2 # Network configuration
5 menu "Networking support"
8 bool "Networking support"
10 Unless you really know what you are doing, you should say Y here.
11 The reason is that some programs need kernel networking support even
12 when running on a stand-alone machine that isn't connected to any
13 other computer. If you are upgrading from an older kernel, you
14 should consider updating your networking tools too because changes
15 in the kernel and the tools often go hand in hand. The tools are
16 contained in the package net-tools, the location and version number
17 of which are given in <file:Documentation/Changes>.
19 For a general introduction to Linux networking, it is highly
20 recommended to read the NET-HOWTO, available from
21 <http://www.tldp.org/docs.html#howto>.
23 menu "Networking options"
27 tristate "Packet socket"
29 The Packet protocol is used by applications which communicate
30 directly with network devices without an intermediate network
31 protocol implemented in the kernel, e.g. tcpdump. If you want them
34 To compile this driver as a module, choose M here: the module will
35 be called af_packet. If you use modprobe or kmod, you may also
36 want to add "alias net-pf-17 af_packet" to /etc/modules.conf.
41 bool "Packet socket: mmapped IO"
44 If you say Y here, the Packet protocol driver will use an IO
45 mechanism that results in faster communication.
50 tristate "Netlink device emulation"
52 This option will be removed soon. Any programs that want to use
53 character special nodes like /dev/tap0 or /dev/route (all with major
54 number 36) need this option, and need to be rewritten soon to use
55 the real netlink socket.
56 This is a backward compatibility option, choose Y for now.
59 tristate "Unix domain sockets"
61 If you say Y here, you will include support for Unix domain sockets;
62 sockets are the standard Unix mechanism for establishing and
63 accessing network connections. Many commonly used programs such as
64 the X Window system and syslog use these sockets even if your
65 machine is not connected to any network. Unless you are working on
66 an embedded system or something similar, you therefore definitely
69 To compile this driver as a module, choose M here: the module will be
70 called unix. If you try building this as a module and you have
71 said Y to "Kernel module loader support" above, be sure to add
72 'alias net-pf-1 unix' to your /etc/modules.conf file. Note that
73 several important services won't work correctly if you say M here
74 and then neglect to load the module.
76 Say Y unless you know what you are doing.
79 tristate "PF_KEY sockets"
82 PF_KEYv2 socket family, compatible to KAME ones.
83 They are required if you are going to use IPsec tools ported
86 Say Y unless you know what you are doing.
89 bool "TCP/IP networking"
91 These are the protocols used on the Internet and on most local
92 Ethernets. It is highly recommended to say Y here (this will enlarge
93 your kernel by about 144 KB), since some programs (e.g. the X window
94 system) use TCP/IP even if your machine is not connected to any
95 other computer. You will get the so-called loopback device which
96 allows you to ping yourself (great fun, that!).
98 For an excellent introduction to Linux networking, please read the
99 NET-3-HOWTO, available from
100 <http://www.tldp.org/docs.html#howto>.
102 This option is also necessary if you want to use the full power of
103 term (term is a program which gives you almost full Internet
104 connectivity if you have a regular dial up shell account on some
105 Internet connected Unix computer; for more information, read
106 <http://www.bart.nl/~patrickr/term-howto/Term-HOWTO.html>).
108 If you say Y here and also to "/proc file system support" and
109 "Sysctl support" below, you can change various aspects of the
110 behavior of the TCP/IP code by writing to the (virtual) files in
111 /proc/sys/net/ipv4/*; the options are explained in the file
112 <file:Documentation/networking/ip-sysctl.txt>.
116 source "net/ipv4/Kconfig"
118 # IPv6 as module will cause a CRASH if you try to unload it
120 tristate "The IPv6 protocol (EXPERIMENTAL)"
121 depends on INET && EXPERIMENTAL
123 This is experimental support for the next version of the Internet
124 Protocol: IP version 6 (also called IPng "IP next generation").
125 Features of this new protocol include: expanded address space,
126 authentication and privacy, and seamless interoperability with the
127 current version of IP (IP version 4). For general information about
128 IPv6, see <http://playground.sun.com/pub/ipng/html/ipng-main.html>;
129 for specific information about IPv6 under Linux read the HOWTO at
130 <http://www.bieringer.de/linux/IPv6/> and the file net/ipv6/README
131 in the kernel source.
