2 # Network configuration
5 menu "Networking support"
8 bool "Networking support"
10 Unless you really know what you are doing, you should say Y here.
11 The reason is that some programs need kernel networking support even
12 when running on a stand-alone machine that isn't connected to any
13 other computer. If you are upgrading from an older kernel, you
14 should consider updating your networking tools too because changes
15 in the kernel and the tools often go hand in hand. The tools are
16 contained in the package net-tools, the location and version number
17 of which are given in <file:Documentation/Changes>.
19 For a general introduction to Linux networking, it is highly
20 recommended to read the NET-HOWTO, available from
21 <http://www.tldp.org/docs.html#howto>.
23 menu "Networking options"
27 tristate "Packet socket"
29 The Packet protocol is used by applications which communicate
30 directly with network devices without an intermediate network
31 protocol implemented in the kernel, e.g. tcpdump. If you want them
34 To compile this driver as a module, choose M here: the module will
40 bool "Packet socket: mmapped IO"
43 If you say Y here, the Packet protocol driver will use an IO
44 mechanism that results in faster communication.
49 tristate "Netlink device emulation"
51 This option will be removed soon. Any programs that want to use
52 character special nodes like /dev/tap0 or /dev/route (all with major
53 number 36) need this option, and need to be rewritten soon to use
54 the real netlink socket.
55 This is a backward compatibility option, choose Y for now.
58 tristate "Unix domain sockets"
60 If you say Y here, you will include support for Unix domain sockets;
61 sockets are the standard Unix mechanism for establishing and
62 accessing network connections. Many commonly used programs such as
63 the X Window system and syslog use these sockets even if your
64 machine is not connected to any network. Unless you are working on
65 an embedded system or something similar, you therefore definitely
68 To compile this driver as a module, choose M here: the module will be
69 called unix. Note that several important services won't work
70 correctly if you say M here and then neglect to load the module.
72 Say Y unless you know what you are doing.
75 tristate "PF_KEY sockets"
78 PF_KEYv2 socket family, compatible to KAME ones.
79 They are required if you are going to use IPsec tools ported
82 Say Y unless you know what you are doing.
85 bool "TCP/IP networking"
87 These are the protocols used on the Internet and on most local
88 Ethernets. It is highly recommended to say Y here (this will enlarge
89 your kernel by about 144 KB), since some programs (e.g. the X window
90 system) use TCP/IP even if your machine is not connected to any
91 other computer. You will get the so-called loopback device which
92 allows you to ping yourself (great fun, that!).
94 For an excellent introduction to Linux networking, please read the
95 Linux Networking HOWTO, available from
96 <http://www.tldp.org/docs.html#howto>.
98 If you say Y here and also to "/proc file system support" and
99 "Sysctl support" below, you can change various aspects of the
100 behavior of the TCP/IP code by writing to the (virtual) files in
101 /proc/sys/net/ipv4/*; the options are explained in the file
102 <file:Documentation/networking/ip-sysctl.txt>.
106 source "net/ipv4/Kconfig"
108 # IPv6 as module will cause a CRASH if you try to unload it
110 tristate "The IPv6 protocol (EXPERIMENTAL)"
111 depends on INET && EXPERIMENTAL
112 select CRYPTO if IPV6_PRIVACY
113 select CRYPTO_MD5 if IPV6_PRIVACY
115 This is experimental support for the IP version 6 (formerly called
116 IPng "IP next generation"). You will still be able to do
117 regular IPv4 networking as well.
119 Features of this new protocol include: expanded address space,
120 authentication and privacy, and seamless interoperability with the
121 current version of IP (IP version 4). For general information about
122 IPv6, see <http://playground.sun.com/pub/ipng/html/ipng-main.html>;
123 for specific information about IPv6 under Linux read the HOWTO at
124 <http://www.bieringer.de/linux/IPv6/> and the file net/ipv6/README
125 in the kernel source.
