sysctl - get or set system information
Standard C Library (libc, -lc)
#include <sys/param.h>
#include <sys/sysctl.h>
int
sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
size_t newlen);
The sysctl function retrieves system information and allows processes
with appropriate privileges to set system information. The information
available from sysctl consists of integers, strings, and tables. Information
may be retrieved and set from the command interface using the
sysctl(8) utility.
Unless explicitly noted below, sysctl returns a consistent snapshot of
the data requested. Consistency is obtained by locking the destination
buffer into memory so that the data may be copied out without blocking.
Calls to sysctl are serialized to avoid deadlock.
The state is described using a ``Management Information Base'' (MIB)
style name, listed in name, which is a namelen length array of integers.
The information is copied into the buffer specified by oldp. The size of
the buffer is given by the location specified by oldlenp before the call,
and that location gives the amount of data copied after a successful
call. If the amount of data available is greater than the size of the
buffer supplied, the call supplies as much data as fits in the buffer
provided and returns with the error code ENOMEM. If the old value is not
desired, oldp and oldlenp should be set to NULL.
The size of the available data can be determined by calling sysctl with a
NULL parameter for oldp. The size of the available data will be returned
in the location pointed to by oldlenp. For some operations, the amount
of space may change often. For these operations, the system attempts to
round up so that the returned size is large enough for a call to return
the data shortly thereafter.
To set a new value, newp is set to point to a buffer of length newlen
from which the requested value is to be taken. If a new value is not to
be set, newp should be set to NULL and newlen set to 0.
The top level names are defined with a CTL_ prefix in ~ <sys/sysctl.h>,
and are as follows. The next and subsequent levels down are found in the
include files listed here, and described in separate sections below.
Name Next level names Description
CTL_KERN sys/sysctl.h High kernel limits
CTL_VM uvm/uvm_param.h Virtual memory
CTL_VFS sys/mount.h Filesystem
CTL_NET sys/socket.h Networking
CTL_DEBUG sys/sysctl.h Debugging
CTL_HW sys/sysctl.h Generic CPU, I/O
CTL_MACHDEP sys/sysctl.h Machine dependent
CTL_USER sys/sysctl.h User-level
CTL_DDB sys/sysctl.h In-kernel debugger
CTL_PROC sys/sysctl.h Per-process
CTL_VENDOR ? Vendor specific
For example, the following retrieves the maximum number of processes
allowed in the system:
int mib[2], maxproc;
size_t len;
mib[0] = CTL_KERN;
mib[1] = KERN_MAXPROC;
len = sizeof(maxproc);
sysctl(mib, 2, maxproc, len, NULL, 0);
To retrieve the standard search path for the system utilities:
int mib[2];
size_t len;
char *p;
mib[0] = CTL_USER;
mib[1] = USER_CS_PATH;
sysctl(mib, 2, NULL, len, NULL, 0);
p = malloc(len);
sysctl(mib, 2, p, len, NULL, 0);
The debugging variables vary from system to system. A debugging variable
may be added or deleted without need to recompile sysctl to know about
it. Each time it runs, sysctl gets the list of debugging variables from
the kernel and displays their current values. The system defines twenty
(struct ctldebug) variables named debug0 through debug19. They are
declared as separate variables so that they can be individually initialized
at the location of their associated variable. The loader prevents
multiple use of the same variable by issuing errors if a variable is initialized
in more than one place. For example, to export the variable
dospecialcheck as a debugging variable, the following declaration would
be used:
int dospecialcheck = 1;
struct ctldebug debug5 = { "dospecialcheck", dospecialcheck };
A distinguished second level name, VFS_GENERIC, is used to get general
information about all filesystems. One of its third level identifiers is
VFS_MAXTYPENUM that gives the highest valid filesystem type number. Its
other third level identifier is VFS_CONF that returns configuration
information about the filesystem type given as a fourth level identifier.
The remaining second level identifiers are the filesystem type number
returned by a statfs(2) call or from VFS_CONF. The third level identifiers
available for each filesystem are given in the header file that
defines the mount argument structure for that filesystem.
The string and integer information available for the CTL_HW level is
detailed below. The changeable column shows whether a process with
appropriate privilege may change the value.
Second level name Type Changeable
HW_MACHINE string no
HW_MODEL string no
HW_NCPU integer no
HW_BYTEORDER integer no
HW_PHYSMEM integer no
HW_USERMEM integer no
HW_PAGESIZE integer no
HW_MACHINE_ARCH string no
HW_ALIGNBYTES integer no
HW_DISKNAMES string no
HW_DISKSTATS struct disk_sysctl no
HW_MACHINE
The machine class.
HW_MODEL
The machine model
HW_NCPU
The number of cpus.
HW_BYTEORDER
The byteorder (4,321, or 1,234).
HW_PHYSMEM
The bytes of physical memory.
HW_USERMEM
The bytes of non-kernel memory.
HW_PAGESIZE
The software page size.
HW_DISKNAMES
The list of (space separated) disk device names on the system.
HW_DISKSTATS
Return statistical information on the disk devices on the system.
