2 # Network configuration
5 menu "Networking support"
8 bool "Networking support"
10 Unless you really know what you are doing, you should say Y here.
11 The reason is that some programs need kernel networking support even
12 when running on a stand-alone machine that isn't connected to any
13 other computer. If you are upgrading from an older kernel, you
14 should consider updating your networking tools too because changes
15 in the kernel and the tools often go hand in hand. The tools are
16 contained in the package net-tools, the location and version number
17 of which are given in <file:Documentation/Changes>.
19 For a general introduction to Linux networking, it is highly
20 recommended to read the NET-HOWTO, available from
21 <http://www.tldp.org/docs.html#howto>.
23 menu "Networking options"
27 tristate "Packet socket"
29 The Packet protocol is used by applications which communicate
30 directly with network devices without an intermediate network
31 protocol implemented in the kernel, e.g. tcpdump. If you want them
34 This driver is also available as a module called af_packet ( =
35 code which can be inserted in and removed from the running kernel
36 whenever you want). If you want to compile it as a module, say M
37 here and read <file:Documentation/modules.txt>; if you use modprobe
38 or kmod, you may also want to add "alias net-pf-17 af_packet" to
44 bool "Packet socket: mmapped IO"
47 If you say Y here, the Packet protocol driver will use an IO
48 mechanism that results in faster communication.
53 tristate "Netlink device emulation"
55 This option will be removed soon. Any programs that want to use
56 character special nodes like /dev/tap0 or /dev/route (all with major
57 number 36) need this option, and need to be rewritten soon to use
58 the real netlink socket.
59 This is a backward compatibility option, choose Y for now.
62 tristate "Unix domain sockets"
64 If you say Y here, you will include support for Unix domain sockets;
65 sockets are the standard Unix mechanism for establishing and
66 accessing network connections. Many commonly used programs such as
67 the X Window system and syslog use these sockets even if your
68 machine is not connected to any network. Unless you are working on
69 an embedded system or something similar, you therefore definitely
72 However, the socket support is also available as a module ( = code
73 which can be inserted in and removed from the running kernel
74 whenever you want). If you want to compile it as a module, say M
75 here and read <file:Documentation/modules.txt>. The module will be
76 called unix. If you try building this as a module and you have
77 said Y to "Kernel module loader support" above, be sure to add
78 'alias net-pf-1 unix' to your /etc/modules.conf file. Note that
79 several important services won't work correctly if you say M here
80 and then neglect to load the module.
82 Say Y unless you know what you are doing.
85 tristate "PF_KEY sockets"
87 PF_KEYv2 socket family, compatible to KAME ones.
88 They are required if you are going to use IPsec tools ported
91 Say Y unless you know what you are doing.
94 bool "TCP/IP networking"
96 These are the protocols used on the Internet and on most local
97 Ethernets. It is highly recommended to say Y here (this will enlarge
98 your kernel by about 144 KB), since some programs (e.g. the X window
99 system) use TCP/IP even if your machine is not connected to any
100 other computer. You will get the so-called loopback device which
101 allows you to ping yourself (great fun, that!).
103 For an excellent introduction to Linux networking, please read the
104 NET-3-HOWTO, available from
105 <http://www.tldp.org/docs.html#howto>.
107 This option is also necessary if you want to use the full power of
108 term (term is a program which gives you almost full Internet
109 connectivity if you have a regular dial up shell account on some
110 Internet connected Unix computer; for more information, read
111 <http://www.bart.nl/~patrickr/term-howto/Term-HOWTO.html>).
113 If you say Y here and also to "/proc file system support" and
114 "Sysctl support" below, you can change various aspects of the
115 behavior of the TCP/IP code by writing to the (virtual) files in
116 /proc/sys/net/ipv4/*; the options are explained in the file
117 <file:Documentation/networking/ip-sysctl.txt>.
121 source "net/ipv4/Kconfig"
123 # IPv6 as module will cause a CRASH if you try to unload it
125 tristate "The IPv6 protocol (EXPERIMENTAL)"
126 depends on INET && EXPERIMENTAL
128 This is experimental support for the next version of the Internet
129 Protocol: IP version 6 (also called IPng "IP next generation").
130 Features of this new protocol include: expanded address space,
131 authentication and privacy, and seamless interoperability with the
132 current version of IP (IP version 4). For general information about
133 IPv6, see <http://playground.sun.com/pub/ipng/html/ipng-main.html>;
134 for specific information about IPv6 under Linux read the HOWTO at
135 <http://www.bieringer.de/linux/IPv6/> and the file net/ipv6/README
136 in the kernel source.
