2 # Network configuration
5 menu "Networking support"
8 bool "Networking support"
10 Unless you really know what you are doing, you should say Y here.
11 The reason is that some programs need kernel networking support even
12 when running on a stand-alone machine that isn't connected to any
13 other computer. If you are upgrading from an older kernel, you
14 should consider updating your networking tools too because changes
15 in the kernel and the tools often go hand in hand. The tools are
16 contained in the package net-tools, the location and version number
17 of which are given in <file:Documentation/Changes>.
19 For a general introduction to Linux networking, it is highly
20 recommended to read the NET-HOWTO, available from
21 <http://www.tldp.org/docs.html#howto>.
23 menu "Networking options"
27 tristate "Packet socket"
29 The Packet protocol is used by applications which communicate
30 directly with network devices without an intermediate network
31 protocol implemented in the kernel, e.g. tcpdump. If you want them
34 To compile this driver as a module, choose M here: the module will
40 bool "Packet socket: mmapped IO"
43 If you say Y here, the Packet protocol driver will use an IO
44 mechanism that results in faster communication.
49 tristate "Netlink device emulation"
51 This option will be removed soon. Any programs that want to use
52 character special nodes like /dev/tap0 or /dev/route (all with major
53 number 36) need this option, and need to be rewritten soon to use
54 the real netlink socket.
55 This is a backward compatibility option, choose Y for now.
58 tristate "Unix domain sockets"
60 If you say Y here, you will include support for Unix domain sockets;
61 sockets are the standard Unix mechanism for establishing and
62 accessing network connections. Many commonly used programs such as
63 the X Window system and syslog use these sockets even if your
64 machine is not connected to any network. Unless you are working on
65 an embedded system or something similar, you therefore definitely
68 To compile this driver as a module, choose M here: the module will be
69 called unix. Note that several important services won't work
70 correctly if you say M here and then neglect to load the module.
72 Say Y unless you know what you are doing.
75 tristate "PF_KEY sockets"
78 PF_KEYv2 socket family, compatible to KAME ones.
79 They are required if you are going to use IPsec tools ported
82 Say Y unless you know what you are doing.
85 bool "TCP/IP networking"
87 These are the protocols used on the Internet and on most local
88 Ethernets. It is highly recommended to say Y here (this will enlarge
89 your kernel by about 144 KB), since some programs (e.g. the X window
90 system) use TCP/IP even if your machine is not connected to any
91 other computer. You will get the so-called loopback device which
92 allows you to ping yourself (great fun, that!).
94 For an excellent introduction to Linux networking, please read the
95 Linux Networking HOWTO, available from
96 <http://www.tldp.org/docs.html#howto>.
98 If you say Y here and also to "/proc file system support" and
99 "Sysctl support" below, you can change various aspects of the
100 behavior of the TCP/IP code by writing to the (virtual) files in
101 /proc/sys/net/ipv4/*; the options are explained in the file
102 <file:Documentation/networking/ip-sysctl.txt>.
106 source "net/ipv4/Kconfig"
108 # IPv6 as module will cause a CRASH if you try to unload it
110 tristate "The IPv6 protocol (EXPERIMENTAL)"
111 depends on INET && EXPERIMENTAL
113 This is experimental support for the IP version 6 (formerly called
114 IPng "IP next generation"). You will still be able to do
115 regular IPv4 networking as well.
117 Features of this new protocol include: expanded address space,
118 authentication and privacy, and seamless interoperability with the
119 current version of IP (IP version 4). For general information about
120 IPv6, see <http://playground.sun.com/pub/ipng/html/ipng-main.html>;
121 for specific information about IPv6 under Linux read the HOWTO at
122 <http://www.bieringer.de/linux/IPv6/> and the file net/ipv6/README
123 in the kernel source.
125 To compile this protocol support as a module, choose M here: the
126 module will be called ipv6.