133 If you want to use IPv6, please upgrade to the newest net-tools as
134 given in <file:Documentation/Changes>. You will still be able to do
135 regular IPv4 networking as well.
137 To compile this protocol support as a module, choose M here: the
138 module will be called ipv6.
140 It is safe to say N here for now.
142 source "net/ipv6/Kconfig"
145 tristate "DECnet Support"
147 The DECnet networking protocol was used in many products made by
148 Digital (now Compaq). It provides reliable stream and sequenced
149 packet communications over which run a variety of services similar
150 to those which run over TCP/IP.
152 To find some tools to use with the kernel layer support, please
153 look at Patrick Caulfield's web site:
154 <http://linux.dreamtime.org/decnet/>.
156 More detailed documentation is available in
157 <file:Documentation/networking/decnet.txt>.
159 Be sure to say Y to "/proc file system support" and "Sysctl support"
160 below when using DECnet, since you will need sysctl support to aid
161 in configuration at run time.
163 The DECnet code is also available as a module ( = code which can be
164 inserted in and removed from the running kernel whenever you want).
165 The module is called decnet.
167 source "net/decnet/Kconfig"
170 tristate "802.1d Ethernet Bridging"
172 If you say Y here, then your Linux box will be able to act as an
173 Ethernet bridge, which means that the different Ethernet segments it
174 is connected to will appear as one Ethernet to the participants.
175 Several such bridges can work together to create even larger
176 networks of Ethernets using the IEEE 802.1 spanning tree algorithm.
177 As this is a standard, Linux bridges will cooperate properly with
178 other third party bridge products.
180 In order to use the Ethernet bridge, you'll need the bridge
181 configuration tools; see <file:Documentation/networking/bridge.txt>
182 for location. Please read the Bridge mini-HOWTO for more
185 If you enable iptables support along with the bridge support then you
186 turn your bridge into a bridging IP firewall.
187 iptables will then see the IP packets being bridged, so you need to
188 take this into account when setting up your firewall rules.
189 Enabling arptables support when bridging will let arptables see
190 bridged ARP traffic in the arptables FORWARD chain.
192 To compile this code as a module, choose M here: the module
193 will be called bridge.
198 bool "Network packet filtering (replaces ipchains)"
200 Netfilter is a framework for filtering and mangling network packets
201 that pass through your Linux box.
203 The most common use of packet filtering is to run your Linux box as
204 a firewall protecting a local network from the Internet. The type of
205 firewall provided by this kernel support is called a "packet
206 filter", which means that it can reject individual network packets
207 based on type, source, destination etc. The other kind of firewall,
208 a "proxy-based" one, is more secure but more intrusive and more
209 bothersome to set up; it inspects the network traffic much more
210 closely, modifies it and has knowledge about the higher level
211 protocols, which a packet filter lacks. Moreover, proxy-based
212 firewalls often require changes to the programs running on the local
213 clients. Proxy-based firewalls don't need support by the kernel, but
214 they are often combined with a packet filter, which only works if
217 You should also say Y here if you intend to use your Linux box as
218 the gateway to the Internet for a local network of machines without
219 globally valid IP addresses. This is called "masquerading": if one
220 of the computers on your local network wants to send something to
221 the outside, your box can "masquerade" as that computer, i.e. it
222 forwards the traffic to the intended outside destination, but
223 modifies the packets to make it look like they came from the
224 firewall box itself. It works both ways: if the outside host
225 replies, the Linux box will silently forward the traffic to the
226 correct local computer. This way, the computers on your local net
227 are completely invisible to the outside world, even though they can
228 reach the outside and can receive replies. It is even possible to
229 run globally visible servers from within a masqueraded local network
230 using a mechanism called portforwarding. Masquerading is also often
231 called NAT (Network Address Translation).