138 If you want to use IPv6, please upgrade to the newest net-tools as
139 given in <file:Documentation/Changes>. You will still be able to do
140 regular IPv4 networking as well.
142 This protocol support is also available as a module ( = code which
143 can be inserted in and removed from the running kernel whenever you
144 want). The module will be called ipv6. If you want to compile it
145 as a module, say M here and read <file:Documentation/modules.txt>.
147 It is safe to say N here for now.
149 source "net/ipv6/Kconfig"
152 tristate "DECnet Support"
154 The DECnet networking protocol was used in many products made by
155 Digital (now Compaq). It provides reliable stream and sequenced
156 packet communications over which run a variety of services similar
157 to those which run over TCP/IP.
159 To find some tools to use with the kernel layer support, please
160 look at Patrick Caulfield's web site:
161 <http://linux.dreamtime.org/decnet/>.
163 More detailed documentation is available in
164 <file:Documentation/networking/decnet.txt>.
166 Be sure to say Y to "/proc file system support" and "Sysctl support"
167 below when using DECnet, since you will need sysctl support to aid
168 in configuration at run time.
170 The DECnet code is also available as a module ( = code which can be
171 inserted in and removed from the running kernel whenever you want).
172 The module is called decnet.
174 source "net/decnet/Kconfig"
177 tristate "802.1d Ethernet Bridging"
179 If you say Y here, then your Linux box will be able to act as an
180 Ethernet bridge, which means that the different Ethernet segments it
181 is connected to will appear as one Ethernet to the participants.
182 Several such bridges can work together to create even larger
183 networks of Ethernets using the IEEE 802.1 spanning tree algorithm.
184 As this is a standard, Linux bridges will cooperate properly with
185 other third party bridge products.
187 In order to use the Ethernet bridge, you'll need the bridge
188 configuration tools; see <file:Documentation/networking/bridge.txt>
189 for location. Please read the Bridge mini-HOWTO for more
192 If you enable iptables support along with the bridge support then you
193 turn your bridge into a bridging firewall.
194 iptables will then see the IP packets being bridged, so you need to
195 take this into account when setting up your firewall rules.
197 If you want to compile this code as a module ( = code which can be
198 inserted in and removed from the running kernel whenever you want),
199 say M here and read <file:Documentation/modules.txt>. The module
200 will be called bridge.
205 bool "Network packet filtering (replaces ipchains)"
207 Netfilter is a framework for filtering and mangling network packets
208 that pass through your Linux box.
210 The most common use of packet filtering is to run your Linux box as
211 a firewall protecting a local network from the Internet. The type of
212 firewall provided by this kernel support is called a "packet
213 filter", which means that it can reject individual network packets
214 based on type, source, destination etc. The other kind of firewall,
215 a "proxy-based" one, is more secure but more intrusive and more
216 bothersome to set up; it inspects the network traffic much more
217 closely, modifies it and has knowledge about the higher level
218 protocols, which a packet filter lacks. Moreover, proxy-based
219 firewalls often require changes to the programs running on the local
220 clients. Proxy-based firewalls don't need support by the kernel, but
221 they are often combined with a packet filter, which only works if
224 You should also say Y here if you intend to use your Linux box as
225 the gateway to the Internet for a local network of machines without
226 globally valid IP addresses. This is called "masquerading": if one
227 of the computers on your local network wants to send something to
228 the outside, your box can "masquerade" as that computer, i.e. it
229 forwards the traffic to the intended outside destination, but
230 modifies the packets to make it look like they came from the
231 firewall box itself. It works both ways: if the outside host
232 replies, the Linux box will silently forward the traffic to the
233 correct local computer. This way, the computers on your local net
234 are completely invisible to the outside world, even though they can
235 reach the outside and can receive replies. It is even possible to
236 run globally visible servers from within a masqueraded local network
237 using a mechanism called portforwarding. Masquerading is also often
238 called NAT (Network Address Translation).
