NPF-PARAMS(7)

NAME
npf-params - tunable NPF parameters

DESCRIPTION
NPF supports a set of dynamically tunable parameters.

All parameter values are integers and should generally be between and INT_MAX, unless specified otherwise. Some parameters values can be negative; such values would typically have a special meaning. Enable/disable switches should be represented as boolean values 0 ("off") or 1 ("on").

PARAMETERS

bpf.jit
    BPF just-in-time compilation: enables or disables bpfjit(4) support. Some machine architectures are not presently supported by bpfjit(4). Setting this parameter to off stops NPF from trying to enable this functionality, and generating a warning if it is unable to do so. Default: 1.

gc.step
    Number of connection state items to process in one garbage collection (G/C) cycle. Must be positive number. Default: 256.

state.generic
    Generic state tracking parameters for non-TCP flows. All timeouts are in seconds and must be zero or positive.

    timeout.new
        Timeout for new ("unsynchronized") state. Default: 30.

    timeout.established
        Timeout for established ("synchronized") state. Default: 60.

    timeout.closed
        Timeout for closed state. Default: 0.

state.tcp
    State tracking parameters for TCP connections. All timeout values are in seconds.

    max_ack_win
        Maximum allowed ACK window. Default: 66000.

    strict_order_rst
        Enforce strict order RST. Default: 1.

    timeout.new
        Timeout for a new connection in "unsynchronized" state. Default: 30.

    timeout.established
        Timeout for an established connection ("synchronized" state). Default: 86400.

    timeout.half_close
        Timeout for the half-close TCP states. Default: 3600.

    timeout.close
        Timeout for the full close TCP states. Default: 10.

    timeout.time_wait
        Timeout for the TCP time-wait state. Default: 240.

portmap.min_port
    Lower bound of the port range used when selecting the port for dynamic NAT with port translation enabled. Default: 1024 (also the lowest allowed value).

portmap.max_port
    Upper bound of the port range as described above. Default: 65535 (also the highest allowed value).

EXAMPLES
An example line in the npf.conf(5) configuration file:

    set state.tcp.strict_order_rst on       # "on" can be used instead of 1
    set state.tcp.timeout.time_wait 0       # destroy the state immediately

SEE ALSO
libnpf(3), npfkern(3), bpfjit(4), npf.conf(5), pcap-filter(7), npfctl(8)

AUTHORS
NPF was designed and implemented by Mindaugas Rasiukevicius.