233 Another use of Netfilter is in transparent proxying: if a machine on
234 the local network tries to connect to an outside host, your Linux
235 box can transparently forward the traffic to a local server,
236 typically a caching proxy server.
238 Yet another use of Netfilter is building a bridging firewall. Using
239 a bridge with Network packet filtering enabled makes iptables "see"
240 the bridged traffic. For filtering on the lower network and Ethernet
241 protocols over the bridge, use ebtables (under bridge netfilter
244 Various modules exist for netfilter which replace the previous
245 masquerading (ipmasqadm), packet filtering (ipchains), transparent
246 proxying, and portforwarding mechanisms. Please see
247 <file:Documentation/Changes> under "iptables" for the location of
250 Make sure to say N to "Fast switching" below if you intend to say Y
251 here, as Fast switching currently bypasses netfilter.
253 Chances are that you should say Y here if you compile a kernel which
254 will run as a router and N for regular hosts. If unsure, say N.
258 config NETFILTER_DEBUG
259 bool "Network packet filtering debugging"
262 You can say Y here if you want to get additional messages useful in
263 debugging the netfilter code.
265 config BRIDGE_NETFILTER
266 bool "Bridged IP/ARP packets filtering"
267 depends on BRIDGE && NETFILTER && INET
270 Enabling this option will let arptables resp. iptables see bridged
271 ARP resp. IP traffic. If you want a bridging firewall, you probably
272 want this option enabled.
273 Enabling or disabling this option doesn't enable or disable
278 source "net/ipv4/netfilter/Kconfig"
279 source "net/ipv6/netfilter/Kconfig"
280 source "net/decnet/netfilter/Kconfig"
281 source "net/bridge/netfilter/Kconfig"
285 source "net/xfrm/Kconfig"
287 source "net/sctp/Kconfig"
290 tristate "Asynchronous Transfer Mode (ATM) (EXPERIMENTAL)"
291 depends on EXPERIMENTAL
293 ATM is a high-speed networking technology for Local Area Networks
294 and Wide Area Networks. It uses a fixed packet size and is
295 connection oriented, allowing for the negotiation of minimum
296 bandwidth requirements.
298 In order to participate in an ATM network, your Linux box needs an
299 ATM networking card. If you have that, say Y here and to the driver
300 of your ATM card below.
302 Note that you need a set of user-space programs to actually make use
303 of ATM. See the file <file:Documentation/networking/atm.txt> for
307 tristate "Classical IP over ATM (EXPERIMENTAL)"
308 depends on ATM && INET
310 Classical IP over ATM for PVCs and SVCs, supporting InARP and
311 ATMARP. If you want to communication with other IP hosts on your ATM
312 network, you will typically either say Y here or to "LAN Emulation
315 config ATM_CLIP_NO_ICMP
316 bool "Do NOT send ICMP if no neighbour (EXPERIMENTAL)"
319 Normally, an "ICMP host unreachable" message is sent if a neighbour
320 cannot be reached because there is no VC to it in the kernel's
321 ATMARP table. This may cause problems when ATMARP table entries are
322 briefly removed during revalidation. If you say Y here, packets to
323 such neighbours are silently discarded instead.
326 tristate "LAN Emulation (LANE) support (EXPERIMENTAL)"
329 LAN Emulation emulates services of existing LANs across an ATM
330 network. Besides operating as a normal ATM end station client, Linux
331 LANE client can also act as an proxy client bridging packets between
332 ELAN and Ethernet segments. You need LANE if you want to try MPOA.
335 tristate "Multi-Protocol Over ATM (MPOA) support (EXPERIMENTAL)"
336 depends on ATM && INET && ATM_LANE!=n
338 Multi-Protocol Over ATM allows ATM edge devices such as routers,
339 bridges and ATM attached hosts establish direct ATM VCs across
340 subnetwork boundaries. These shortcut connections bypass routers
341 enhancing overall network performance.