240 Another use of Netfilter is in transparent proxying: if a machine on
241 the local network tries to connect to an outside host, your Linux
242 box can transparently forward the traffic to a local server,
243 typically a caching proxy server.
245 Various modules exist for netfilter which replace the previous
246 masquerading (ipmasqadm), packet filtering (ipchains), transparent
247 proxying, and portforwarding mechanisms. Please see
248 <file:Documentation/Changes> under "iptables" for the location of
251 Make sure to say N to "Fast switching" below if you intend to say Y
252 here, as Fast switching currently bypasses netfilter.
254 Chances are that you should say Y here if you compile a kernel which
255 will run as a router and N for regular hosts. If unsure, say N.
259 config NETFILTER_DEBUG
260 bool "Network packet filtering debugging"
263 You can say Y here if you want to get additional messages useful in
264 debugging the netfilter code.
266 source "net/ipv4/netfilter/Kconfig"
267 source "net/ipv6/netfilter/Kconfig"
268 source "net/decnet/netfilter/Kconfig"
269 source "net/bridge/netfilter/Kconfig"
273 source "net/xfrm/Kconfig"
275 source "net/sctp/Kconfig"
278 tristate "Asynchronous Transfer Mode (ATM) (EXPERIMENTAL)"
279 depends on EXPERIMENTAL
281 ATM is a high-speed networking technology for Local Area Networks
282 and Wide Area Networks. It uses a fixed packet size and is
283 connection oriented, allowing for the negotiation of minimum
284 bandwidth requirements.
286 In order to participate in an ATM network, your Linux box needs an
287 ATM networking card. If you have that, say Y here and to the driver
288 of your ATM card below.
290 Note that you need a set of user-space programs to actually make use
291 of ATM. See the file <file:Documentation/networking/atm.txt> for
295 tristate "Classical IP over ATM (EXPERIMENTAL)"
296 depends on ATM && INET
298 Classical IP over ATM for PVCs and SVCs, supporting InARP and
299 ATMARP. If you want to communication with other IP hosts on your ATM
300 network, you will typically either say Y here or to "LAN Emulation
303 config ATM_CLIP_NO_ICMP
304 bool "Do NOT send ICMP if no neighbour (EXPERIMENTAL)"
307 Normally, an "ICMP host unreachable" message is sent if a neighbour
308 cannot be reached because there is no VC to it in the kernel's
309 ATMARP table. This may cause problems when ATMARP table entries are
310 briefly removed during revalidation. If you say Y here, packets to
311 such neighbours are silently discarded instead.
314 tristate "LAN Emulation (LANE) support (EXPERIMENTAL)"
317 LAN Emulation emulates services of existing LANs across an ATM
318 network. Besides operating as a normal ATM end station client, Linux
319 LANE client can also act as an proxy client bridging packets between
320 ELAN and Ethernet segments. You need LANE if you want to try MPOA.
323 tristate "Multi-Protocol Over ATM (MPOA) support (EXPERIMENTAL)"
324 depends on ATM && INET && ATM_LANE!=n
326 Multi-Protocol Over ATM allows ATM edge devices such as routers,
327 bridges and ATM attached hosts establish direct ATM VCs across
328 subnetwork boundaries. These shortcut connections bypass routers
329 enhancing overall network performance.
332 tristate "RFC1483/2684 Bridged protocols"
333 depends on ATM && INET
335 ATM PVCs can carry ethernet PDUs according to rfc2684 (formerly 1483)
336 This device will act like an ethernet from the kernels point of view,
337 with the traffic being carried by ATM PVCs (currently 1 PVC/device).
338 This is sometimes used over DSL lines. If in doubt, say N.
340 config ATM_BR2684_IPFILTER
341 bool "Per-VC IP filter kludge"
342 depends on ATM_BR2684
344 This is an experimental mechanism for users who need to terminating a
345 large number of IP-only vcc's. Do not enable this unless you are sure
346 you know what you are doing.
349 tristate "802.1Q VLAN Support"
352 tristate "ANSI/IEEE 802.2 - aka LLC (IPX, Appletalk, Token Ring)"
354 This is a Logical Link Layer protocol used for Appletalk, IPX,
355 Token Ring devices, the linux-sna.org project and in the future by
356 NetBEUI. It originally came from Procom Inc. that released the code
357 for 2.0.36 and was heavily modified to work with 2.{4,5}.