An array of struct disk_sysctl structures is returned, whose size
depends on the current number of such objects in the system. The
third level name is the size of the struct disk_sysctl.
HW_MACHINE_ARCH
The machine cpu class.
HW_ALIGNBYTES
Alignment constraint for all possible data types. This shows the
value ALIGNBYTES in /usr/include/machine/param.h, at the kernel
compilation time.
The string and integer information available for the CTL_KERN level is
detailed below. The changeable column shows whether a process with
appropriate privilege may change the value. The types of data currently
available are process information, system vnodes, the open file entries,
routing table entries, virtual memory statistics, load average history,
and clock rate information.
Second level name Type Changeable
KERN_ARGMAX integer no
KERN_AUTONICETIME integer yes
KERN_AUTONICEVAL integer yes
KERN_BOOTTIME struct timeval no
KERN_CCPU integer no
KERN_CLOCKRATE struct clockinfo no
KERN_CP_TIME long[] no
KERN_DEFCORENAME string yes
KERN_DOMAINNAME string yes
KERN_FILE struct file no
KERN_FSCALE integer no
KERN_FSYNC integer no
KERN_HOSTID integer yes
KERN_HOSTNAME string yes
KERN_IOV_MAX integer no
KERN_JOB_CONTROL integer no
KERN_LOGIN_NAME_MAX integer no
KERN_LOGSIGEXIT integer yes
KERN_MAPPED_FILES integer no
KERN_MAXFILES integer yes
KERN_MAXPARTITIONS integer no
KERN_MAXPROC integer yes
KERN_MAXPTYS integer yes
KERN_MAXVNODES integer yes
KERN_MBUF node not applicable
KERN_MEMLOCK integer no
KERN_MEMLOCK_RANGE integer no
KERN_MEMORY_PROTECTION integer no
KERN_MONOTONIC_CLOCK integer no
KERN_MSGBUF char[] no
KERN_MSGBUFSIZE integer no
KERN_NGROUPS integer no
KERN_NTPTIME struct ntptimeval no
KERN_OSRELEASE string no
KERN_OSREV integer no
KERN_OSTYPE string no
KERN_POSIX1 integer no
KERN_PROC struct kinfo_proc no
KERN_PROC2 struct kinfo_proc2 no
KERN_PROC_ARGS string no
KERN_PROF node not applicable
KERN_RAWPARTITION integer no
KERN_ROOT_DEVICE string no
KERN_RTC_OFFSET integer no
KERN_SAVED_IDS integer no
KERN_SECURELVL integer raise only
KERN_SYNCHRONIZED_IO integer no
KERN_SYSVIPC_INFO node not applicable
KERN_SYSVMSG integer no
KERN_SYSVSEM integer no
KERN_SYSVSHM integer no
KERN_TKSTAT node not applicable
KERN_VERSION string no
KERN_VNODE struct vnode no
KERN_ARGMAX
The maximum bytes of argument to execve(2).
KERN_AUTONICETIME
The number of seconds of cpu-time a non-root process may accumulate
before having its priority lowered from the default to the
value of KERN_AUTONICEVAL. If set to 0, automatic lowering of
priority is not performed, and if set to -1 all non-root processes
are immediately lowered.
KERN_AUTONICEVAL
The priority assigned for automatically niced processes.
KERN_BOOTTIME
A struct timeval structure is returned. This structure contains
the time that the system was booted.
KERN_CCPU
The scheduler exponential decay value.
KERN_CLOCKRATE
A struct clockinfo structure is returned. This structure contains
the clock, statistics clock and profiling clock frequencies,
the number of micro-seconds per hz tick, and the clock skew
rate.
KERN_CP_TIME
Return an array if CPUSTATES longs is returned. This array contains
the number of clock ticks spent in different CPU states.
KERN_DEFCORENAME
Default template for the name of core dump files (see also
PROC_PID_CORENAME in the per-process variables CTL_PROC, and
core(5) for format of this template). The default value is
%n.core and can be changed with the kernel configuration option
options DEFCORENAME (see options(4) ).
KERN_DOMAINNAME
Get or set the YP domain name.
KERN_FILE
Return the entire file table. The returned data consists of a
single struct filehead followed by an array of struct file, whose
size depends on the current number of such objects in the system.
KERN_FSCALE
The kernel fixed-point scale factor.
KERN_FSYNC
Return 1 if the POSIX 1003.1b File Synchronization Option is
available on this system, otherwise 0.
KERN_HOSTID
Get or set the host id.
KERN_HOSTNAME
Get or set the hostname.
KERN_IOV_MAX
Return the maximum number of iovec structures that a process has
available for use with preadv(2), pwritev(2), readv(2),
recvmsg(2), sendmsg(2) and writev(2).
KERN_JOB_CONTROL
Return 1 if job control is available on this system, otherwise 0.
KERN_LOGIN_NAME_MAX
The size of the storage required for a login name, in bytes,
including the terminating NUL.
KERN_LOGSIGEXIT
If this flag is non-zero, the kernel will log(9) all process
exits due to signals which create a core(5) file, and whether the
coredump was created.