127 To compile this protocol support as a module, choose M here: the
128 module will be called ipv6.
130 It is safe to say N here for now.
132 source "net/ipv6/Kconfig"
135 bool "Network packet filtering (replaces ipchains)"
137 Netfilter is a framework for filtering and mangling network packets
138 that pass through your Linux box.
140 The most common use of packet filtering is to run your Linux box as
141 a firewall protecting a local network from the Internet. The type of
142 firewall provided by this kernel support is called a "packet
143 filter", which means that it can reject individual network packets
144 based on type, source, destination etc. The other kind of firewall,
145 a "proxy-based" one, is more secure but more intrusive and more
146 bothersome to set up; it inspects the network traffic much more
147 closely, modifies it and has knowledge about the higher level
148 protocols, which a packet filter lacks. Moreover, proxy-based
149 firewalls often require changes to the programs running on the local
150 clients. Proxy-based firewalls don't need support by the kernel, but
151 they are often combined with a packet filter, which only works if
154 You should also say Y here if you intend to use your Linux box as
155 the gateway to the Internet for a local network of machines without
156 globally valid IP addresses. This is called "masquerading": if one
157 of the computers on your local network wants to send something to
158 the outside, your box can "masquerade" as that computer, i.e. it
159 forwards the traffic to the intended outside destination, but
160 modifies the packets to make it look like they came from the
161 firewall box itself. It works both ways: if the outside host
162 replies, the Linux box will silently forward the traffic to the
163 correct local computer. This way, the computers on your local net
164 are completely invisible to the outside world, even though they can
165 reach the outside and can receive replies. It is even possible to
166 run globally visible servers from within a masqueraded local network
167 using a mechanism called portforwarding. Masquerading is also often
168 called NAT (Network Address Translation).
170 Another use of Netfilter is in transparent proxying: if a machine on
171 the local network tries to connect to an outside host, your Linux
172 box can transparently forward the traffic to a local server,
173 typically a caching proxy server.
175 Yet another use of Netfilter is building a bridging firewall. Using
176 a bridge with Network packet filtering enabled makes iptables "see"
177 the bridged traffic. For filtering on the lower network and Ethernet
178 protocols over the bridge, use ebtables (under bridge netfilter
181 Various modules exist for netfilter which replace the previous
182 masquerading (ipmasqadm), packet filtering (ipchains), transparent
183 proxying, and portforwarding mechanisms. Please see
184 <file:Documentation/Changes> under "iptables" for the location of
187 Make sure to say N to "Fast switching" below if you intend to say Y
188 here, as Fast switching currently bypasses netfilter.
190 Chances are that you should say Y here if you compile a kernel which
191 will run as a router and N for regular hosts. If unsure, say N.
195 config NETFILTER_DEBUG
196 bool "Network packet filtering debugging"
199 You can say Y here if you want to get additional messages useful in
200 debugging the netfilter code.
202 config BRIDGE_NETFILTER
203 bool "Bridged IP/ARP packets filtering"
204 depends on BRIDGE && NETFILTER && INET
207 Enabling this option will let arptables resp. iptables see bridged
208 ARP resp. IP traffic. If you want a bridging firewall, you probably
209 want this option enabled.
210 Enabling or disabling this option doesn't enable or disable
215 source "net/ipv4/netfilter/Kconfig"
216 source "net/ipv6/netfilter/Kconfig"
217 source "net/decnet/netfilter/Kconfig"
218 source "net/bridge/netfilter/Kconfig"
221 tristate "PlanetLab Virtualized NETwork access"
222 depends on IP_NF_CONNTRACK
224 VNET associates IP connections with VServer virtual contexts
225 and ensures that unprivileged contexts can receive only packets
226 related to connections initiated by, or bound to, sockets
227 created in their contexts.
229 For now, enabling or disabling this option does not compile
230 the driver or activate any non-default code paths. Compile
231 and load the VNET module separately.