344 tristate "RFC1483/2684 Bridged protocols"
345 depends on ATM && INET
347 ATM PVCs can carry ethernet PDUs according to rfc2684 (formerly 1483)
348 This device will act like an ethernet from the kernels point of view,
349 with the traffic being carried by ATM PVCs (currently 1 PVC/device).
350 This is sometimes used over DSL lines. If in doubt, say N.
352 config ATM_BR2684_IPFILTER
353 bool "Per-VC IP filter kludge"
354 depends on ATM_BR2684
356 This is an experimental mechanism for users who need to terminating a
357 large number of IP-only vcc's. Do not enable this unless you are sure
358 you know what you are doing.
361 tristate "802.1Q VLAN Support"
363 source "net/llc/Kconfig"
366 tristate "The IPX protocol"
369 This is support for the Novell networking protocol, IPX, commonly
370 used for local networks of Windows machines. You need it if you
371 want to access Novell NetWare file or print servers using the Linux
372 Novell client ncpfs (available from
373 <ftp://platan.vc.cvut.cz/pub/linux/ncpfs/>) or from
374 within the Linux DOS emulator DOSEMU (read the DOSEMU-HOWTO,
375 available from <http://www.tldp.org/docs.html#howto>). In order
376 to do the former, you'll also have to say Y to "NCP file system
379 IPX is similar in scope to IP, while SPX, which runs on top of IPX,
380 is similar to TCP. There is also experimental support for SPX in
381 Linux (see "SPX networking", below).
383 To turn your Linux box into a fully featured NetWare file server and
384 IPX router, say Y here and fetch either lwared from
385 <ftp://ibiblio.org/pub/Linux/system/network/daemons/> or
386 mars_nwe from <ftp://www.compu-art.de/mars_nwe/>. For more
387 information, read the IPX-HOWTO available from
388 <http://www.tldp.org/docs.html#howto>.
390 General information about how to connect Linux, Windows machines and
391 Macs is on the WWW at <http://www.eats.com/linux_mac_win.html>.
393 The IPX driver would enlarge your kernel by about 16 KB. To compile
394 this driver as a module, choose M here: the module will be called ipx.
395 Unless you want to integrate your Linux box with a local Novell
398 source "net/ipx/Kconfig"
401 tristate "Appletalk protocol support"
404 AppleTalk is the protocol that Apple computers can use to communicate
405 on a network. If your Linux box is connected to such a network and you
406 wish to connect to it, say Y. You will need to use the netatalk package
407 so that your Linux box can act as a print and file server for Macs as
408 well as access AppleTalk printers. Check out
409 <http://www.zettabyte.net/netatalk/> on the WWW for details.
410 EtherTalk is the name used for AppleTalk over Ethernet and the
411 cheaper and slower LocalTalk is AppleTalk over a proprietary Apple
412 network using serial links. EtherTalk and LocalTalk are fully
415 General information about how to connect Linux, Windows machines and
416 Macs is on the WWW at <http://www.eats.com/linux_mac_win.html>. The
417 NET-3-HOWTO, available from
418 <http://www.tldp.org/docs.html#howto>, contains valuable
421 To compile this driver as a module, choose M here: the module will be
422 called appletalk. You almost certainly want to compile it as a
423 module so you can restart your AppleTalk stack without rebooting
424 your machine. I hear that the GNU boycott of Apple is over, so
425 even politically correct people are allowed to say Y here.
427 source "drivers/net/appletalk/Kconfig"
430 tristate "CCITT X.25 Packet Layer (EXPERIMENTAL)"
431 depends on EXPERIMENTAL
433 X.25 is a set of standardized network protocols, similar in scope to
434 frame relay; the one physical line from your box to the X.25 network
435 entry point can carry several logical point-to-point connections
436 (called "virtual circuits") to other computers connected to the X.25
437 network. Governments, banks, and other organizations tend to use it
438 to connect to each other or to form Wide Area Networks (WANs). Many
439 countries have public X.25 networks. X.25 consists of two
440 protocols: the higher level Packet Layer Protocol (PLP) (say Y here
441 if you want that) and the lower level data link layer protocol LAPB
442 (say Y to "LAPB Data Link Driver" below if you want that).