KERN_MAPPED_FILES
Returns 1 if the POSIX 1003.1b Memory Mapped Files Option is
available on this system, otherwise 0.
KERN_MAXFILES
The maximum number of open files that may be open in the system.
KERN_MAXPARTITIONS
The maximum number of partitions allowed per disk.
KERN_MAXPROC
The maximum number of simultaneous processes the system will
allow.
KERN_MAXPTYS
The maximum number of pseudo terminals. This value can be both
raised and lowered, though it cannot be set lower than number of
currently used ptys. See also pty(4).
KERN_MAXVNODES
The maximum number of vnodes available on the system. This can
only be raised.
KERN_MBUF
Return information about the mbuf control variables. the third
level names for the mbuf variables are detailed below. The
changeable column shows whether a process with appropriate privilege
may change the value.
Third level name Type Changeable
MBUF_MSIZE integer yes
MBUF_MCLBYTES integer yes
MBUF_NMBCLUSTERS integer yes
MBUF_MBLOWAT integer yes
MBUF_MCLLOWAT integer yes
The variables are as follows:
MBUF_MSIZE
The mbuf base size.
MBUF_MCLBYTES
The mbuf cluster size.
MBUF_NMBCLUSTERS
The limit on the number of mbuf clusters. The variable
can only be increased, and only increased on machines
with direct-mapped pool pages
MBUF_MBLOWAT
The mbuf low water mark.
MBUF_MCLLOWAT
The mbuf cluster low water mark.
KERN_MEMLOCK
Returns 1 if the POSIX 1003.1b Process Memory Locking Option is
available on this system, otherwise 0.
KERN_MEMLOCK_RANGE
Returns 1 if the POSIX 1003.1b Range Memory Locking Option is
available on this system, otherwise 0.
KERN_MEMORY_PROTECTION
Returns 1 if the POSIX 1003.1b Memory Protection Option is available
on this system, otherwise 0.
KERN_MONOTONIC_CLOCK
Returns the standard version the implementation of the POSIX
1003.1b Monotonic Clock Option conforms to, otherwise 0.
KERN_MSGBUF
The kernel message buffer, rotated so that the head of the circular
kernel message buffer is returned at the start of the buffer
specified by oldp. The returned data may contain NUL bytes.
KERN_MSGBUFSIZE
The maximum number of characters that the kernel message buffer
can hold.
KERN_NGROUPS
The maximum number of supplemental groups.
KERN_NO_TRUNC
Return 1 if file names longer than KERN_NAME_MAX are truncated.
KERN_NTPTIME
A struct ntptimeval structure is returned. This structure contains
data used by the ntpd(8) program.
KERN_OSRELEASE
The system release string.
KERN_OSREV
The system revision string.
KERN_OSTYPE
The system type string.
KERN_PATH_MAX
The maximum number of bytes in a pathname.
KERN_POSIX1
The version of ISO/IEC 9945 (POSIX 1003.1) with which the system
attempts to comply.
KERN_PROC
Return the entire process table, or a subset of it. An array of
struct kinfo_proc structures is returned, whose size depends on
the current number of such objects in the system. The third and
fourth level names are as follows:
Third level name Fourth level is:
KERN_PROC_ALL None
KERN_PROC_PID A process ID
KERN_PROC_PGRP A process group
KERN_PROC_SESSION A session ID
KERN_PROC_TTY A tty device
KERN_PROC_UID A user ID
KERN_PROC_RUID A real user ID
KERN_PROC_GID A group ID
KERN_PROC_RGID A real group ID
KERN_PROC2
As for KERN_PROC, but an array of struct kinfo_proc2 structures
are returned. The fifth level name is the size of the struct
kinfo_proc2 and the sixth level name is the number of structures
to return.
KERN_PROC_ARGS
Return the argv or environment strings (or the number thereof) of
a process. Multiple strings are returned separated by NUL characters.
The third level name is the process ID. The fourth
level name is as follows:
KERN_PROC_ARGV The argv strings
KERN_PROC_NARGV The number of argv strings
KERN_PROC_ENV The environ strings
KERN_PROC_NENV The number of environ strings
KERN_PROF
Return profiling information about the kernel. If the kernel is
not compiled for profiling, attempts to retrieve any of the
KERN_PROF values will fail with EOPNOTSUPP. The third level
names for the string and integer profiling information is
detailed below. The changeable column shows whether a process
with appropriate privilege may change the value.
Third level name Type Changeable
GPROF_STATE integer yes
GPROF_COUNT u_short[] yes
GPROF_FROMS u_short[] yes
GPROF_TOS struct tostruct yes
GPROF_GMONPARAM struct gmonparam no
The variables are as follows:
GPROF_STATE
Returns GMON_PROF_ON or GMON_PROF_OFF to show that profiling
is running or stopped.
GPROF_COUNT
Array of statistical program counter counts.
GPROF_FROMS
Array indexed by program counter of call-from points.
GPROF_TOS
Array of struct tostruct describing destination of calls
and their counts.
GPROF_GMONPARAM
Structure giving the sizes of the above arrays.
KERN_RAWPARTITION
The raw partition of a disk (a == 0).
KERN_ROOT_DEVICE
The name of the root device.
