<!--
SPDX-License-Identifier: LGPL-2.1+
-
- Copyright © 2013 Tom Gundersen
-->
<refentry id="systemd.netdev" conditional='ENABLE_NETWORKD'>
<row><entry><varname>gretap</varname></entry>
<entry>A Level 2 GRE tunnel over IPv4.</entry></row>
+ <row><entry><varname>erspan</varname></entry>
+ <entry>ERSPAN mirrors traffic on one or more source ports and delivers the mirrored traffic to one or more destination ports on another switch.
+ The traffic is encapsulated in generic routing encapsulation (GRE) and is therefore routable across a layer 3 network between the source switch
+ and the destination switch.</entry></row>
+
<row><entry><varname>ip6gre</varname></entry>
<entry>A Level 3 GRE tunnel over IPv6.</entry></row>
<row><entry><varname>netdevsim</varname></entry>
<entry> A simulator. This simulated networking device is used for testing various networking APIs and at this time is particularly focused on testing hardware offloading related interfaces.</entry></row>
+
+ <row><entry><varname>fou</varname></entry>
+ <entry>Foo-over-UDP tunneling.</entry></row>
+
</tbody>
</tgroup>
</table>
<varlistentry>
<term><varname>MTUBytes=</varname></term>
<listitem>
- <para>The maximum transmission unit in bytes to set for
- the device. The usual suffixes K, M, G, are supported and
- are understood to the base of 1024. This key is not
- currently supported for <literal>tun</literal> or
- <literal>tap</literal> devices.
- </para>
+ <para>The maximum transmission unit in bytes to set for the device. The usual suffixes K, M, G,
+ are supported and are understood to the base of 1024. For <literal>tun</literal> or
+ <literal>tap</literal> devices, <varname>MTUBytes=</varname> setting is not currently supported in
+ <literal>[NetDev]</literal> section. Please specify it in <literal>[Link]</literal> section of
+ corresponding
+ <citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+ files.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>MACAddress=</varname></term>
<listitem>
- <para>The MAC address to use for the device. If none is
- given, one is generated based on the interface name and
- the
+ <para>The MAC address to use for the device. For <literal>tun</literal> or <literal>tap</literal>
+ devices, setting <varname>MACAddress=</varname> in the <literal>[NetDev]</literal> section is not
+ supported. Please specify it in <literal>[Link]</literal> section of the corresponding
+ <citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+ file. If this option is not set, <literal>vlan</literal> devices inherit the MAC address of the
+ physical interface. For other kind of netdevs, if this option is not set, then MAC address is
+ generated based on the interface name and the
<citerefentry><refentrytitle>machine-id</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
- This key is not currently supported for
- <literal>tun</literal> or <literal>tap</literal> devices.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>MulticastQuerier=</varname></term>
<listitem>
- <para>A boolean. This setting controls the IFLA_BR_MCAST_QUERIER option in the kernel.
+ <para>Takes a boolean. This setting controls the IFLA_BR_MCAST_QUERIER option in the kernel.
If enabled, the kernel will send general ICMP queries from a zero source address.
This feature should allow faster convergence on startup, but it causes some
multicast-aware switches to misbehave and disrupt forwarding of multicast packets.
- When unset, the kernel's default setting applies.
+ When unset, the kernel's default will be used.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>MulticastSnooping=</varname></term>
<listitem>
- <para>A boolean. This setting controls the IFLA_BR_MCAST_SNOOPING option in the kernel.
+ <para>Takes a boolean. This setting controls the IFLA_BR_MCAST_SNOOPING option in the kernel.
If enabled, IGMP snooping monitors the Internet Group Management Protocol (IGMP) traffic
- between hosts and multicast routers. When unset, the kernel's default setting applies.
+ between hosts and multicast routers. When unset, the kernel's default will be used.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>VLANFiltering=</varname></term>
<listitem>
- <para>A boolean. This setting controls the IFLA_BR_VLAN_FILTERING option in the kernel.
- If enabled, the bridge will be started in VLAN-filtering mode. When unset, the kernel's
- default setting applies.
+ <para>Takes a boolean. This setting controls the IFLA_BR_VLAN_FILTERING option in the kernel.