128 It is safe to say N here for now.
130 source "net/ipv6/Kconfig"
133 bool "Network packet filtering (replaces ipchains)"
135 Netfilter is a framework for filtering and mangling network packets
136 that pass through your Linux box.
138 The most common use of packet filtering is to run your Linux box as
139 a firewall protecting a local network from the Internet. The type of
140 firewall provided by this kernel support is called a "packet
141 filter", which means that it can reject individual network packets
142 based on type, source, destination etc. The other kind of firewall,
143 a "proxy-based" one, is more secure but more intrusive and more
144 bothersome to set up; it inspects the network traffic much more
145 closely, modifies it and has knowledge about the higher level
146 protocols, which a packet filter lacks. Moreover, proxy-based
147 firewalls often require changes to the programs running on the local
148 clients. Proxy-based firewalls don't need support by the kernel, but
149 they are often combined with a packet filter, which only works if
152 You should also say Y here if you intend to use your Linux box as
153 the gateway to the Internet for a local network of machines without
154 globally valid IP addresses. This is called "masquerading": if one
155 of the computers on your local network wants to send something to
156 the outside, your box can "masquerade" as that computer, i.e. it
157 forwards the traffic to the intended outside destination, but
158 modifies the packets to make it look like they came from the
159 firewall box itself. It works both ways: if the outside host
160 replies, the Linux box will silently forward the traffic to the
161 correct local computer. This way, the computers on your local net
162 are completely invisible to the outside world, even though they can
163 reach the outside and can receive replies. It is even possible to
164 run globally visible servers from within a masqueraded local network
165 using a mechanism called portforwarding. Masquerading is also often
166 called NAT (Network Address Translation).
168 Another use of Netfilter is in transparent proxying: if a machine on
169 the local network tries to connect to an outside host, your Linux
170 box can transparently forward the traffic to a local server,
171 typically a caching proxy server.
173 Yet another use of Netfilter is building a bridging firewall. Using
174 a bridge with Network packet filtering enabled makes iptables "see"
175 the bridged traffic. For filtering on the lower network and Ethernet
176 protocols over the bridge, use ebtables (under bridge netfilter
179 Various modules exist for netfilter which replace the previous
180 masquerading (ipmasqadm), packet filtering (ipchains), transparent
181 proxying, and portforwarding mechanisms. Please see
182 <file:Documentation/Changes> under "iptables" for the location of
185 Make sure to say N to "Fast switching" below if you intend to say Y
186 here, as Fast switching currently bypasses netfilter.
188 Chances are that you should say Y here if you compile a kernel which
189 will run as a router and N for regular hosts. If unsure, say N.
193 config NETFILTER_DEBUG
194 bool "Network packet filtering debugging"
197 You can say Y here if you want to get additional messages useful in
198 debugging the netfilter code.
200 config BRIDGE_NETFILTER
201 bool "Bridged IP/ARP packets filtering"
202 depends on BRIDGE && NETFILTER && INET
205 Enabling this option will let arptables resp. iptables see bridged
206 ARP resp. IP traffic. If you want a bridging firewall, you probably
207 want this option enabled.
208 Enabling or disabling this option doesn't enable or disable
213 source "net/ipv4/netfilter/Kconfig"
214 source "net/ipv6/netfilter/Kconfig"
215 source "net/decnet/netfilter/Kconfig"
216 source "net/bridge/netfilter/Kconfig"
220 source "net/xfrm/Kconfig"
222 source "net/sctp/Kconfig"
225 tristate "Asynchronous Transfer Mode (ATM) (EXPERIMENTAL)"
226 depends on EXPERIMENTAL
228 ATM is a high-speed networking technology for Local Area Networks
229 and Wide Area Networks. It uses a fixed packet size and is
230 connection oriented, allowing for the negotiation of minimum
231 bandwidth requirements.
233 In order to participate in an ATM network, your Linux box needs an
234 ATM networking card. If you have that, say Y here and to the driver
235 of your ATM card below.