444 You can read more about X.25 at <http://www.sangoma.com/x25.htm> and
445 <http://www.cisco.com/univercd/data/doc/software/11_0/rpcg/cx25.htm>.
446 Information about X.25 for Linux is contained in the files
447 <file:Documentation/networking/x25.txt> and
448 <file:Documentation/networking/x25-iface.txt>.
450 One connects to an X.25 network either with a dedicated network card
451 using the X.21 protocol (not yet supported by Linux) or one can do
452 X.25 over a standard telephone line using an ordinary modem (say Y
453 to "X.25 async driver" below) or over Ethernet using an ordinary
454 Ethernet card and the LAPB over Ethernet (say Y to "LAPB Data Link
455 Driver" and "LAPB over Ethernet driver" below).
457 To compile this driver as a module, choose M here: the module
458 will be called x25. If unsure, say N.
461 tristate "LAPB Data Link Driver (EXPERIMENTAL)"
462 depends on EXPERIMENTAL
464 Link Access Procedure, Balanced (LAPB) is the data link layer (i.e.
465 the lower) part of the X.25 protocol. It offers a reliable
466 connection service to exchange data frames with one other host, and
467 it is used to transport higher level protocols (mostly X.25 Packet
468 Layer, the higher part of X.25, but others are possible as well).
469 Usually, LAPB is used with specialized X.21 network cards, but Linux
470 currently supports LAPB only over Ethernet connections. If you want
471 to use LAPB connections over Ethernet, say Y here and to "LAPB over
472 Ethernet driver" below. Read
473 <file:Documentation/networking/lapb-module.txt> for technical
476 To compile this driver as a module, choose M here: the
477 module will be called lapb. If unsure, say N.
480 bool "Frame Diverter (EXPERIMENTAL)"
481 depends on EXPERIMENTAL
483 The Frame Diverter allows you to divert packets from the
484 network, that are not aimed at the interface receiving it (in
485 promisc. mode). Typically, a Linux box setup as an Ethernet bridge
486 with the Frames Diverter on, can do some *really* transparent www
487 caching using a Squid proxy for example.
489 This is very useful when you don't want to change your router's
490 config (or if you simply don't have access to it).
492 The other possible usages of diverting Ethernet Frames are
494 - reroute smtp traffic to another interface
495 - traffic-shape certain network streams
496 - transparently proxy smtp connections
499 For more informations, please refer to:
500 <http://diverter.sourceforge.net/>
501 <http://perso.wanadoo.fr/magpie/EtherDivert.html>
506 tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
507 depends on EXPERIMENTAL && INET
509 Econet is a fairly old and slow networking protocol mainly used by
510 Acorn computers to access file and print servers. It uses native
511 Econet network cards. AUN is an implementation of the higher level
512 parts of Econet that runs over ordinary Ethernet connections, on
513 top of the UDP packet protocol, which in turn runs on top of the
514 Internet protocol IP.
516 If you say Y here, you can choose with the next two options whether
517 to send Econet/AUN traffic over a UDP Ethernet connection or over
518 a native Econet network card.
520 To compile this driver as a module, choose M here: the module
521 will be called econet.
527 Say Y here if you want to send Econet/AUN traffic over a UDP
528 connection (UDP is a packet based protocol that runs on top of the
529 Internet protocol IP) using an ordinary Ethernet network card.
535 Say Y here if you have a native Econet network card installed in
539 tristate "WAN router"
540 depends on EXPERIMENTAL
542 Wide Area Networks (WANs), such as X.25, frame relay and leased
543 lines, are used to interconnect Local Area Networks (LANs) over vast
544 distances with data transfer rates significantly higher than those
545 achievable with commonly used asynchronous modem connections.
546 Usually, a quite expensive external device called a `WAN router' is
547 needed to connect to a WAN.
549 As an alternative, WAN routing can be built into the Linux kernel.
550 With relatively inexpensive WAN interface cards available on the
551 market, a perfectly usable router can be built for less than half
552 the price of an external router. If you have one of those cards and
553 wish to use your Linux box as a WAN router, say Y here and also to
554 the WAN driver for your card, below. You will then need the
555 wan-tools package which is available from <ftp://ftp.sangoma.com/>.