358 Select this if you want to have support for those protocols or if
359 you want to have the sockets interface for LLC.
363 bool "LLC sockets interface"
367 tristate "The IPX protocol"
370 This is support for the Novell networking protocol, IPX, commonly
371 used for local networks of Windows machines. You need it if you
372 want to access Novell NetWare file or print servers using the Linux
373 Novell client ncpfs (available from
374 <ftp://platan.vc.cvut.cz/pub/linux/ncpfs/>) or from
375 within the Linux DOS emulator DOSEMU (read the DOSEMU-HOWTO,
376 available from <http://www.tldp.org/docs.html#howto>). In order
377 to do the former, you'll also have to say Y to "NCP file system
380 IPX is similar in scope to IP, while SPX, which runs on top of IPX,
381 is similar to TCP. There is also experimental support for SPX in
382 Linux (see "SPX networking", below).
384 To turn your Linux box into a fully featured NetWare file server and
385 IPX router, say Y here and fetch either lwared from
386 <ftp://ibiblio.org/pub/Linux/system/network/daemons/> or
387 mars_nwe from <ftp://www.compu-art.de/mars_nwe/>. For more
388 information, read the IPX-HOWTO available from
389 <http://www.tldp.org/docs.html#howto>.
391 General information about how to connect Linux, Windows machines and
392 Macs is on the WWW at <http://www.eats.com/linux_mac_win.html>.
394 The IPX driver would enlarge your kernel by about 16 KB. This driver
395 is also available as a module ( = code which can be inserted in and
396 removed from the running kernel whenever you want). The module will
397 be called ipx. If you want to compile it as a module, say M here
398 and read <file:Documentation/modules.txt>. Unless you want to
399 integrate your Linux box with a local Novell network, say N.
401 source "net/ipx/Kconfig"
404 tristate "Appletalk protocol support"
407 AppleTalk is the protocol that Apple computers can use to communicate
408 on a network. If your Linux box is connected to such a network and you
409 wish to connect to it, say Y. You will need to use the netatalk package
410 so that your Linux box can act as a print and file server for Macs as
411 well as access AppleTalk printers. Check out
412 <http://www.zettabyte.net/netatalk/> on the WWW for details.
413 EtherTalk is the name used for AppleTalk over Ethernet and the
414 cheaper and slower LocalTalk is AppleTalk over a proprietary Apple
415 network using serial links. EtherTalk and LocalTalk are fully
418 General information about how to connect Linux, Windows machines and
419 Macs is on the WWW at <http://www.eats.com/linux_mac_win.html>. The
420 NET-3-HOWTO, available from
421 <http://www.tldp.org/docs.html#howto>, contains valuable
424 This driver is also available as a module ( = code which can be
425 inserted in and removed from the running kernel whenever you want).
426 The module is called appletalk. If you want to compile it as a
427 module, say M here and read <file:Documentation/modules.txt>. You
428 almost certainly want to compile it as a module so you can restart
429 your AppleTalk stack without rebooting your machine. I hear that
430 the GNU boycott of Apple is over, so even politically correct people
431 are allowed to say Y here.
433 source "drivers/net/appletalk/Kconfig"
436 tristate "CCITT X.25 Packet Layer (EXPERIMENTAL)"
437 depends on EXPERIMENTAL
439 X.25 is a set of standardized network protocols, similar in scope to
440 frame relay; the one physical line from your box to the X.25 network
441 entry point can carry several logical point-to-point connections
442 (called "virtual circuits") to other computers connected to the X.25
443 network. Governments, banks, and other organizations tend to use it
444 to connect to each other or to form Wide Area Networks (WANs). Many
445 countries have public X.25 networks. X.25 consists of two
446 protocols: the higher level Packet Layer Protocol (PLP) (say Y here
447 if you want that) and the lower level data link layer protocol LAPB
448 (say Y to "LAPB Data Link Driver" below if you want that).
450 You can read more about X.25 at <http://www.sangoma.com/x25.htm> and
451 <http://www.cisco.com/univercd/data/doc/software/11_0/rpcg/cx25.htm>.
