2 # Network configuration
5 menu "Networking support"
8 bool "Networking support"
10 Unless you really know what you are doing, you should say Y here.
11 The reason is that some programs need kernel networking support even
12 when running on a stand-alone machine that isn't connected to any
13 other computer. If you are upgrading from an older kernel, you
14 should consider updating your networking tools too because changes
15 in the kernel and the tools often go hand in hand. The tools are
16 contained in the package net-tools, the location and version number
17 of which are given in <file:Documentation/Changes>.
19 For a general introduction to Linux networking, it is highly
20 recommended to read the NET-HOWTO, available from
21 <http://www.tldp.org/docs.html#howto>.
23 menu "Networking options"
27 tristate "Packet socket"
29 The Packet protocol is used by applications which communicate
30 directly with network devices without an intermediate network
31 protocol implemented in the kernel, e.g. tcpdump. If you want them
34 This driver is also available as a module called af_packet ( =
35 code which can be inserted in and removed from the running kernel
36 whenever you want). If you want to compile it as a module, say M
37 here and read <file:Documentation/modules.txt>; if you use modprobe
38 or kmod, you may also want to add "alias net-pf-17 af_packet" to
44 bool "Packet socket: mmapped IO"
47 If you say Y here, the Packet protocol driver will use an IO
48 mechanism that results in faster communication.
53 tristate "Netlink device emulation"
55 This option will be removed soon. Any programs that want to use
56 character special nodes like /dev/tap0 or /dev/route (all with major
57 number 36) need this option, and need to be rewritten soon to use
58 the real netlink socket.
59 This is a backward compatibility option, choose Y for now.
62 bool "Network packet filtering (replaces ipchains)"
64 Netfilter is a framework for filtering and mangling network packets
65 that pass through your Linux box.
67 The most common use of packet filtering is to run your Linux box as
68 a firewall protecting a local network from the Internet. The type of
69 firewall provided by this kernel support is called a "packet
70 filter", which means that it can reject individual network packets
71 based on type, source, destination etc. The other kind of firewall,
72 a "proxy-based" one, is more secure but more intrusive and more
73 bothersome to set up; it inspects the network traffic much more
74 closely, modifies it and has knowledge about the higher level
75 protocols, which a packet filter lacks. Moreover, proxy-based
76 firewalls often require changes to the programs running on the local
77 clients. Proxy-based firewalls don't need support by the kernel, but
78 they are often combined with a packet filter, which only works if
81 You should also say Y here if you intend to use your Linux box as
82 the gateway to the Internet for a local network of machines without
83 globally valid IP addresses. This is called "masquerading": if one
84 of the computers on your local network wants to send something to
85 the outside, your box can "masquerade" as that computer, i.e. it
86 forwards the traffic to the intended outside destination, but
87 modifies the packets to make it look like they came from the
88 firewall box itself. It works both ways: if the outside host
89 replies, the Linux box will silently forward the traffic to the
90 correct local computer. This way, the computers on your local net
91 are completely invisible to the outside world, even though they can
92 reach the outside and can receive replies. It is even possible to
93 run globally visible servers from within a masqueraded local network
94 using a mechanism called portforwarding. Masquerading is also often
95 called NAT (Network Address Translation).
97 Another use of Netfilter is in transparent proxying: if a machine on
98 the local network tries to connect to an outside host, your Linux
99 box can transparently forward the traffic to a local server,
100 typically a caching proxy server.
102 Various modules exist for netfilter which replace the previous
103 masquerading (ipmasqadm), packet filtering (ipchains), transparent
104 proxying, and portforwarding mechanisms. Please see
105 <file:Documentation/Changes> under "iptables" for the location of
108 Make sure to say N to "Fast switching" below if you intend to say Y
109 here, as Fast switching currently bypasses netfilter.
111 Chances are that you should say Y here if you compile a kernel which
112 will run as a router and N for regular hosts. If unsure, say N.
114 config NETFILTER_DEBUG
115 bool "Network packet filtering debugging"
118 You can say Y here if you want to get additional messages useful in
119 debugging the netfilter code.