556 Read <file:Documentation/networking/wan-router.txt> for more
559 To compile WAN routing support as a module, choose M here: the
560 module will be called wanrouter.
565 bool "Fast switching (read help!)"
566 depends on EXPERIMENTAL
568 Saying Y here enables direct NIC-to-NIC (NIC = Network Interface
569 Card) data transfers on the local network, which is fast.
571 IMPORTANT NOTE: This option is NOT COMPATIBLE with "Network packet
572 filtering" (CONFIG_NETFILTER). Say N here if you say Y there.
574 However, it will work with all options in the "Advanced router"
575 section (except for "Use TOS value as routing key" and
576 "Use FWMARK value as routing key").
578 At the moment, few devices support fast switching (tulip is one of
579 them, a modified 8390 driver can be found at
580 <ftp://ftp.inr.ac.ru/ip-routing/fastroute/fastroute-8390.tar.gz>).
584 config NET_HW_FLOWCONTROL
585 bool "Forwarding between high speed interfaces"
586 depends on EXPERIMENTAL
588 This option enables NIC (Network Interface Card) hardware throttling
589 during periods of extreme congestion. At the moment only a couple
590 of device drivers support it (really only one -- tulip, a modified
591 8390 driver can be found at
592 <ftp://ftp.inr.ac.ru/ip-routing/fastroute/fastroute-8390.tar.gz>).
594 Really, this option is applicable to any machine attached to a fast
595 enough network, and even a 10 Mb NIC is able to kill a not very slow
596 box, such as a 120MHz Pentium.
598 However, do not say Y here if you did not experience any serious
602 menu "QoS and/or fair queueing"
605 bool "QoS and/or fair queueing"
607 When the kernel has several packets to send out over a network
608 device, it has to decide which ones to send first, which ones to
609 delay, and which ones to drop. This is the job of the packet
610 scheduler, and several different algorithms for how to do this
611 "fairly" have been proposed.
613 If you say N here, you will get the standard packet scheduler, which
614 is a FIFO (first come, first served). If you say Y here, you will be
615 able to choose from among several alternative algorithms which can
616 then be attached to different network devices. This is useful for
617 example if some of your network devices are real time devices that
618 need a certain minimum data flow rate, or if you need to limit the
619 maximum data flow rate for traffic which matches specified criteria.
620 This code is considered to be experimental.
622 To administer these schedulers, you'll need the user-level utilities
623 from the package iproute2+tc at <ftp://ftp.inr.ac.ru/ip-routing/>.
624 That package also contains some documentation; for more, check out
625 <http://snafu.freedom.org/linux2.2/iproute-notes.html>.
627 This Quality of Service (QoS) support will enable you to use
628 Differentiated Services (diffserv) and Resource Reservation Protocol
629 (RSVP) on your Linux router if you also say Y to "QoS support",
630 "Packet classifier API" and to some classifiers below. Documentation
631 and software is at <http://diffserv.sourceforge.net/>.
633 If you say Y here and to "/proc file system" below, you will be able
634 to read status information about packet schedulers from the file
637 The available schedulers are listed in the following questions; you
638 can say Y to as many as you like. If unsure, say N now.
640 source "net/sched/Kconfig"
644 menu "Network testing"
647 tristate "Packet Generator (USE WITH CAUTION)"
650 This module will inject preconfigured packets, at a configurable
651 rate, out of a given interface. It is used for network interface
652 stress testing and performance analysis. If you don't understand
653 what was just said, you don't need it: say N.
655 Documentation on how to use the packet generaor can be found
656 at <file:Documentation/networking/pktgen.txt>.
658 To compile this code as a module, choose M here: the
659 module will be called pktgen.
665 source "drivers/net/Kconfig"
667 source "net/ax25/Kconfig"
669 source "net/irda/Kconfig"
671 source "net/bluetooth/Kconfig"