KERN_RTC_OFFSET
Return the offset of real time clock from UTC in minutes.
KERN_SAVED_IDS
Returns 1 if saved set-group and saved set-user ID is available.
KERN_SECURELVL
The system security level. This level may be raised by processes
with appropriate privilege. It may only be lowered by process 1.
KERN_SYNCHRONIZED_IO
Returns 1 if the POSIX 1003.1b Synchronized I/O Option is available
on this system, otherwise 0.
KERN_SYSVIPC_INFO
Return System V style IPC configuration and run-time information.
The third level name selects the System V style IPC facility.
Third level name Type
KERN_SYSVIPC_MSG_INFO struct msg_sysctl_info
KERN_SYSVIPC_SEM_INFO struct sem_sysctl_info
KERN_SYSVIPC_SHM_INFO struct shm_sysctl_info
KERN_SYSVIPC_MSG_INFO
Return information on the System V style message facility.
The msg_sysctl_info structure is defined in
<sys/msg.h>.
KERN_SYSVIPC_SEM_INFO
Return information on the System V style semaphore facility.
The sem_sysctl_info structure is defined in
<sys/sem.h>.
KERN_SYSVIPC_SHM_INFO
Return information on the System V style shared memory
facility. The shm_sysctl_info structure is defined in
<sys/shm.h>.
KERN_SYSVMSG
Returns 1 if System V style message queue functionality is available
on this system, otherwise 0.
KERN_SYSVSEM
Returns 1 if System V style semaphore functionality is available
on this system, otherwise 0.
KERN_SYSVSHM
Returns 1 if System V style share memory functionality is available
on this system, otherwise 0.
KERN_TKSTAT
Return information about the number of characters sent and
received on ttys. The third level names for the tty statistic
variables are detailed below. The changeable column shows
whether a process with appropriate privilege may change the
value.
Third level name Type Changeable
KERN_TKSTAT_NIN quad no
KERN_TKSTAT_NOUT quad no
KERN_TKSTAT_CANCC quad no
KERN_TKSTAT_RAWCC quad no
The variables are as follows:
KERN_TKSTAT_NIN
The total number of input characters.
KERN_TKSTAT_NOUT
The total number of output characters.
KERN_TKSTAT_CANCC
The number of canonical input characters.
KERN_TKSTAT_RAWCC
The number of raw input characters.
KERN_VERSION
The system version string.
KERN_VNODE
Return the entire vnode table. Note, the vnode table is not necessarily
a consistent snapshot of the system. The returned data
consists of an array whose size depends on the current number of
such objects in the system. Each element of the array contains
the kernel address of a vnode struct vnode * followed by the
vnode itself struct vnode.
The set of variables defined is architecture dependent. Most architectures
define at least the following variables.
Second level name Type Changeable
CPU_CONSDEV dev_t no
The string and integer information available for the CTL_NET level is
detailed below. The changeable column shows whether a process with
appropriate privilege may change the value.
Second level name Type Changeable
PF_ROUTE routing messages no
PF_INET IPv4 values yes
PF_INET6 IPv6 values yes
PF_KEY IPsec key management valuesyes
PF_ROUTE
Return the entire routing table or a subset of it. The data is
returned as a sequence of routing messages (see route(4) for the
header file, format and meaning). The length of each message is
contained in the message header.
The third level name is a protocol number, which is currently
always 0. The fourth level name is an address family, which may
be set to 0 to select all address families. The fifth and sixth
level names are as follows:
Fifth level name Sixth level is:
NET_RT_FLAGS rtflags
NET_RT_DUMP None
NET_RT_IFLIST None
PF_INET
Get or set various global information about the IPv4 (Internet
Protocol version 4). The third level name is the protocol. The
fourth level name is the variable name. The currently defined
protocols and names are:
Protocol name Variable name Type Changeable
ip forwarding integer yes
ip redirect integer yes
ip ttl integer yes
ip forwsrcrt integer yes
ip directed-broadcast integer yes
ip allowsrcrt integer yes
ip subnetsarelocal integer yes
ip mtudisc integer yes
ip anonportmin integer yes
ip anonportmax integer yes
ip mtudisctimeout integer yes
ip gifttl integer yes
ip grettl integer yes
ip lowportmin integer yes
ip lowportmax integer yes
ip maxfragpacket integer yes
icmp maskrepl integer yes
icmp errppslimit integer yes
icmp rediraccept integer yes
icmp redirtimeout integer yes
tcp rfc1323 integer yes
tcp sendspace integer yes
tcp recvspace integer yes
tcp mssdflt integer yes
tcp syn_cache_limit integer yes
tcp syn_bucket_limit integer yes
tcp syn_cache_interval integer yes
tcp init_win integer yes
tcp mss_ifmtu integer yes
tcp sack integer yes
tcp win_scale integer yes
tcp timestamps integer yes
tcp compat_42 integer yes
tcp cwm integer yes
tcp cwm_burstsize integer yes
tcp ack_on_push integer yes
tcp keepidle integer yes
tcp keepintvl integer yes
tcp keepcnt integer yes
tcp slowhz integer no
tcp newreno integer yes
tcp log_refused integer yes
tcp rstppslimit integer yes
udp checksum integer yes
udp sendspace integer yes
udp recvspace integer yes
The variables are as follows:
ip.forwarding
Returns 1 when IP forwarding is enabled for the host,
meaning that the host is acting as a router.
ip.redirect
Returns 1 when ICMP redirects may be sent by the host.