122 tristate "Unix domain sockets"
124 If you say Y here, you will include support for Unix domain sockets;
125 sockets are the standard Unix mechanism for establishing and
126 accessing network connections. Many commonly used programs such as
127 the X Window system and syslog use these sockets even if your
128 machine is not connected to any network. Unless you are working on
129 an embedded system or something similar, you therefore definitely
132 However, the socket support is also available as a module ( = code
133 which can be inserted in and removed from the running kernel
134 whenever you want). If you want to compile it as a module, say M
135 here and read <file:Documentation/modules.txt>. The module will be
136 called unix. If you try building this as a module and you have
137 said Y to "Kernel module loader support" above, be sure to add
138 'alias net-pf-1 unix' to your /etc/modules.conf file. Note that
139 several important services won't work correctly if you say M here
140 and then neglect to load the module.
142 Say Y unless you know what you are doing.
145 tristate "PF_KEY sockets"
147 PF_KEYv2 socket family, compatible to KAME ones.
148 They are required if you are going to use IPsec tools ported
151 Say Y unless you know what you are doing.
154 bool "TCP/IP networking"
156 These are the protocols used on the Internet and on most local
157 Ethernets. It is highly recommended to say Y here (this will enlarge
158 your kernel by about 144 KB), since some programs (e.g. the X window
159 system) use TCP/IP even if your machine is not connected to any
160 other computer. You will get the so-called loopback device which
161 allows you to ping yourself (great fun, that!).
163 For an excellent introduction to Linux networking, please read the
164 NET-3-HOWTO, available from
165 <http://www.tldp.org/docs.html#howto>.
167 This option is also necessary if you want to use the full power of
168 term (term is a program which gives you almost full Internet
169 connectivity if you have a regular dial up shell account on some
170 Internet connected Unix computer; for more information, read
171 <http://www.bart.nl/~patrickr/term-howto/Term-HOWTO.html>).
173 If you say Y here and also to "/proc file system support" and
174 "Sysctl support" below, you can change various aspects of the
175 behavior of the TCP/IP code by writing to the (virtual) files in
176 /proc/sys/net/ipv4/*; the options are explained in the file
177 <file:Documentation/networking/ip-sysctl.txt>.
181 source "net/ipv4/Kconfig"
183 # IPv6 as module will cause a CRASH if you try to unload it
185 tristate "The IPv6 protocol (EXPERIMENTAL)"
186 depends on INET && EXPERIMENTAL
188 This is experimental support for the next version of the Internet
189 Protocol: IP version 6 (also called IPng "IP next generation").
190 Features of this new protocol include: expanded address space,
191 authentication and privacy, and seamless interoperability with the
192 current version of IP (IP version 4). For general information about
193 IPv6, see <http://playground.sun.com/pub/ipng/html/ipng-main.html>;
194 for specific information about IPv6 under Linux read the HOWTO at
195 <http://www.bieringer.de/linux/IPv6/> and the file net/ipv6/README
196 in the kernel source.
198 If you want to use IPv6, please upgrade to the newest net-tools as
199 given in <file:Documentation/Changes>. You will still be able to do
200 regular IPv4 networking as well.
202 This protocol support is also available as a module ( = code which
203 can be inserted in and removed from the running kernel whenever you
204 want). The module will be called ipv6. If you want to compile it
205 as a module, say M here and read <file:Documentation/modules.txt>.
207 It is safe to say N here for now.
209 source "net/ipv6/Kconfig"
211 source "net/xfrm/Kconfig"
213 source "net/sctp/Kconfig"
216 tristate "Asynchronous Transfer Mode (ATM) (EXPERIMENTAL)"
217 depends on EXPERIMENTAL
219 ATM is a high-speed networking technology for Local Area Networks
220 and Wide Area Networks. It uses a fixed packet size and is
221 connection oriented, allowing for the negotiation of minimum
222 bandwidth requirements.
224 In order to participate in an ATM network, your Linux box needs an
225 ATM networking card. If you have that, say Y here and to the driver
226 of your ATM card below.