237 source "net/xfrm/Kconfig"
239 source "net/sctp/Kconfig"
242 tristate "Asynchronous Transfer Mode (ATM) (EXPERIMENTAL)"
243 depends on EXPERIMENTAL
245 ATM is a high-speed networking technology for Local Area Networks
246 and Wide Area Networks. It uses a fixed packet size and is
247 connection oriented, allowing for the negotiation of minimum
248 bandwidth requirements.
250 In order to participate in an ATM network, your Linux box needs an
251 ATM networking card. If you have that, say Y here and to the driver
252 of your ATM card below.
254 Note that you need a set of user-space programs to actually make use
255 of ATM. See the file <file:Documentation/networking/atm.txt> for
259 tristate "Classical IP over ATM (EXPERIMENTAL)"
260 depends on ATM && INET
262 Classical IP over ATM for PVCs and SVCs, supporting InARP and
263 ATMARP. If you want to communication with other IP hosts on your ATM
264 network, you will typically either say Y here or to "LAN Emulation
267 config ATM_CLIP_NO_ICMP
268 bool "Do NOT send ICMP if no neighbour (EXPERIMENTAL)"
271 Normally, an "ICMP host unreachable" message is sent if a neighbour
272 cannot be reached because there is no VC to it in the kernel's
273 ATMARP table. This may cause problems when ATMARP table entries are
274 briefly removed during revalidation. If you say Y here, packets to
275 such neighbours are silently discarded instead.
278 tristate "LAN Emulation (LANE) support (EXPERIMENTAL)"
281 LAN Emulation emulates services of existing LANs across an ATM
282 network. Besides operating as a normal ATM end station client, Linux
283 LANE client can also act as an proxy client bridging packets between
284 ELAN and Ethernet segments. You need LANE if you want to try MPOA.
287 tristate "Multi-Protocol Over ATM (MPOA) support (EXPERIMENTAL)"
288 depends on ATM && INET && ATM_LANE!=n
290 Multi-Protocol Over ATM allows ATM edge devices such as routers,
291 bridges and ATM attached hosts establish direct ATM VCs across
292 subnetwork boundaries. These shortcut connections bypass routers
293 enhancing overall network performance.
296 tristate "RFC1483/2684 Bridged protocols"
297 depends on ATM && INET
299 ATM PVCs can carry ethernet PDUs according to rfc2684 (formerly 1483)
300 This device will act like an ethernet from the kernels point of view,
301 with the traffic being carried by ATM PVCs (currently 1 PVC/device).
302 This is sometimes used over DSL lines. If in doubt, say N.
304 config ATM_BR2684_IPFILTER
305 bool "Per-VC IP filter kludge"
306 depends on ATM_BR2684
308 This is an experimental mechanism for users who need to terminating a
309 large number of IP-only vcc's. Do not enable this unless you are sure
310 you know what you are doing.
313 tristate "802.1d Ethernet Bridging"
315 If you say Y here, then your Linux box will be able to act as an
316 Ethernet bridge, which means that the different Ethernet segments it
317 is connected to will appear as one Ethernet to the participants.
318 Several such bridges can work together to create even larger
319 networks of Ethernets using the IEEE 802.1 spanning tree algorithm.
320 As this is a standard, Linux bridges will cooperate properly with
321 other third party bridge products.
323 In order to use the Ethernet bridge, you'll need the bridge
324 configuration tools; see <file:Documentation/networking/bridge.txt>
325 for location. Please read the Bridge mini-HOWTO for more
328 If you enable iptables support along with the bridge support then you
329 turn your bridge into a bridging IP firewall.
330 iptables will then see the IP packets being bridged, so you need to
331 take this into account when setting up your firewall rules.
332 Enabling arptables support when bridging will let arptables see
333 bridged ARP traffic in the arptables FORWARD chain.
335 To compile this code as a module, choose M here: the module
336 will be called bridge.