237 Note that you need a set of user-space programs to actually make use
238 of ATM. See the file <file:Documentation/networking/atm.txt> for
242 tristate "Classical IP over ATM (EXPERIMENTAL)"
243 depends on ATM && INET
245 Classical IP over ATM for PVCs and SVCs, supporting InARP and
246 ATMARP. If you want to communication with other IP hosts on your ATM
247 network, you will typically either say Y here or to "LAN Emulation
250 config ATM_CLIP_NO_ICMP
251 bool "Do NOT send ICMP if no neighbour (EXPERIMENTAL)"
254 Normally, an "ICMP host unreachable" message is sent if a neighbour
255 cannot be reached because there is no VC to it in the kernel's
256 ATMARP table. This may cause problems when ATMARP table entries are
257 briefly removed during revalidation. If you say Y here, packets to
258 such neighbours are silently discarded instead.
261 tristate "LAN Emulation (LANE) support (EXPERIMENTAL)"
264 LAN Emulation emulates services of existing LANs across an ATM
265 network. Besides operating as a normal ATM end station client, Linux
266 LANE client can also act as an proxy client bridging packets between
267 ELAN and Ethernet segments. You need LANE if you want to try MPOA.
270 tristate "Multi-Protocol Over ATM (MPOA) support (EXPERIMENTAL)"
271 depends on ATM && INET && ATM_LANE!=n
273 Multi-Protocol Over ATM allows ATM edge devices such as routers,
274 bridges and ATM attached hosts establish direct ATM VCs across
275 subnetwork boundaries. These shortcut connections bypass routers
276 enhancing overall network performance.
279 tristate "RFC1483/2684 Bridged protocols"
280 depends on ATM && INET
282 ATM PVCs can carry ethernet PDUs according to rfc2684 (formerly 1483)
283 This device will act like an ethernet from the kernels point of view,
284 with the traffic being carried by ATM PVCs (currently 1 PVC/device).
285 This is sometimes used over DSL lines. If in doubt, say N.
287 config ATM_BR2684_IPFILTER
288 bool "Per-VC IP filter kludge"
289 depends on ATM_BR2684
291 This is an experimental mechanism for users who need to terminating a
292 large number of IP-only vcc's. Do not enable this unless you are sure
293 you know what you are doing.
296 tristate "802.1d Ethernet Bridging"
298 If you say Y here, then your Linux box will be able to act as an
299 Ethernet bridge, which means that the different Ethernet segments it
300 is connected to will appear as one Ethernet to the participants.
301 Several such bridges can work together to create even larger
302 networks of Ethernets using the IEEE 802.1 spanning tree algorithm.
303 As this is a standard, Linux bridges will cooperate properly with
304 other third party bridge products.
306 In order to use the Ethernet bridge, you'll need the bridge
307 configuration tools; see <file:Documentation/networking/bridge.txt>
308 for location. Please read the Bridge mini-HOWTO for more
311 If you enable iptables support along with the bridge support then you
312 turn your bridge into a bridging IP firewall.
313 iptables will then see the IP packets being bridged, so you need to
314 take this into account when setting up your firewall rules.
315 Enabling arptables support when bridging will let arptables see
316 bridged ARP traffic in the arptables FORWARD chain.
318 To compile this code as a module, choose M here: the module
319 will be called bridge.
324 tristate "802.1Q VLAN Support"
327 tristate "DECnet Support"
329 The DECnet networking protocol was used in many products made by
330 Digital (now Compaq). It provides reliable stream and sequenced
331 packet communications over which run a variety of services similar
332 to those which run over TCP/IP.
334 To find some tools to use with the kernel layer support, please
335 look at Patrick Caulfield's web site:
336 <http://linux-decnet.sourceforge.net/>.
338 More detailed documentation is available in
339 <file:Documentation/networking/decnet.txt>.
341 Be sure to say Y to "/proc file system support" and "Sysctl support"
342 below when using DECnet, since you will need sysctl support to aid
343 in configuration at run time.