228 Note that you need a set of user-space programs to actually make use
229 of ATM. See the file <file:Documentation/networking/atm.txt> for
233 tristate "Classical IP over ATM (EXPERIMENTAL)"
234 depends on ATM && INET
236 Classical IP over ATM for PVCs and SVCs, supporting InARP and
237 ATMARP. If you want to communication with other IP hosts on your ATM
238 network, you will typically either say Y here or to "LAN Emulation
241 config ATM_CLIP_NO_ICMP
242 bool "Do NOT send ICMP if no neighbour (EXPERIMENTAL)"
245 Normally, an "ICMP host unreachable" message is sent if a neighbour
246 cannot be reached because there is no VC to it in the kernel's
247 ATMARP table. This may cause problems when ATMARP table entries are
248 briefly removed during revalidation. If you say Y here, packets to
249 such neighbours are silently discarded instead.
252 tristate "LAN Emulation (LANE) support (EXPERIMENTAL)"
255 LAN Emulation emulates services of existing LANs across an ATM
256 network. Besides operating as a normal ATM end station client, Linux
257 LANE client can also act as an proxy client bridging packets between
258 ELAN and Ethernet segments. You need LANE if you want to try MPOA.
261 tristate "Multi-Protocol Over ATM (MPOA) support (EXPERIMENTAL)"
262 depends on ATM && INET && ATM_LANE!=n
264 Multi-Protocol Over ATM allows ATM edge devices such as routers,
265 bridges and ATM attached hosts establish direct ATM VCs across
266 subnetwork boundaries. These shortcut connections bypass routers
267 enhancing overall network performance.
270 tristate "RFC1483/2684 Bridged protocols"
271 depends on ATM && INET
273 ATM PVCs can carry ethernet PDUs according to rfc2684 (formerly 1483)
274 This device will act like an ethernet from the kernels point of view,
275 with the traffic being carried by ATM PVCs (currently 1 PVC/device).
276 This is sometimes used over DSL lines. If in doubt, say N.
278 config ATM_BR2684_IPFILTER
279 bool "Per-VC IP filter kludge"
280 depends on ATM_BR2684
282 This is an experimental mechanism for users who need to terminating a
283 large number of IP-only vcc's. Do not enable this unless you are sure
284 you know what you are doing.
287 tristate "802.1Q VLAN Support"
290 tristate "ANSI/IEEE 802.2 - aka LLC (IPX, Appletalk, Token Ring)"
292 This is a Logical Link Layer protocol used for Appletalk, IPX,
293 Token Ring devices, the linux-sna.org project and in the future by
294 NetBEUI. It originally came from Procom Inc. that released the code
295 for 2.0.36 and was heavily modified to work with 2.{4,5}.
296 Select this if you want to have support for those protocols or if
297 you want to have the sockets interface for LLC.
301 bool "LLC sockets interface"
305 tristate "The IPX protocol"
308 This is support for the Novell networking protocol, IPX, commonly
309 used for local networks of Windows machines. You need it if you
310 want to access Novell NetWare file or print servers using the Linux
311 Novell client ncpfs (available from
312 <ftp://platan.vc.cvut.cz/pub/linux/ncpfs/>) or from
313 within the Linux DOS emulator DOSEMU (read the DOSEMU-HOWTO,
314 available from <http://www.tldp.org/docs.html#howto>). In order
315 to do the former, you'll also have to say Y to "NCP file system
318 IPX is similar in scope to IP, while SPX, which runs on top of IPX,
319 is similar to TCP. There is also experimental support for SPX in
320 Linux (see "SPX networking", below).
322 To turn your Linux box into a fully featured NetWare file server and
323 IPX router, say Y here and fetch either lwared from
324 <ftp://ibiblio.org/pub/Linux/system/network/daemons/> or
325 mars_nwe from <ftp://www.compu-art.de/mars_nwe/>. For more
326 information, read the IPX-HOWTO available from
327 <http://www.tldp.org/docs.html#howto>.
329 General information about how to connect Linux, Windows machines and
330 Macs is on the WWW at <http://www.eats.com/linux_mac_win.html>.
332 The IPX driver would enlarge your kernel by about 16 KB. This driver
333 is also available as a module ( = code which can be inserted in and
334 removed from the running kernel whenever you want). The module will
335 be called ipx. If you want to compile it as a module, say M here
336 and read <file:Documentation/modules.txt>. Unless you want to
337 integrate your Linux box with a local Novell network, say N.