341 tristate "802.1Q VLAN Support"
343 Select this and you will be able to create 802.1Q VLAN interfaces
344 on your ethernet interfaces. 802.1Q VLAN supports almost
345 everything a regular ethernet interface does, including
346 firewalling, bridging, and of course IP traffic. You will need
347 the 'vconfig' tool from the VLAN project in order to effectively
348 use VLANs. See the VLAN web page for more information:
349 <http://www.candelatech.com/~greear/vlan.html>
351 To compile this code as a module, choose M here: the module
352 will be called 8021q.
357 tristate "DECnet Support"
359 The DECnet networking protocol was used in many products made by
360 Digital (now Compaq). It provides reliable stream and sequenced
361 packet communications over which run a variety of services similar
362 to those which run over TCP/IP.
364 To find some tools to use with the kernel layer support, please
365 look at Patrick Caulfield's web site:
366 <http://linux-decnet.sourceforge.net/>.
368 More detailed documentation is available in
369 <file:Documentation/networking/decnet.txt>.
371 Be sure to say Y to "/proc file system support" and "Sysctl support"
372 below when using DECnet, since you will need sysctl support to aid
373 in configuration at run time.
375 The DECnet code is also available as a module ( = code which can be
376 inserted in and removed from the running kernel whenever you want).
377 The module is called decnet.
379 source "net/decnet/Kconfig"
381 source "net/llc/Kconfig"
384 tristate "The IPX protocol"
387 This is support for the Novell networking protocol, IPX, commonly
388 used for local networks of Windows machines. You need it if you
389 want to access Novell NetWare file or print servers using the Linux
390 Novell client ncpfs (available from
391 <ftp://platan.vc.cvut.cz/pub/linux/ncpfs/>) or from
392 within the Linux DOS emulator DOSEMU (read the DOSEMU-HOWTO,
393 available from <http://www.tldp.org/docs.html#howto>). In order
394 to do the former, you'll also have to say Y to "NCP file system
397 IPX is similar in scope to IP, while SPX, which runs on top of IPX,
398 is similar to TCP. There is also experimental support for SPX in
399 Linux (see "SPX networking", below).
401 To turn your Linux box into a fully featured NetWare file server and
402 IPX router, say Y here and fetch either lwared from
403 <ftp://ibiblio.org/pub/Linux/system/network/daemons/> or
404 mars_nwe from <ftp://www.compu-art.de/mars_nwe/>. For more
405 information, read the IPX-HOWTO available from
406 <http://www.tldp.org/docs.html#howto>.
408 General information about how to connect Linux, Windows machines and
409 Macs is on the WWW at <http://www.eats.com/linux_mac_win.html>.
411 The IPX driver would enlarge your kernel by about 16 KB. To compile
412 this driver as a module, choose M here: the module will be called ipx.
413 Unless you want to integrate your Linux box with a local Novell
416 source "net/ipx/Kconfig"
419 tristate "Appletalk protocol support"
422 AppleTalk is the protocol that Apple computers can use to communicate
423 on a network. If your Linux box is connected to such a network and you
424 wish to connect to it, say Y. You will need to use the netatalk package
425 so that your Linux box can act as a print and file server for Macs as
426 well as access AppleTalk printers. Check out
427 <http://www.zettabyte.net/netatalk/> on the WWW for details.
428 EtherTalk is the name used for AppleTalk over Ethernet and the
429 cheaper and slower LocalTalk is AppleTalk over a proprietary Apple
430 network using serial links. EtherTalk and LocalTalk are fully
433 General information about how to connect Linux, Windows machines and
434 Macs is on the WWW at <http://www.eats.com/linux_mac_win.html>. The
435 NET-3-HOWTO, available from
436 <http://www.tldp.org/docs.html#howto>, contains valuable
439 To compile this driver as a module, choose M here: the module will be
440 called appletalk. You almost certainly want to compile it as a
441 module so you can restart your AppleTalk stack without rebooting
442 your machine. I hear that the GNU boycott of Apple is over, so
443 even politically correct people are allowed to say Y here.