This option is ignored unless the host is routing IP
packets, and should normally be enabled on all systems.
ip.ttl The maximum time-to-live (hop count) value for an IP
packet sourced by the system. This value applies to normal
transport protocols, not to ICMP.
ip.forwsrcrt
Returns 1 when forwarding of source-routed packets is
enabled for the host. This value may only be changed if
the kernel security level is less than 1.
ip.directed-broadcast
Returns 1 if directed broadcast behavior is enabled for
the host.
ip.allowsrcrt
Returns 1 if the host accepts source routed packets.
ip.subnetsarelocal
Returns 1 if subnets are to be considered local
addresses.
ip.mtudisc
Returns 1 if Path MTU Discovery is enabled.
ip.anonportmin
The lowest port number to use for TCP and UDP ephemeral
port allocation. This cannot be set to less than 1024 or
greater than 65535.
ip.anonportmax
The highest port number to use for TCP and UDP ephemeral
port allocation. This cannot be set to less than 1024 or
greater than 65535, and must be greater than
ip.anonportmin.
ip.mtudisctimeout
Returns the number of seconds in which a route added by
the Path MTU Discovery engine will time out. When the
route times out, the Path MTU Discovery engine will
attempt to probe a larger path MTU.
ip.gifttl
The maximum time-to-live (hop count) value for an IPv4
packet generated by gif(4) tunnel interface.
ip.grettl
The maximum time-to-live (hop count) value for an IPv4
packet generated by gre(4) tunnel interface.
ip.lowportmin
The lowest port number to use for TCP and UDP reserved
port allocation. This cannot be set to less than 0 or
greater than 1024, and must be smaller than
ip.lowportmax.
ip.lowportmax
The highest port number to use for TCP and UDP reserved
port allocation. This cannot be set to less than 0 or
greater than 1024, and must be greater than
ip.lowportmin.
ip.maxfragpackets
The maximum number of fragmented packets the node will
accept. 0 means that the node will not accept any fragmented
packets. -1 means that the node will accept as
many fragmented packets as it receives. The flag is provided
basically for avoiding possible DoS attacks.
icmp.maskrepl
Returns 1 if ICMP network mask requests are to be
answered.
icmp.errppslimit
The variable specifies the maximum number of outgoing
ICMP error messages, per second. ICMP error messages
that exceeded the value are subject to rate limitation
and will not go out from the node. Negative value disables
rate limitation.
icmp.rediraccept
If set to non-zero, the host will accept ICMP redirect
packets. Note that routers will never accept ICMP redirect
packets, and the variable is meaningful on IP hosts
only.
icmp.redirtimeout
The variable specifies lifetime of routing entries generated
by incoming ICMP redirect. This defaults to 600
seconds.
tcp.rfc1323
Returns 1 if RFC1323 extensions to TCP are enabled.
tcp.sendspace
Returns the default TCP send buffer size.
tcp.recvspace
Returns the default TCP receive buffer size.
tcp.mssdflt
Returns the default maximum segment size both advertsized
to the peer and to use when the peer does not advertize a
maximum segment size to us during connection setup. Do
not change this value unless you really know what you are
doing.
tcp.syn_cache_limit
Returns the maximum number of entries allowed in the TCP
compressed state engine.
tcp.syn_bucket_limit
Returns the maximum number of entries allowed per hash
bucket in the TCP compressed state engine.
tcp.syn_cache_interval
Returns the TCP compressed state engine's timer interval.
tcp.init_win
Returns a value indicating the TCP initial congestion
window. If this value is 0, an auto-tuning algorithm
designed to use an initial window of approximately 4K
bytes is in use. Otherwise, this value indicates a fixed
number of packets.
tcp.mss_ifmtu
Returns 1 if TCP calculates the outgoing maximum segment
size based on the MTU of the appropriate interface. Otherwise,
it is calculated based on the greater of the MTU
of the interface, and the largest (non-loopback) interface
MTU on the system.
tcp.sack
TCP Selective ACKnowledgement (RFC 2018) is not implemented
in NetBSD at this time. Changing this value will
have no effect.
tcp.win_scale
If rfc1323 is enabled, a value of 1 indicates RFC1323
window scale options, for increasing the TCP window size,
are enabled.
tcp.timestamps
If rfc1323 is enabled, a value of 1 indicates RFC1323
time stamp options, used for measuring TCP round trip
times, are enabled.
tcp.compat_42
Returns 1 if work-arounds for bugs in the 4.2BSD TCP
implementation are enabled. Use of this option is not
recommended, although it may be required in order to communicate
with extremely old TCP implementations.
tcp.cwm
Returns 1 if use of the Hughes/Touch/Heidemann Congestion
Window Monitoring algorithm is enabled. This algorithm
prevents line-rate bursts of packets that could otherwise
occur when data begins flowing on an idle TCP connection.