452 Information about X.25 for Linux is contained in the files
453 <file:Documentation/networking/x25.txt> and
454 <file:Documentation/networking/x25-iface.txt>.
456 One connects to an X.25 network either with a dedicated network card
457 using the X.21 protocol (not yet supported by Linux) or one can do
458 X.25 over a standard telephone line using an ordinary modem (say Y
459 to "X.25 async driver" below) or over Ethernet using an ordinary
460 Ethernet card and either the 802.2 LLC protocol (say Y to "802.2
461 LLC" below) or LAPB over Ethernet (say Y to "LAPB Data Link Driver"
462 and "LAPB over Ethernet driver" below).
464 If you want to compile this driver as a module ( = code which can be
465 inserted in and removed from the running kernel whenever you want),
466 say M here and read <file:Documentation/modules.txt>. The module
467 will be called x25. If unsure, say N.
470 tristate "LAPB Data Link Driver (EXPERIMENTAL)"
471 depends on EXPERIMENTAL
473 Link Access Procedure, Balanced (LAPB) is the data link layer (i.e.
474 the lower) part of the X.25 protocol. It offers a reliable
475 connection service to exchange data frames with one other host, and
476 it is used to transport higher level protocols (mostly X.25 Packet
477 Layer, the higher part of X.25, but others are possible as well).
478 Usually, LAPB is used with specialized X.21 network cards, but Linux
479 currently supports LAPB only over Ethernet connections. If you want
480 to use LAPB connections over Ethernet, say Y here and to "LAPB over
481 Ethernet driver" below. Read
482 <file:Documentation/networking/lapb-module.txt> for technical
485 If you want to compile this driver as a module though ( = code which
486 can be inserted in and removed from the running kernel whenever you
487 want), say M here and read <file:Documentation/modules.txt>. The
488 module will be called lapb. If unsure, say N.
491 bool "Frame Diverter (EXPERIMENTAL)"
492 depends on EXPERIMENTAL
494 The Frame Diverter allows you to divert packets from the
495 network, that are not aimed at the interface receiving it (in
496 promisc. mode). Typically, a Linux box setup as an Ethernet bridge
497 with the Frames Diverter on, can do some *really* transparent www
498 caching using a Squid proxy for example.
500 This is very useful when you don't want to change your router's
501 config (or if you simply don't have access to it).
503 The other possible usages of diverting Ethernet Frames are
505 - reroute smtp traffic to another interface
506 - traffic-shape certain network streams
507 - transparently proxy smtp connections
510 For more informations, please refer to:
511 <http://diverter.sourceforge.net/>
512 <http://perso.wanadoo.fr/magpie/EtherDivert.html>
517 tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
518 depends on EXPERIMENTAL && INET
520 Econet is a fairly old and slow networking protocol mainly used by
521 Acorn computers to access file and print servers. It uses native
522 Econet network cards. AUN is an implementation of the higher level
523 parts of Econet that runs over ordinary Ethernet connections, on
524 top of the UDP packet protocol, which in turn runs on top of the
525 Internet protocol IP.
527 If you say Y here, you can choose with the next two options whether
528 to send Econet/AUN traffic over a UDP Ethernet connection or over
529 a native Econet network card.
531 This driver is also available as a module ( = code which can be
532 inserted in and removed from the running kernel whenever you want).
533 The module will be called econet. If you want to compile it as a
534 module, say M here and read <file:Documentation/modules.txt>.
540 Say Y here if you want to send Econet/AUN traffic over a UDP
541 connection (UDP is a packet based protocol that runs on top of the
542 Internet protocol IP) using an ordinary Ethernet network card.
548 Say Y here if you have a native Econet network card installed in
552 tristate "WAN router"
553 depends on EXPERIMENTAL
555 Wide Area Networks (WANs), such as X.25, frame relay and leased
556 lines, are used to interconnect Local Area Networks (LANs) over vast
557 distances with data transfer rates significantly higher than those
558 achievable with commonly used asynchronous modem connections.
559 Usually, a quite expensive external device called a `WAN router' is
560 needed to connect to a WAN.
562 As an alternative, WAN routing can be built into the Linux kernel.
563 With relatively inexpensive WAN interface cards available on the
564 market, a perfectly usable router can be built for less than half
565 the price of an external router. If you have one of those cards and
566 wish to use your Linux box as a WAN router, say Y here and also to
567 the WAN driver for your card, below. You will then need the
568 wan-tools package which is available from <ftp://ftp.sangoma.com/>.