339 source "net/ipx/Kconfig"
342 tristate "Appletalk protocol support"
345 AppleTalk is the protocol that Apple computers can use to communicate
346 on a network. If your Linux box is connected to such a network and you
347 wish to connect to it, say Y. You will need to use the netatalk package
348 so that your Linux box can act as a print and file server for Macs as
349 well as access AppleTalk printers. Check out
350 <http://www.zettabyte.net/netatalk/> on the WWW for details.
351 EtherTalk is the name used for AppleTalk over Ethernet and the
352 cheaper and slower LocalTalk is AppleTalk over a proprietary Apple
353 network using serial links. EtherTalk and LocalTalk are fully
356 General information about how to connect Linux, Windows machines and
357 Macs is on the WWW at <http://www.eats.com/linux_mac_win.html>. The
358 NET-3-HOWTO, available from
359 <http://www.tldp.org/docs.html#howto>, contains valuable
362 This driver is also available as a module ( = code which can be
363 inserted in and removed from the running kernel whenever you want).
364 The module is called appletalk. If you want to compile it as a
365 module, say M here and read <file:Documentation/modules.txt>. You
366 almost certainly want to compile it as a module so you can restart
367 your AppleTalk stack without rebooting your machine. I hear that
368 the GNU boycott of Apple is over, so even politically correct people
369 are allowed to say Y here.
371 source "drivers/net/appletalk/Kconfig"
374 tristate "DECnet Support"
376 The DECnet networking protocol was used in many products made by
377 Digital (now Compaq). It provides reliable stream and sequenced
378 packet communications over which run a variety of services similar
379 to those which run over TCP/IP.
381 To find some tools to use with the kernel layer support, please
382 look at Patrick Caulfield's web site:
383 <http://linux.dreamtime.org/decnet/>.
385 More detailed documentation is available in
386 <file:Documentation/networking/decnet.txt>.
388 Be sure to say Y to "/proc file system support" and "Sysctl support"
389 below when using DECnet, since you will need sysctl support to aid
390 in configuration at run time.
392 The DECnet code is also available as a module ( = code which can be
393 inserted in and removed from the running kernel whenever you want).
394 The module is called decnet.
396 source "net/decnet/Kconfig"
399 tristate "802.1d Ethernet Bridging"
402 If you say Y here, then your Linux box will be able to act as an
403 Ethernet bridge, which means that the different Ethernet segments it
404 is connected to will appear as one Ethernet to the participants.
405 Several such bridges can work together to create even larger
406 networks of Ethernets using the IEEE 802.1 spanning tree algorithm.
407 As this is a standard, Linux bridges will cooperate properly with
408 other third party bridge products.
410 In order to use the Ethernet bridge, you'll need the bridge
411 configuration tools; see <file:Documentation/networking/bridge.txt>
412 for location. Please read the Bridge mini-HOWTO for more
415 If you enable iptables support along with the bridge support then you
416 turn your bridge into a bridging firewall.
417 iptables will then see the IP packets being bridged, so you need to
418 take this into account when setting up your firewall rules.
420 If you want to compile this code as a module ( = code which can be
421 inserted in and removed from the running kernel whenever you want),
422 say M here and read <file:Documentation/modules.txt>. The module
423 will be called bridge.
427 source "net/bridge/netfilter/Kconfig"
430 tristate "CCITT X.25 Packet Layer (EXPERIMENTAL)"
431 depends on EXPERIMENTAL
433 X.25 is a set of standardized network protocols, similar in scope to
434 frame relay; the one physical line from your box to the X.25 network
435 entry point can carry several logical point-to-point connections
436 (called "virtual circuits") to other computers connected to the X.25
437 network. Governments, banks, and other organizations tend to use it
438 to connect to each other or to form Wide Area Networks (WANs). Many
439 countries have public X.25 networks. X.25 consists of two
440 protocols: the higher level Packet Layer Protocol (PLP) (say Y here
441 if you want that) and the lower level data link layer protocol LAPB
442 (say Y to "LAPB Data Link Driver" below if you want that).
444 You can read more about X.25 at <http://www.sangoma.com/x25.htm> and
445 <http://www.cisco.com/univercd/data/doc/software/11_0/rpcg/cx25.htm>.
446 Information about X.25 for Linux is contained in the files
447 <file:Documentation/networking/x25.txt> and
448 <file:Documentation/networking/x25-iface.txt>.