These line-rate bursts can contribute to network and
router congestion. This can be particularly useful on
World Wide Web servers which support HTTP/1.1, which has
lingering connections.
tcp.cwm_burstsize
Returns the Congestion Window Monitoring allowed burst
size, in terms of packet count.
tcp.ack_on_push
Returns 1 if TCP is to immediately transmit an ACK upon
reception of a packet with PUSH set. This can avoid losing
a round trip time in some rare situations, but has
the caveat of potentially defeating TCP's delayed ACK
algorithm. Use of this option is generally not recommended,
but the variable exists in case your configuration
really needs it.
tcp.keepidle
Time a connection must be idle before keepalives are sent
(if keepalives are enabled for the connection). See also
tcp.slowhz.
tcp.keepintvl
Time after a keepalive probe is sent until, in the
absence of any response, another probe is sent. See also
tcp.slowhz.
tcp.keepcnt
Number of keepalive probes sent before declaring a connection
dead. If set to zero, there is no limit;
keepalives will be sent until some kind of response is
received from the peer.
tcp.slowhz
The units for tcp.keepidle and tcp.keepintvl; those variables
are in ticks of a clock that ticks tcp.slowhz times
per second. (That is, their values must be divided by
the tcp.slowhz value to get times in seconds.)
tcp.newreno
Returns 1 if the use of J. Hoe's NewReno congestion control
algorithm is enabled. This algorithm improves the
start-up behavior of TCP connections.
tcp.log_refused
Returns 1 if refused TCP connections to the host will be
logged.
tcp.rstppslimit
The variable specifies the maximum number of outgoing TCP
RST packets, per second. TCP RST packet that exceeded
the value are subject to rate limitation and will not go
out from the node. Negative value disables rate limitation.
udp.checksum
Returns 1 when UDP checksums are being computed and
checked. Disabling UDP checksums is strongly discouraged.
udp.sendspace
Returns the default UDP send buffer size.
udp.recvspace
Returns the default UDP receive buffer size.
For variables net.*.ipsec, please refer to ipsec(4).
PF_INET6
Get or set various global information about the IPv6 (Internet
Protocol version 6). The third level name is the protocol. The
fourth level name is the variable name. The currently defined
protocols and names are:
Protocol name Variable name Type Changeable
ip6 forwarding integer yes
ip6 redirect integer yes
ip6 hlim integer yes
ip6 maxfragpackets integer yes
ip6 accept_rtadv integer yes
ip6 keepfaith integer yes
ip6 log_interval integer yes
ip6 hdrnestlimit integer yes
ip6 dad_count integer yes
ip6 auto_flowlabel integer yes
ip6 defmcasthlim integer yes
ip6 gif_hlim integer yes
ip6 kame_version string no
ip6 use_deprecated integer yes
ip6 rr_prune integer yes
ip6 v6only integer yes
ip6 anonportmin integer yes
ip6 anonportmax integer yes
ip6 lowportmin integer yes
ip6 lowportmax integer yes
icmp6 rediraccept integer yes
icmp6 redirtimeout integer yes
icmp6 nd6_prune integer yes
icmp6 nd6_delay integer yes
icmp6 nd6_umaxtries integer yes
icmp6 nd6_mmaxtries integer yes
icmp6 nd6_useloopback integer yes
icmp6 nodeinfo integer yes
icmp6 errppslimit integer yes
icmp6 nd6_maxnudhint integer yes
icmp6 mtudisc_hiwat integer yes
icmp6 mtudisc_lowat integer yes
icmp6 nd6_debug integer yes
udp6 sendspace integer yes
udp6 recvspace integer yes
The variables are as follows:
ip6.forwarding
Returns 1 when IPv6 forwarding is enabled for the node,
meaning that the node is acting as a router. Returns 0
when IPv6 forwarding is disabled for the node, meaning
that the node is acting as a host. IPv6 specification
defines node behavior for ``router'' case and ``host''
case quite differently, and changing this variable during
operation may cause serious trouble. It is recommended
to configure the variable at bootstrap time, and bootstrap
time only.
ip6.redirect
Returns 1 when ICMPv6 redirects may be sent by the node.
This option is ignored unless the node is routing IP
packets, and should normally be enabled on all systems.
ip6.hlim
The default hop limit value for an IPv6 unicast packet
sourced by the node. This value applies to all the
transport protocols on top of IPv6. There are APIs to
override the value, as documented in ip6(4).
ip6.maxfragpackets
The maximum number of fragmented packets the node will
accept. 0 means that the node will not accept any fragmented
packets. -1 means that the node will accept as
many fragmented packets as it receives. The flag is provided
basically for avoiding possible DoS attacks.
ip6.accept_rtadv
If set to non-zero, the node will accept ICMPv6 router
advertisement packets and autoconfigures address prefixes
and default routers. The node must be a host (not a
router) for the option to be meaningful.
ip6.keepfaith
If set to non-zero, it enables ``FAITH'' TCP relay
IPv6-to-IPv4 translator code in the kernel. Refer
faith(4) and faithd(8) for detail.