445 source "drivers/net/appletalk/Kconfig"
448 tristate "CCITT X.25 Packet Layer (EXPERIMENTAL)"
449 depends on EXPERIMENTAL
451 X.25 is a set of standardized network protocols, similar in scope to
452 frame relay; the one physical line from your box to the X.25 network
453 entry point can carry several logical point-to-point connections
454 (called "virtual circuits") to other computers connected to the X.25
455 network. Governments, banks, and other organizations tend to use it
456 to connect to each other or to form Wide Area Networks (WANs). Many
457 countries have public X.25 networks. X.25 consists of two
458 protocols: the higher level Packet Layer Protocol (PLP) (say Y here
459 if you want that) and the lower level data link layer protocol LAPB
460 (say Y to "LAPB Data Link Driver" below if you want that).
462 You can read more about X.25 at <http://www.sangoma.com/x25.htm> and
463 <http://www.cisco.com/univercd/cc/td/doc/product/software/ios11/cbook/cx25.htm>.
464 Information about X.25 for Linux is contained in the files
465 <file:Documentation/networking/x25.txt> and
466 <file:Documentation/networking/x25-iface.txt>.
468 One connects to an X.25 network either with a dedicated network card
469 using the X.21 protocol (not yet supported by Linux) or one can do
470 X.25 over a standard telephone line using an ordinary modem (say Y
471 to "X.25 async driver" below) or over Ethernet using an ordinary
472 Ethernet card and the LAPB over Ethernet (say Y to "LAPB Data Link
473 Driver" and "LAPB over Ethernet driver" below).
475 To compile this driver as a module, choose M here: the module
476 will be called x25. If unsure, say N.
479 tristate "LAPB Data Link Driver (EXPERIMENTAL)"
480 depends on EXPERIMENTAL
482 Link Access Procedure, Balanced (LAPB) is the data link layer (i.e.
483 the lower) part of the X.25 protocol. It offers a reliable
484 connection service to exchange data frames with one other host, and
485 it is used to transport higher level protocols (mostly X.25 Packet
486 Layer, the higher part of X.25, but others are possible as well).
487 Usually, LAPB is used with specialized X.21 network cards, but Linux
488 currently supports LAPB only over Ethernet connections. If you want
489 to use LAPB connections over Ethernet, say Y here and to "LAPB over
490 Ethernet driver" below. Read
491 <file:Documentation/networking/lapb-module.txt> for technical
494 To compile this driver as a module, choose M here: the
495 module will be called lapb. If unsure, say N.
498 bool "Frame Diverter (EXPERIMENTAL)"
499 depends on EXPERIMENTAL
501 The Frame Diverter allows you to divert packets from the
502 network, that are not aimed at the interface receiving it (in
503 promisc. mode). Typically, a Linux box setup as an Ethernet bridge
504 with the Frames Diverter on, can do some *really* transparent www
505 caching using a Squid proxy for example.
507 This is very useful when you don't want to change your router's
508 config (or if you simply don't have access to it).
510 The other possible usages of diverting Ethernet Frames are
512 - reroute smtp traffic to another interface
513 - traffic-shape certain network streams
514 - transparently proxy smtp connections
517 For more informations, please refer to:
518 <http://diverter.sourceforge.net/>
519 <http://perso.wanadoo.fr/magpie/EtherDivert.html>
524 tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
525 depends on EXPERIMENTAL && INET
527 Econet is a fairly old and slow networking protocol mainly used by
528 Acorn computers to access file and print servers. It uses native
529 Econet network cards. AUN is an implementation of the higher level
530 parts of Econet that runs over ordinary Ethernet connections, on
531 top of the UDP packet protocol, which in turn runs on top of the
532 Internet protocol IP.
534 If you say Y here, you can choose with the next two options whether
535 to send Econet/AUN traffic over a UDP Ethernet connection or over
536 a native Econet network card.