450 One connects to an X.25 network either with a dedicated network card
451 using the X.21 protocol (not yet supported by Linux) or one can do
452 X.25 over a standard telephone line using an ordinary modem (say Y
453 to "X.25 async driver" below) or over Ethernet using an ordinary
454 Ethernet card and either the 802.2 LLC protocol (say Y to "802.2
455 LLC" below) or LAPB over Ethernet (say Y to "LAPB Data Link Driver"
456 and "LAPB over Ethernet driver" below).
458 If you want to compile this driver as a module ( = code which can be
459 inserted in and removed from the running kernel whenever you want),
460 say M here and read <file:Documentation/modules.txt>. The module
461 will be called x25. If unsure, say N.
464 tristate "LAPB Data Link Driver (EXPERIMENTAL)"
465 depends on EXPERIMENTAL
467 Link Access Procedure, Balanced (LAPB) is the data link layer (i.e.
468 the lower) part of the X.25 protocol. It offers a reliable
469 connection service to exchange data frames with one other host, and
470 it is used to transport higher level protocols (mostly X.25 Packet
471 Layer, the higher part of X.25, but others are possible as well).
472 Usually, LAPB is used with specialized X.21 network cards, but Linux
473 currently supports LAPB only over Ethernet connections. If you want
474 to use LAPB connections over Ethernet, say Y here and to "LAPB over
475 Ethernet driver" below. Read
476 <file:Documentation/networking/lapb-module.txt> for technical
479 If you want to compile this driver as a module though ( = code which
480 can be inserted in and removed from the running kernel whenever you
481 want), say M here and read <file:Documentation/modules.txt>. The
482 module will be called lapb. If unsure, say N.
485 bool "Frame Diverter (EXPERIMENTAL)"
486 depends on EXPERIMENTAL
488 The Frame Diverter allows you to divert packets from the
489 network, that are not aimed at the interface receiving it (in
490 promisc. mode). Typically, a Linux box setup as an Ethernet bridge
491 with the Frames Diverter on, can do some *really* transparent www
492 caching using a Squid proxy for example.
494 This is very useful when you don't want to change your router's
495 config (or if you simply don't have access to it).
497 The other possible usages of diverting Ethernet Frames are
499 - reroute smtp traffic to another interface
500 - traffic-shape certain network streams
501 - transparently proxy smtp connections
504 For more informations, please refer to:
505 <http://diverter.sourceforge.net/>
506 <http://perso.wanadoo.fr/magpie/EtherDivert.html>
511 tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
512 depends on EXPERIMENTAL && INET
514 Econet is a fairly old and slow networking protocol mainly used by
515 Acorn computers to access file and print servers. It uses native
516 Econet network cards. AUN is an implementation of the higher level
517 parts of Econet that runs over ordinary Ethernet connections, on
518 top of the UDP packet protocol, which in turn runs on top of the
519 Internet protocol IP.
521 If you say Y here, you can choose with the next two options whether
522 to send Econet/AUN traffic over a UDP Ethernet connection or over
523 a native Econet network card.
525 This driver is also available as a module ( = code which can be
526 inserted in and removed from the running kernel whenever you want).
527 The module will be called econet. If you want to compile it as a
528 module, say M here and read <file:Documentation/modules.txt>.
534 Say Y here if you want to send Econet/AUN traffic over a UDP
535 connection (UDP is a packet based protocol that runs on top of the
536 Internet protocol IP) using an ordinary Ethernet network card.
542 Say Y here if you have a native Econet network card installed in
546 tristate "WAN router"
547 depends on EXPERIMENTAL
549 Wide Area Networks (WANs), such as X.25, frame relay and leased
550 lines, are used to interconnect Local Area Networks (LANs) over vast
551 distances with data transfer rates significantly higher than those
552 achievable with commonly used asynchronous modem connections.
553 Usually, a quite expensive external device called a `WAN router' is
554 needed to connect to a WAN.
556 As an alternative, WAN routing can be built into the Linux kernel.
557 With relatively inexpensive WAN interface cards available on the
558 market, a perfectly usable router can be built for less than half
559 the price of an external router. If you have one of those cards and
560 wish to use your Linux box as a WAN router, say Y here and also to
561 the WAN driver for your card, below. You will then need the
562 wan-tools package which is available from <ftp://ftp.sangoma.com/>.