345 The DECnet code is also available as a module ( = code which can be
346 inserted in and removed from the running kernel whenever you want).
347 The module is called decnet.
349 source "net/decnet/Kconfig"
351 source "net/llc/Kconfig"
354 tristate "The IPX protocol"
357 This is support for the Novell networking protocol, IPX, commonly
358 used for local networks of Windows machines. You need it if you
359 want to access Novell NetWare file or print servers using the Linux
360 Novell client ncpfs (available from
361 <ftp://platan.vc.cvut.cz/pub/linux/ncpfs/>) or from
362 within the Linux DOS emulator DOSEMU (read the DOSEMU-HOWTO,
363 available from <http://www.tldp.org/docs.html#howto>). In order
364 to do the former, you'll also have to say Y to "NCP file system
367 IPX is similar in scope to IP, while SPX, which runs on top of IPX,
368 is similar to TCP. There is also experimental support for SPX in
369 Linux (see "SPX networking", below).
371 To turn your Linux box into a fully featured NetWare file server and
372 IPX router, say Y here and fetch either lwared from
373 <ftp://ibiblio.org/pub/Linux/system/network/daemons/> or
374 mars_nwe from <ftp://www.compu-art.de/mars_nwe/>. For more
375 information, read the IPX-HOWTO available from
376 <http://www.tldp.org/docs.html#howto>.
378 General information about how to connect Linux, Windows machines and
379 Macs is on the WWW at <http://www.eats.com/linux_mac_win.html>.
381 The IPX driver would enlarge your kernel by about 16 KB. To compile
382 this driver as a module, choose M here: the module will be called ipx.
383 Unless you want to integrate your Linux box with a local Novell
386 source "net/ipx/Kconfig"
389 tristate "Appletalk protocol support"
392 AppleTalk is the protocol that Apple computers can use to communicate
393 on a network. If your Linux box is connected to such a network and you
394 wish to connect to it, say Y. You will need to use the netatalk package
395 so that your Linux box can act as a print and file server for Macs as
396 well as access AppleTalk printers. Check out
397 <http://www.zettabyte.net/netatalk/> on the WWW for details.
398 EtherTalk is the name used for AppleTalk over Ethernet and the
399 cheaper and slower LocalTalk is AppleTalk over a proprietary Apple
400 network using serial links. EtherTalk and LocalTalk are fully
403 General information about how to connect Linux, Windows machines and
404 Macs is on the WWW at <http://www.eats.com/linux_mac_win.html>. The
405 NET-3-HOWTO, available from
406 <http://www.tldp.org/docs.html#howto>, contains valuable
409 To compile this driver as a module, choose M here: the module will be
410 called appletalk. You almost certainly want to compile it as a
411 module so you can restart your AppleTalk stack without rebooting
412 your machine. I hear that the GNU boycott of Apple is over, so
413 even politically correct people are allowed to say Y here.
415 source "drivers/net/appletalk/Kconfig"
418 tristate "CCITT X.25 Packet Layer (EXPERIMENTAL)"
419 depends on EXPERIMENTAL
421 X.25 is a set of standardized network protocols, similar in scope to
422 frame relay; the one physical line from your box to the X.25 network
423 entry point can carry several logical point-to-point connections
424 (called "virtual circuits") to other computers connected to the X.25
425 network. Governments, banks, and other organizations tend to use it
426 to connect to each other or to form Wide Area Networks (WANs). Many
427 countries have public X.25 networks. X.25 consists of two
428 protocols: the higher level Packet Layer Protocol (PLP) (say Y here
429 if you want that) and the lower level data link layer protocol LAPB
430 (say Y to "LAPB Data Link Driver" below if you want that).
432 You can read more about X.25 at <http://www.sangoma.com/x25.htm> and
433 <http://www.cisco.com/univercd/cc/td/doc/product/software/ios11/cbook/cx25.htm>.
434 Information about X.25 for Linux is contained in the files
435 <file:Documentation/networking/x25.txt> and
436 <file:Documentation/networking/x25-iface.txt>.