+ If enabled, the bridge will be started in VLAN-filtering mode. When unset, the kernel's default will be used.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>STP=</varname></term>
<listitem>
- <para>A boolean. This enables the bridge's Spanning Tree Protocol (STP). When unset,
- the kernel's default setting applies.
+ <para>Takes a boolean. This enables the bridge's Spanning Tree Protocol (STP).
+ When unset, the kernel's default will be used.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>GVRP=</varname></term>
<listitem>
- <para>The Generic VLAN Registration Protocol (GVRP) is a protocol that
- allows automatic learning of VLANs on a network. A boolean. When unset,
- the kernel's default setting applies.</para>
+ <para>Takes a boolean. The Generic VLAN Registration Protocol (GVRP) is a protocol that
+ allows automatic learning of VLANs on a network.
+ When unset, the kernel's default will be used.
+ </para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>MVRP=</varname></term>
<listitem>
- <para>Multiple VLAN Registration Protocol (MVRP) formerly known as GARP VLAN
+ <para>Takes a boolean. Multiple VLAN Registration Protocol (MVRP) formerly known as GARP VLAN
Registration Protocol (GVRP) is a standards-based Layer 2 network protocol,
for automatic configuration of VLAN information on switches. It was defined
- in the 802.1ak amendment to 802.1Q-2005. A boolean. When unset, the kernel's
- default setting applies.</para>
+ in the 802.1ak amendment to 802.1Q-2005. When unset, the kernel's default will be used.
+ </para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>LooseBinding=</varname></term>
<listitem>
- <para>The VLAN loose binding mode, in which only the operational state is passed
+ <para>Takes a boolean. The VLAN loose binding mode, in which only the operational state is passed
from the parent to the associated VLANs, but the VLAN device state is not changed.
- A boolean. When unset, the kernel's default setting applies.</para>
+ When unset, the kernel's default will be used.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>ReorderHeader=</varname></term>
<listitem>
- <para>The VLAN reorder header is set VLAN interfaces behave like physical interfaces.
- A boolean. When unset, the kernel's default setting applies.</para>
+ <para>Takes a boolean. The VLAN reorder header is set VLAN interfaces behave like physical interfaces.
+ When unset, the kernel's default will be used.</para>
</listitem>
</varlistentry>
</variablelist>
<varlistentry>
<term><varname>MacLearning=</varname></term>
<listitem>
- <para>A boolean. When true, enables dynamic MAC learning
+ <para>Takes a boolean. When true, enables dynamic MAC learning
to discover remote MAC addresses.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>ReduceARPProxy=</varname></term>
<listitem>
- <para>A boolean. When true, bridge-connected VXLAN tunnel
+ <para>Takes a boolean. When true, bridge-connected VXLAN tunnel
endpoint answers ARP requests from the local bridge on behalf
of remote Distributed Overlay Virtual Ethernet
<ulink url="https://en.wikipedia.org/wiki/Distributed_Overlay_Virtual_Ethernet">
<varlistentry>
<term><varname>L2MissNotification=</varname></term>
<listitem>
- <para>A boolean. When true, enables netlink LLADDR miss
+ <para>Takes a boolean. When true, enables netlink LLADDR miss
notifications.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>L3MissNotification=</varname></term>
<listitem>
- <para>A boolean. When true, enables netlink IP address miss
+ <para>Takes a boolean. When true, enables netlink IP address miss
notifications.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>RouteShortCircuit=</varname></term>
<listitem>
- <para>A boolean. When true, route short circuiting is turned
+ <para>Takes a boolean. When true, route short circuiting is turned
on.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>UDPChecksum=</varname></term>
<listitem>
- <para>A boolean. When true, transmitting UDP checksums when doing VXLAN/IPv4 is turned on.</para>
+ <para>Takes a boolean. When true, transmitting UDP checksums when doing VXLAN/IPv4 is turned on.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>UDP6ZeroChecksumTx=</varname></term>
<listitem>
- <para>A boolean. When true, sending zero checksums in VXLAN/IPv6 is turned on.</para>
+ <para>Takes a boolean. When true, sending zero checksums in VXLAN/IPv6 is turned on.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>UDP6ZeroChecksumRx=</varname></term>