ip6.log_interval
The variable controls amount of logs generated by IPv6
packet forwarding engine, by seting interval between log
output (in seconds).
ip6.hdrnestlimit
The number of IPv6 extension headers permitted on incoming
IPv6 packets. If set to 0, the node will accept as
many extension headers as possible.
ip6.dad_count
The variable cofigures number of IPv6 DAD (duplicated
address detection) probe packets. The packets will be
generated when IPv6 interface addresses are configured.
ip6.auto_flowlabel
On connected transport protocol packets, fill IPv6
flowlabel field to help intermediate routers to identify
packet flows.
ip6.defmcasthlim
The default hop limit value for an IPv6 multicast packet
sourced by the node. This value applies to all the
transport protocols on top of IPv6. There are APIs to
override the value, as documented in ip6(4).
ip6.gif_hlim
The maximum hop limit value for an IPv6 packet generated
by gif(4) tunnel interface.
ip6.kame_version
The string identifies the version of KAME IPv6 stack
implemented in the kernel.
ip6.use_deprecated
The variable controls use of deprecated address, specified
in RFC2462 5.5.4.
ip6.rr_prune
The variable specifies interval between IPv6 router
renumbering prefix babysitting, in seconds.
ip6.v6only
The variable specifies initial value for IPV6_V6ONLY
socket option for AF_INET6 socket. Please refer to
ip6(4) for detail.
ip6.anonportmin
The lowest port number to use for TCP and UDP ephemeral
port allocation. This cannot be set to less than 1024 or
greater than 65535.
ip6.anonportmax
The highest port number to use for TCP and UDP ephemeral
port allocation. This cannot be set to less than 1024 or
greater than 65535, and must be greater than
ip6.anonportmin.
ip6.lowportmin
The lowest port number to use for TCP and UDP reserved
port allocation. This cannot be set to less than 0 or
greater than 1024, and must be smaller than
ip6.lowportmax.
ip6.lowportmax
The highest port number to use for TCP and UDP reserved
port allocation. This cannot be set to less than 0 or
greater than 1024, and must be greater than
ip6.lowportmin.
icmp6.rediraccept
If set to non-zero, the host will accept ICMPv6 redirect
packets. Note that IPv6 routers will never accept ICMPv6
redirect packets, and the variable is meaningful on IPv6
hosts (non-router) only.
icmp6.redirtimeout
The variable specifies lifetime of routing entries generated
by incoming ICMPv6 redirect.
icmp6.nd6_prune
The variable specifies interval between IPv6 neighbor
cache babysitting, in seconds.
icmp6.nd6_delay
The variable specifies DELAY_FIRST_PROBE_TIME timing constant
in IPv6 neighbor discovery specification (RFC2461),
in seconds.
icmp6.nd6_umaxtries
The variable specifies MAX_UNICAST_SOLICIT constant in
IPv6 neighbor discovery specification (RFC2461).
icmp6.nd6_mmaxtries
The variable specifies MAX_MULTICAST_SOLICIT constant in
IPv6 neighbor discovery specification (RFC2461).
icmp6.nd6_useloopback
If set to non-zero, kernel IPv6 stack will use loopback
interface for local traffic.
icmp6.nodeinfo
The variable enables responses to ICMPv6 node information
queries. If you set the variable to 0, reponses will not
be generated for ICMPv6 node information queries. Since
node information queries can have a security impact, it
is possible to fine tune which responses should be
answered. Two separate bits can be set.
1 Respond to ICMPv6 FQDN queries, e.g. ping6 -w.
2 Respond to ICMPv6 node addresses queries, e.g.
ping6 -a.
icmp6.errppslimit
The variable specifies the maximum number of outgoing
ICMPv6 error messages, per second. ICMPv6 error messages
that exceeded the value are subject to rate limitation
and will not go out from the node. Negative value disables
rate limitation.
icmp6.nd6_maxnudhint
IPv6 neighbor discovery permits upper layer protocols to
supply reachability hints, to avoid unnecessary neighbor
discovery exchanges. The variable defines the number of
consecutive hints the neighbor discovery layer will take.
For example, by setting the variable to 3, neighbor discovery
layer will take 3 consecutive hints in maximum.
After receiving 3 hints, neighbor discovery layer will
perform normal neighbor discovery process.
icmp6.mtudisc_hiwat
icmp6.mtudisc_lowat
The variables define the maximum number of routing table
entries, created due to path MTU discovery (prevents
denial-of-service attacks with ICMPv6 too big messages).
When IPv6 path MTU discovery happens, we keep path MTU
information into the routing table. If the number of
routing table entries exceed the value, the kernel will
not attempt to keep the path MTU information.
icmp6.mtudisc_hiwat is used when we have verified ICMPv6
too big messages. icmp6.mtudisc_lowat is used when we
have unverified ICMPv6 too big messages. Verification is
performed by using address/port pairs kept in connected
pcbs. Negative value disables the upper limit.
icmp6.nd6_debug
If set to non-zero, kernel IPv6 neighbor discovery code
will generate debugging messages. The debug outputs are
useful to diagnose IPv6 interoperability issues. The
flag must be set to 0 for normal operation.