438 One connects to an X.25 network either with a dedicated network card
439 using the X.21 protocol (not yet supported by Linux) or one can do
440 X.25 over a standard telephone line using an ordinary modem (say Y
441 to "X.25 async driver" below) or over Ethernet using an ordinary
442 Ethernet card and the LAPB over Ethernet (say Y to "LAPB Data Link
443 Driver" and "LAPB over Ethernet driver" below).
445 To compile this driver as a module, choose M here: the module
446 will be called x25. If unsure, say N.
449 tristate "LAPB Data Link Driver (EXPERIMENTAL)"
450 depends on EXPERIMENTAL
452 Link Access Procedure, Balanced (LAPB) is the data link layer (i.e.
453 the lower) part of the X.25 protocol. It offers a reliable
454 connection service to exchange data frames with one other host, and
455 it is used to transport higher level protocols (mostly X.25 Packet
456 Layer, the higher part of X.25, but others are possible as well).
457 Usually, LAPB is used with specialized X.21 network cards, but Linux
458 currently supports LAPB only over Ethernet connections. If you want
459 to use LAPB connections over Ethernet, say Y here and to "LAPB over
460 Ethernet driver" below. Read
461 <file:Documentation/networking/lapb-module.txt> for technical
464 To compile this driver as a module, choose M here: the
465 module will be called lapb. If unsure, say N.
468 bool "Frame Diverter (EXPERIMENTAL)"
469 depends on EXPERIMENTAL
471 The Frame Diverter allows you to divert packets from the
472 network, that are not aimed at the interface receiving it (in
473 promisc. mode). Typically, a Linux box setup as an Ethernet bridge
474 with the Frames Diverter on, can do some *really* transparent www
475 caching using a Squid proxy for example.
477 This is very useful when you don't want to change your router's
478 config (or if you simply don't have access to it).
480 The other possible usages of diverting Ethernet Frames are
482 - reroute smtp traffic to another interface
483 - traffic-shape certain network streams
484 - transparently proxy smtp connections
487 For more informations, please refer to:
488 <http://diverter.sourceforge.net/>
489 <http://perso.wanadoo.fr/magpie/EtherDivert.html>
494 tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
495 depends on EXPERIMENTAL && INET
497 Econet is a fairly old and slow networking protocol mainly used by
498 Acorn computers to access file and print servers. It uses native
499 Econet network cards. AUN is an implementation of the higher level
500 parts of Econet that runs over ordinary Ethernet connections, on
501 top of the UDP packet protocol, which in turn runs on top of the
502 Internet protocol IP.
504 If you say Y here, you can choose with the next two options whether
505 to send Econet/AUN traffic over a UDP Ethernet connection or over
506 a native Econet network card.
508 To compile this driver as a module, choose M here: the module
509 will be called econet.
515 Say Y here if you want to send Econet/AUN traffic over a UDP
516 connection (UDP is a packet based protocol that runs on top of the
517 Internet protocol IP) using an ordinary Ethernet network card.
523 Say Y here if you have a native Econet network card installed in
527 tristate "WAN router"
528 depends on EXPERIMENTAL
530 Wide Area Networks (WANs), such as X.25, frame relay and leased
531 lines, are used to interconnect Local Area Networks (LANs) over vast
532 distances with data transfer rates significantly higher than those
533 achievable with commonly used asynchronous modem connections.
534 Usually, a quite expensive external device called a `WAN router' is
535 needed to connect to a WAN.
537 As an alternative, WAN routing can be built into the Linux kernel.
538 With relatively inexpensive WAN interface cards available on the
539 market, a perfectly usable router can be built for less than half
540 the price of an external router. If you have one of those cards and
541 wish to use your Linux box as a WAN router, say Y here and also to
542 the WAN driver for your card, below. You will then need the
543 wan-tools package which is available from <ftp://ftp.sangoma.com/>.