563 Read <file:Documentation/networking/wan-router.txt> for more
566 The WAN routing support is also available as a module called
567 wanrouter ( = code which can be inserted in and removed from the
568 running kernel whenever you want). If you want to compile it as a
569 module, say M here and read <file:Documentation/modules.txt>.
574 bool "Fast switching (read help!)"
575 depends on EXPERIMENTAL
577 Saying Y here enables direct NIC-to-NIC (NIC = Network Interface
578 Card) data transfers on the local network, which is fast.
580 IMPORTANT NOTE: This option is NOT COMPATIBLE with "Network packet
581 filtering" (CONFIG_NETFILTER). Say N here if you say Y there.
583 However, it will work with all options in the "Advanced router"
584 section (except for "Use TOS value as routing key" and
585 "Use FWMARK value as routing key").
587 At the moment, few devices support fast switching (tulip is one of
588 them, a modified 8390 driver can be found at
589 <ftp://ftp.inr.ac.ru/ip-routing/fastroute/fastroute-8390.tar.gz>).
593 config NET_HW_FLOWCONTROL
594 bool "Forwarding between high speed interfaces"
595 depends on EXPERIMENTAL
597 This option enables NIC (Network Interface Card) hardware throttling
598 during periods of extremal congestion. At the moment only a couple
599 of device drivers support it (really only one -- tulip, a modified
600 8390 driver can be found at
601 <ftp://ftp.inr.ac.ru/ip-routing/fastroute/fastroute-8390.tar.gz>).
603 Really, this option is applicable to any machine attached to a fast
604 enough network, and even a 10 Mb NIC is able to kill a not very slow
605 box, such as a 120MHz Pentium.
607 However, do not say Y here if you did not experience any serious
611 menu "QoS and/or fair queueing"
614 bool "QoS and/or fair queueing"
616 When the kernel has several packets to send out over a network
617 device, it has to decide which ones to send first, which ones to
618 delay, and which ones to drop. This is the job of the packet
619 scheduler, and several different algorithms for how to do this
620 "fairly" have been proposed.
622 If you say N here, you will get the standard packet scheduler, which
623 is a FIFO (first come, first served). If you say Y here, you will be
624 able to choose from among several alternative algorithms which can
625 then be attached to different network devices. This is useful for
626 example if some of your network devices are real time devices that
627 need a certain minimum data flow rate, or if you need to limit the
628 maximum data flow rate for traffic which matches specified criteria.
629 This code is considered to be experimental.
631 To administer these schedulers, you'll need the user-level utilities
632 from the package iproute2+tc at <ftp://ftp.inr.ac.ru/ip-routing/>.
633 That package also contains some documentation; for more, check out
634 <http://snafu.freedom.org/linux2.2/iproute-notes.html>.
636 This Quality of Service (QoS) support will enable you to use
637 Differentiated Services (diffserv) and Resource Reservation Protocol
638 (RSVP) on your Linux router if you also say Y to "QoS support",
639 "Packet classifier API" and to some classifiers below. Documentation
640 and software is at <http://diffserv.sourceforge.net/>.
642 If you say Y here and to "/proc file system" below, you will be able
643 to read status information about packet schedulers from the file
646 The available schedulers are listed in the following questions; you
647 can say Y to as many as you like. If unsure, say N now.
649 source "net/sched/Kconfig"
651 #bool 'Network code profiler' CONFIG_NET_PROFILE
654 menu "Network testing"
657 tristate "Packet Generator (USE WITH CAUTION)"
659 This module will inject preconfigured packets, at a configurable
660 rate, out of a given interface. It is used for network interface
661 stress testing and performance analysis. If you don't understand
662 what was just said, you don't need it: say N.
664 Documentation on how to use the packet generaor can be found
665 at <file:Documentation/networking/pktgen.txt>.
667 This code is also available as a module called pktgen ( = code
668 which can be inserted in and removed from the running kernel
669 whenever you want). If you want to compile it as a module, say M
670 here and read <file:Documentation/modules.txt>.
676 source "drivers/net/Kconfig"