We reuse net.*.tcp for TCP over IPv6, and therefore we do not
have variables net.*.tcp6. Variables net.inet6.udp6 have identical
meaning to net.inet.udp. Please refer to PF_INET section
above. For variables net.*.ipsec6, please refer to ipsec(4).
PF_KEY Get or set various global information about the IPsec key management.
The third level name is the variable name. The currently
defined variable and names are:
Variable name Type Changeable
debug integer yes
spi_try integer yes
spi_min_value integer yes
spi_max_value integer yes
random_int integer yes
larval_lifetime integer yes
blockacq_count integer yes
blockacq_lifetime integer yes
esp_keymin integer yes
esp_auth integer yes
ah_keymin integer yes
The variables are as follows:
debug Turn on debugging message from within the kernel. The
value is a bitmap, as defined in
/usr/include/netkey/key_debug.h.
spi_try
The number of times the kernel will try to obtain an
unique SPI when it generates it from random number generator.
spi_min_value
Minimum SPI value when generating it within the kernel.
spi_max_value
Maximum SPI value when generating it within the kernel.
random_int
Interval to stir pseudo-random number generator, in seconds.
Pseudo-random number generator is used only as a
last resort when random number source (/dev/urandom) is
not available. It should not really be used, and if it
were used, kernel will warn about it.
larval_lifetime
Lifetime for LARVAL SAD entries, in seconds.
blockacq_count
Number of ACQUIRE PF_KEY messages to be blocked after an
ACQUIRE message. It avoids flood of ACQUIRE PF_KEY from
being sent from the kernel to the key management daemon.
blockacq_lifetime
Lifetime of ACQUIRE PF_KEY message.
esp_keymin
Minimum ESP key length, in bits. The value is used when
the kernel creates proposal payload on ACQUIRE PF_KEY
message.
esp_auth
Whether ESP authentication should be used or not. Nonzero
value indicates that ESP authentication should be
used. The value is used when the kernel creates proposal
payload on ACQUIRE PF_KEY message.
ah_keymin
Minimum AH key length, in bits, The value is used when
the kernel creates proposal payload on ACQUIRE PF_KEY
message.
The string and integer information available for the CTL_PROC is detailed
below. The changeable column shows whether a process with appropriate
privilege may change the value. These values are per-process, and as
such may change from one process to another. When a process is created,
the default values are inherited from its parent. When a set-user-ID or
set-group-ID binary is executed, the value of PROC_PID_CORENAME is reset
to the system default value. The second level name is either the magic
value PROC_CURPROC, which points to the current process, or the PID of
the target process.
Third level name Type Changeable
PROC_PID_CORENAME string yes
PROC_PID_LIMIT node not applicable
PROC_PID_CORENAME
The template used for the core dump file name (see core(5) for
details). The base name must either be core or end with the suffix
``.core'' (the super-user may set arbitrary names). By
default it points to KERN_DEFCORENAME.
PROC_PID_LIMIT
Return resources limits, as defined for the getrlimit(2) and
setrlimit(2) system calls. The fourth level name is one of:
PROC_PID_LIMIT_CPU The maximum amount of cpu time (in seconds)
to be used by each process.
PROC_PID_LIMIT_FSIZE The largest size (in bytes) file that
may be created.
PROC_PID_LIMIT_DATA The maximum size (in bytes) of the data
segment for a process; this defines how
far a program may extend its break with
the sbrk(2) system call.
PROC_PID_LIMIT_STACK The maximum size (in bytes) of the
stack segment for a process; this
defines how far a program's stack segment
may be extended. Stack extension
is performed automatically by the system.
PROC_PID_LIMIT_CORE The largest size (in bytes) core file
that may be created.
PROC_PID_LIMIT_RSS The maximum size (in bytes) to which a
process's resident set size may grow.
This imposes a limit on the amount of
physical memory to be given to a process;
if memory is tight, the system
will prefer to take memory from processes
that are exceeding their
declared resident set size.
PROC_PID_LIMIT_MEMLOCK The maximum size (in bytes) which a
process may lock into memory using the
mlock(2) function.
PROC_PID_LIMIT_NPROC The maximum number of simultaneous processes
for this user id.
PROC_PID_LIMIT_NOFILE The maximum number of open files for
this process.
The fifth level name is one of PROC_PID_LIMIT_TYPE_SOFT or
PROC_PID_LIMIT_TYPE_HARD, to select respectively the soft or hard
limit. Both are of type integer.
The string and integer information available for the CTL_USER level is
detailed below. The changeable column shows whether a process with
appropriate privilege may change the value.
Second level name Type Changeable
USER_BC_BASE_MAX integer no
USER_BC_DIM_MAX integer no
USER_BC_SCALE_MAX integer no
USER_BC_STRING_MAX integer no
USER_COLL_WEIGHTS_MAX integer no
USER_CS_PATH string no
USER_EXPR_NEST_MAX integer no
USER_LINE_MAX integer no
USER_POSIX2_CHAR_TERM integer no
USER_POSIX2_C_BIND integer no
|