538 To compile this driver as a module, choose M here: the module
539 will be called econet.
545 Say Y here if you want to send Econet/AUN traffic over a UDP
546 connection (UDP is a packet based protocol that runs on top of the
547 Internet protocol IP) using an ordinary Ethernet network card.
553 Say Y here if you have a native Econet network card installed in
557 tristate "WAN router"
558 depends on EXPERIMENTAL
560 Wide Area Networks (WANs), such as X.25, frame relay and leased
561 lines, are used to interconnect Local Area Networks (LANs) over vast
562 distances with data transfer rates significantly higher than those
563 achievable with commonly used asynchronous modem connections.
564 Usually, a quite expensive external device called a `WAN router' is
565 needed to connect to a WAN.
567 As an alternative, WAN routing can be built into the Linux kernel.
568 With relatively inexpensive WAN interface cards available on the
569 market, a perfectly usable router can be built for less than half
570 the price of an external router. If you have one of those cards and
571 wish to use your Linux box as a WAN router, say Y here and also to
572 the WAN driver for your card, below. You will then need the
573 wan-tools package which is available from <ftp://ftp.sangoma.com/>.
574 Read <file:Documentation/networking/wan-router.txt> for more
577 To compile WAN routing support as a module, choose M here: the
578 module will be called wanrouter.
582 menu "QoS and/or fair queueing"
585 bool "QoS and/or fair queueing"
587 When the kernel has several packets to send out over a network
588 device, it has to decide which ones to send first, which ones to
589 delay, and which ones to drop. This is the job of the packet
590 scheduler, and several different algorithms for how to do this
591 "fairly" have been proposed.
593 If you say N here, you will get the standard packet scheduler, which
594 is a FIFO (first come, first served). If you say Y here, you will be
595 able to choose from among several alternative algorithms which can
596 then be attached to different network devices. This is useful for
597 example if some of your network devices are real time devices that
598 need a certain minimum data flow rate, or if you need to limit the
599 maximum data flow rate for traffic which matches specified criteria.
600 This code is considered to be experimental.
602 To administer these schedulers, you'll need the user-level utilities
603 from the package iproute2+tc at <ftp://ftp.tux.org/pub/net/ip-routing/>.
604 That package also contains some documentation; for more, check out
605 <http://snafu.freedom.org/linux2.2/iproute-notes.html>.
607 This Quality of Service (QoS) support will enable you to use
608 Differentiated Services (diffserv) and Resource Reservation Protocol
609 (RSVP) on your Linux router if you also say Y to "QoS support",
610 "Packet classifier API" and to some classifiers below. Documentation
611 and software is at <http://diffserv.sourceforge.net/>.
613 If you say Y here and to "/proc file system" below, you will be able
614 to read status information about packet schedulers from the file
617 The available schedulers are listed in the following questions; you
618 can say Y to as many as you like. If unsure, say N now.
620 source "net/sched/Kconfig"
624 menu "Network testing"
627 tristate "Packet Generator (USE WITH CAUTION)"
630 This module will inject preconfigured packets, at a configurable
631 rate, out of a given interface. It is used for network interface
632 stress testing and performance analysis. If you don't understand
633 what was just said, you don't need it: say N.
635 Documentation on how to use the packet generaor can be found
636 at <file:Documentation/networking/pktgen.txt>.
638 To compile this code as a module, choose M here: the
639 module will be called pktgen.
649 bool "Netpoll support for trapping incoming packets"
654 bool "Netpoll traffic trapping"
658 config NET_POLL_CONTROLLER
661 source "net/ax25/Kconfig"
663 source "net/irda/Kconfig"
665 source "net/bluetooth/Kconfig"
667 source "net/tux/Kconfig"
669 source "drivers/net/Kconfig"