569 Read <file:Documentation/networking/wan-router.txt> for more
572 The WAN routing support is also available as a module called
573 wanrouter ( = code which can be inserted in and removed from the
574 running kernel whenever you want). If you want to compile it as a
575 module, say M here and read <file:Documentation/modules.txt>.
580 bool "Fast switching (read help!)"
581 depends on EXPERIMENTAL
583 Saying Y here enables direct NIC-to-NIC (NIC = Network Interface
584 Card) data transfers on the local network, which is fast.
586 IMPORTANT NOTE: This option is NOT COMPATIBLE with "Network packet
587 filtering" (CONFIG_NETFILTER). Say N here if you say Y there.
589 However, it will work with all options in the "Advanced router"
590 section (except for "Use TOS value as routing key" and
591 "Use FWMARK value as routing key").
593 At the moment, few devices support fast switching (tulip is one of
594 them, a modified 8390 driver can be found at
595 <ftp://ftp.inr.ac.ru/ip-routing/fastroute/fastroute-8390.tar.gz>).
599 config NET_HW_FLOWCONTROL
600 bool "Forwarding between high speed interfaces"
601 depends on EXPERIMENTAL
603 This option enables NIC (Network Interface Card) hardware throttling
604 during periods of extremal congestion. At the moment only a couple
605 of device drivers support it (really only one -- tulip, a modified
606 8390 driver can be found at
607 <ftp://ftp.inr.ac.ru/ip-routing/fastroute/fastroute-8390.tar.gz>).
609 Really, this option is applicable to any machine attached to a fast
610 enough network, and even a 10 Mb NIC is able to kill a not very slow
611 box, such as a 120MHz Pentium.
613 However, do not say Y here if you did not experience any serious
617 menu "QoS and/or fair queueing"
620 bool "QoS and/or fair queueing"
622 When the kernel has several packets to send out over a network
623 device, it has to decide which ones to send first, which ones to
624 delay, and which ones to drop. This is the job of the packet
625 scheduler, and several different algorithms for how to do this
626 "fairly" have been proposed.
628 If you say N here, you will get the standard packet scheduler, which
629 is a FIFO (first come, first served). If you say Y here, you will be
630 able to choose from among several alternative algorithms which can
631 then be attached to different network devices. This is useful for
632 example if some of your network devices are real time devices that
633 need a certain minimum data flow rate, or if you need to limit the
634 maximum data flow rate for traffic which matches specified criteria.
635 This code is considered to be experimental.
637 To administer these schedulers, you'll need the user-level utilities
638 from the package iproute2+tc at <ftp://ftp.inr.ac.ru/ip-routing/>.
639 That package also contains some documentation; for more, check out
640 <http://snafu.freedom.org/linux2.2/iproute-notes.html>.
642 This Quality of Service (QoS) support will enable you to use
643 Differentiated Services (diffserv) and Resource Reservation Protocol
644 (RSVP) on your Linux router if you also say Y to "QoS support",
645 "Packet classifier API" and to some classifiers below. Documentation
646 and software is at <http://diffserv.sourceforge.net/>.
648 If you say Y here and to "/proc file system" below, you will be able
649 to read status information about packet schedulers from the file
652 The available schedulers are listed in the following questions; you
653 can say Y to as many as you like. If unsure, say N now.
655 source "net/sched/Kconfig"
657 #bool 'Network code profiler' CONFIG_NET_PROFILE
660 menu "Network testing"
663 tristate "Packet Generator (USE WITH CAUTION)"
665 This module will inject preconfigured packets, at a configurable
666 rate, out of a given interface. It is used for network interface
667 stress testing and performance analysis. If you don't understand
668 what was just said, you don't need it: say N.
670 Documentation on how to use the packet generaor can be found
671 at <file:Documentation/networking/pktgen.txt>.
673 This code is also available as a module called pktgen ( = code
674 which can be inserted in and removed from the running kernel
675 whenever you want). If you want to compile it as a module, say M
676 here and read <file:Documentation/modules.txt>.
682 source "drivers/net/Kconfig"