<listitem>
- <para>A boolean. When true, receiving zero checksums in VXLAN/IPv6 is turned on.</para>
+ <para>Takes a boolean. When true, receiving zero checksums in VXLAN/IPv6 is turned on.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>RemoteChecksumTx=</varname></term>
<listitem>
- <para>A boolean. When true, remote transmit checksum offload of VXLAN is turned on.</para>
+ <para>Takes a boolean. When true, remote transmit checksum offload of VXLAN is turned on.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>RemoteChecksumRx=</varname></term>
<listitem>
- <para>A boolean. When true, remote receive checksum offload in VXLAN is turned on.</para>
+ <para>Takes a boolean. When true, remote receive checksum offload in VXLAN is turned on.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>GroupPolicyExtension=</varname></term>
<listitem>
- <para>A boolean. When true, it enables Group Policy VXLAN extension security label mechanism
+ <para>Takes a boolean. When true, it enables Group Policy VXLAN extension security label mechanism
across network peers based on VXLAN. For details about the Group Policy VXLAN, see the
<ulink url="https://tools.ietf.org/html/draft-smith-vxlan-group-policy">
VXLAN Group Policy </ulink> document. Defaults to false.</para>
<varlistentry>
<term><varname>UDPChecksum=</varname></term>
<listitem>
- <para>A boolean. When true, specifies if UDP checksum is calculated for transmitted packets over IPv4.</para>
+ <para>Takes a boolean. When true, specifies if UDP checksum is calculated for transmitted packets over IPv4.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>UDP6ZeroChecksumTx=</varname></term>
<listitem>
- <para>A boolean. When true, skip UDP checksum calculation for transmitted packets over IPv6.</para>
+ <para>Takes a boolean. When true, skip UDP checksum calculation for transmitted packets over IPv6.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>UDP6ZeroChecksumRx=</varname></term>
<listitem>
- <para>A boolean. When true, allows incoming UDP packets over IPv6 with zero checksum field.</para>
+ <para>Takes a boolean. When true, allows incoming UDP packets over IPv6 with zero checksum field.</para>
</listitem>
</varlistentry>
<varlistentry>
<literal>ip6gre</literal>,
<literal>ip6gretap</literal>,
<literal>vti</literal>,
- <literal>vti6</literal>, and
- <literal>ip6tnl</literal> and accepts
+ <literal>vti6</literal>,
+ <literal>ip6tnl</literal>, and
+ <literal>erspan</literal> and accepts
the following keys:</para>
<variablelist class='network-directives'>
<varlistentry>
<term><varname>DiscoverPathMTU=</varname></term>
<listitem>
- <para>A boolean. When true, enables Path MTU Discovery on
+ <para>Takes a boolean. When true, enables Path MTU Discovery on
the tunnel.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>CopyDSCP=</varname></term>
<listitem>
- <para>A boolean. When true, the Differentiated Service Code
+ <para>Takes a boolean. When true, the Differentiated Service Code
Point (DSCP) field will be copied to the inner header from
outer header during the decapsulation of an IPv6 tunnel
packet. DSCP is a field in an IP packet that enables different
<varlistentry>
<term><varname>Independent=</varname></term>
<listitem>
- <para>A boolean. When true tunnel does not require .network file. Created as "tunnel@NONE".
+ <para>Takes a boolean. When true tunnel does not require .network file. Created as "tunnel@NONE".
Defaults to <literal>false</literal>.
</para>
</listitem>
<varlistentry>
<term><varname>AllowLocalRemote=</varname></term>
<listitem>
- <para>A boolean. When true allows tunnel traffic on <varname>ip6tnl</varname> devices where the remote endpoint is a local host address.
- Defaults to unset.
+ <para>Takes a boolean. When true allows tunnel traffic on <varname>ip6tnl</varname> devices where the remote endpoint is a local host address.
+ When unset, the kernel's default will be used.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><varname>FooOverUDP=</varname></term>
+ <listitem>
+ <para>Takes a boolean. Specifies whether <varname>FooOverUDP=</varname> tunnel is to be configured.
+ Defaults to false. For more detail information see
+ <ulink url="https://lwn.net/Articles/614348">Foo over UDP</ulink></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><varname>FOUDestinationPort=</varname></term>
+ <listitem>
+ <para>This setting specifies the UDP destination port for encapsulation.
