errors may be generated by the overlaying protocols; see
1226 .BR IP_MTU_DISCOVER ,
1227 .BR IP_RECVORIGDSTADDR ,
1230 .BR IP_ROUTER_ALERT ,
1234 .\" IP_PASSSEC is Linux-specific
1235 .\" IP_XFRM_POLICY is Linux-specific
1236 .\" IP_IPSEC_POLICY is a nonstandard extension, also present on some BSDs
1238 Be very careful with the
1240 option \- it is not privileged in Linux.
1241 It is easy to overload the network
1242 with careless broadcasts.
1243 For new application protocols
1244 it is better to use a multicast group instead of broadcasting.
1245 Broadcasting is discouraged.
1247 Some other BSD sockets implementations provide
1251 socket options to get the destination address and the interface of
1253 Linux has the more general
1257 Some BSD sockets implementations also provide an
1259 option, but an ancillary message with type
1261 is passed with the incoming packet.
1262 This is different from the
1264 option used in Linux.
1268 socket options level isn't portable; BSD-based stacks use the
1272 For compatibility with Linux 2.0, the obsolete
1273 .BI "socket(AF_INET, SOCK_PACKET, " protocol )
1274 syntax is still supported to open a
1277 This is deprecated and should be replaced by
1278 .BI "socket(AF_PACKET, SOCK_RAW, " protocol )
1280 The main difference is the new
1282 address structure for generic link layer information instead of the old
1285 There are too many inconsistent error values.
1287 The error used to diagnose exhaustion of the ephemeral port range differs
1288 across the various system calls
1293 that can assign ephemeral ports.
1295 The ioctls to configure IP-specific interface options and ARP tables are
1298 .\" Some versions of glibc forget to declare
1299 .\" .IR in_pktinfo .
1300 .\" Workaround currently is to copy it into your program from this man page.
1302 Receiving the original destination address with
1308 does not work in some 2.2 kernels.
1310 .\" This man page was written by Andi Kleen.
1316 .BR capabilities (7),
1325 RFC\ 791 for the original IP specification.
1326 RFC\ 1122 for the IPv4 host requirements.
1327 RFC\ 1812 for the IPv4 router requirements.