+ This field is mandatory and is not set by default.</para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><varname>FOUSourcePort=</varname></term>
+ <listitem>
+ <para>This setting specifies the UDP source port for encapsulation. Defaults to <constant>0</constant>
+ — that is, the source port for packets is left to the network stack to decide.</para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><varname>Encapsulation=</varname></term>
+ <listitem>
+ <para>Accepts the same key as <literal>[FooOverUDP]</literal></para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><varname>IPv6RapidDeploymentPrefix=</varname></term>
+ <listitem>
+ <para>Reconfigure the tunnel for <ulink url="https://tools.ietf.org/html/rfc5569">IPv6 Rapid
+ Deployment</ulink>, also known as 6rd. The value is an ISP-specific IPv6 prefix with a non-zero length. Only
+ applicable to SIT tunnels.</para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><varname>ISATAP=</varname></term>
+ <listitem>
+ <para>Takes a boolean. If set, configures the tunnel as Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) tunnel.
+ Only applicable to SIT tunnels. When unset, the kernel's default will be used.</para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><varname>SerializeTunneledPackets=</varname></term>
+ <listitem>
+ <para>Takes a boolean. If set to yes, then packets are serialized. Only applies for ERSPAN tunnel.
+ When unset, the kernel's default will be used.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><varname>ERSPANIndex=</varname></term>
+ <listitem>
+ <para>Specifies the ERSPAN index field for the interface, an integer in the range 1-1048575 associated with
+ the ERSPAN traffic's source port and direction. This field is mandatory.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
+
+ <refsect1>
+ <title>[FooOverUDP] Section Options</title>
+
+ <para>The <literal>[FooOverUDP]</literal> section only applies for
+ netdevs of kind <literal>fou</literal> and accepts the
+ following keys:</para>
+
+ <variablelist class='network-directives'>
+ <varlistentry>
+ <term><varname>Protocol=</varname></term>
+ <listitem>
+ <para>The <varname>Protocol=</varname> specifies the protocol number of the
+ packets arriving at the UDP port. This field is mandatory and is not set by default. Valid range is 1-255.</para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><varname>Encapsulation=</varname></term>
+ <listitem>
+ <para>Specifies the encapsulation mechanism used to store networking packets of various protocols inside the UDP packets. Supports the following values:
+
+ <literal>FooOverUDP</literal> provides the simplest no frills model of UDP encapsulation, it simply encapsulates
+ packets directly in the UDP payload.
+ <literal>GenericUDPEncapsulation</literal> is a generic and extensible encapsulation, it allows encapsulation of packets for any IP
+ protocol and optional data as part of the encapsulation.
+ For more detailed information see <ulink url="https://lwn.net/Articles/615044">Generic UDP Encapsulation</ulink>.
+ Defaults to <literal>FooOverUDP</literal>.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><varname>Port=</varname></term>
+ <listitem>
+ <para>Specifies the port number, where the IP encapsulation packets will arrive. Please take note that the packets
+ will arrive with the encapsulation will be removed. Then they will be manually fed back into the network stack, and sent ahead
+ for delivery to the real destination. This option is mandatory.</para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ </refsect1>
<refsect1>
<title>[Peer] Section Options</title>
<variablelist class='network-directives'>
<varlistentry>
<term><varname>OneQueue=</varname></term>
- <listitem><para>Takes a boolean argument. Configures whether
+ <listitem><para>Takes a boolean. Configures whether
all packets are queued at the device (enabled), or a fixed
number of packets are queued at the device and the rest at the
<literal>qdisc</literal>. Defaults to
</varlistentry>
<varlistentry>
<term><varname>MultiQueue=</varname></term>
- <listitem><para>Takes a boolean argument. Configures whether
+ <listitem><para>Takes a boolean. Configures whether
to use multiple file descriptors (queues) to parallelize
packets sending and receiving. Defaults to
<literal>no</literal>.</para>
</varlistentry>
<varlistentry>
<term><varname>PacketInfo=</varname></term>
- <listitem><para>Takes a boolean argument. Configures whether
+ <listitem><para>Takes a boolean. Configures whether
packets should be prepended with four extra bytes (two flag
bytes and two protocol bytes). If disabled, it indicates that
the packets will be pure IP packets. Defaults to
</varlistentry>
<varlistentry>
<term><varname>VNetHeader=</varname></term>
- <listitem><para>Takes a boolean argument. Configures
+ <listitem><para>Takes a boolean. Configures
IFF_VNET_HDR flag for a tap device. It allows sending
and receiving larger Generic Segmentation Offload (GSO)
packets. This may increase throughput significantly.
(see <citerefentry project="wireguard"><refentrytitle>wg</refentrytitle><manvolnum>8</manvolnum></citerefentry>).
This option is mandatory to use WireGuard.
Note that because this information is secret, you may want to set
- the permissions of the .netdev file to be owned by <literal>root:systemd-networkd</literal>
+ the permissions of the .netdev file to be owned by <literal>root:systemd-network</literal>
with a <literal>0640</literal> file mode.</para>
</listitem>
</varlistentry>
</listitem>
</varlistentry>
+ <varlistentry>
+ <term><varname>AdActorSystemPriority=</varname></term>
+ <listitem>
+ <para>Specifies the 802.3ad actor system priority. Ranges [1-65535].</para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><varname>AdUserPortKey=</varname></term>
+ <listitem>
+ <para>Specifies the 802.3ad user defined portion of the port key. Ranges [0-1023].</para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><varname>AdActorSystem=</varname></term>
+ <listitem>
+ <para>Specifies the 802.3ad system mac address. This can not be either NULL or Multicast.</para>
+ </listitem>
+ </varlistentry>
+
<varlistentry>
<term><varname>FailOverMACPolicy=</varname></term>
<listitem>
<varlistentry>
<term><varname>AllSlavesActive=</varname></term>
<listitem>
- <para>A boolean. Specifies that duplicate frames (received on inactive ports)
+ <para>Takes a boolean. Specifies that duplicate frames (received on inactive ports)
should be dropped when false, or delivered when true. Normally, bonding will drop
duplicate frames (received on inactive ports), which is desirable for
most users. But there are some times it is nice to allow duplicate
</listitem>
</varlistentry>
+ <varlistentry>
+ <term><varname>DynamicTransmitLoadBalancing=</varname></term>
+ <listitem>
+ <para>Takes a boolean. Specifies if dynamic shuffling of flows is enabled. Applies only
+ for balance-tlb mode. Defaults to unset.
+ </para>
+ </listitem>
+ </varlistentry>
+
<varlistentry>
<term><varname>MinLinks=</varname></term>
<listitem>
</refsect1>
<refsect1>
- <title>Example</title>
+ <title>Examples</title>
<example>
<title>/etc/systemd/network/25-bridge.netdev</title>
Remote=192.169.224.239
TTL=64</programlisting>
</example>
+ <example>
+ <title>/etc/systemd/network/1-fou-tunnel.netdev</title>
+ <programlisting>[NetDev]
+Name=fou-tun
+Kind=fou
+
+[FooOverUDP]
+Port=5555
+Protocol=4
+ </programlisting>
+ </example>
+ <example>
+ <title>/etc/systemd/network/25-fou-ipip.netdev</title>
+ <programlisting>[NetDev]
+Name=ipip-tun
+Kind=ipip
+
+[Tunnel]
+Independent=yes
+Local=10.65.208.212
+Remote=10.65.208.211
+FooOverUDP=yes
+FOUDestinationPort=5555
+ </programlisting>
+ </example>
<example>
<title>/etc/systemd/network/25-tap.netdev</title>
<programlisting>[NetDev]
Kind=tap
[Tap]
-MultiQueue=true
-PacketInfo=true</programlisting> </example>
+MultiQueue=yes
+PacketInfo=yes</programlisting> </example>
<example>
<title>/etc/systemd/network/25-sit.netdev</title>
Remote=10.65.223.239</programlisting>
</example>
+ <example>
+ <title>/etc/systemd/network/25-6rd.netdev</title>
+ <programlisting>[NetDev]
+Name=6rd-tun
+Kind=sit
+MTUBytes=1480
+
+[Tunnel]
+Local=10.65.223.238
+IPv6RapidDeploymentPrefix=2602::/24</programlisting>
+ </example>
+
<example>
<title>/etc/systemd/network/25-gre.netdev</title>
<programlisting>[NetDev]
projects / thirdparty / systemd.git / blobdiff