544 Read <file:Documentation/networking/wan-router.txt> for more
547 To compile WAN routing support as a module, choose M here: the
548 module will be called wanrouter.
553 bool "Fast switching (read help!)"
554 depends on EXPERIMENTAL
556 Saying Y here enables direct NIC-to-NIC (NIC = Network Interface
557 Card) data transfers on the local network, which is fast.
559 IMPORTANT NOTE: This option is NOT COMPATIBLE with "Network packet
560 filtering" (CONFIG_NETFILTER). Say N here if you say Y there.
562 However, it will work with all options in the "Advanced router"
563 section (except for "Use TOS value as routing key" and
564 "Use FWMARK value as routing key").
566 At the moment, few devices support fast switching (tulip is one of
567 them, a modified 8390 driver can be found at
568 <ftp://ftp.tux.org/pub/net/ip-routing/fastroute/fastroute-8390.tar.gz>).
572 config NET_HW_FLOWCONTROL
573 bool "Forwarding between high speed interfaces"
574 depends on EXPERIMENTAL
576 This option enables NIC (Network Interface Card) hardware throttling
577 during periods of extreme congestion. At the moment only a couple
578 of device drivers support it (really only one -- tulip, a modified
579 8390 driver can be found at
580 <ftp://ftp.tux.org/pub/net/ip-routing/fastroute/fastroute-8390.tar.gz>).
582 Really, this option is applicable to any machine attached to a fast
583 enough network, and even a 10 Mb NIC is able to kill a not very slow
584 box, such as a 120MHz Pentium.
586 However, do not say Y here if you did not experience any serious
590 menu "QoS and/or fair queueing"
593 bool "QoS and/or fair queueing"
595 When the kernel has several packets to send out over a network
596 device, it has to decide which ones to send first, which ones to
597 delay, and which ones to drop. This is the job of the packet
598 scheduler, and several different algorithms for how to do this
599 "fairly" have been proposed.
601 If you say N here, you will get the standard packet scheduler, which
602 is a FIFO (first come, first served). If you say Y here, you will be
603 able to choose from among several alternative algorithms which can
604 then be attached to different network devices. This is useful for
605 example if some of your network devices are real time devices that
606 need a certain minimum data flow rate, or if you need to limit the
607 maximum data flow rate for traffic which matches specified criteria.
608 This code is considered to be experimental.
610 To administer these schedulers, you'll need the user-level utilities
611 from the package iproute2+tc at <ftp://ftp.tux.org/pub/net/ip-routing/>.
612 That package also contains some documentation; for more, check out
613 <http://snafu.freedom.org/linux2.2/iproute-notes.html>.
615 This Quality of Service (QoS) support will enable you to use
616 Differentiated Services (diffserv) and Resource Reservation Protocol
617 (RSVP) on your Linux router if you also say Y to "QoS support",
618 "Packet classifier API" and to some classifiers below. Documentation
619 and software is at <http://diffserv.sourceforge.net/>.
621 If you say Y here and to "/proc file system" below, you will be able
622 to read status information about packet schedulers from the file
625 The available schedulers are listed in the following questions; you
626 can say Y to as many as you like. If unsure, say N now.
628 source "net/sched/Kconfig"
632 menu "Network testing"
635 tristate "Packet Generator (USE WITH CAUTION)"
638 This module will inject preconfigured packets, at a configurable
639 rate, out of a given interface. It is used for network interface
640 stress testing and performance analysis. If you don't understand
641 what was just said, you don't need it: say N.
643 Documentation on how to use the packet generaor can be found
644 at <file:Documentation/networking/pktgen.txt>.
646 To compile this code as a module, choose M here: the
647 module will be called pktgen.
657 bool "Netpoll support for trapping incoming packets"
662 bool "Netpoll traffic trapping"
666 config NET_POLL_CONTROLLER
669 source "net/ax25/Kconfig"
671 source "net/irda/Kconfig"
673 source "net/bluetooth/Kconfig"
675 source "drivers/net/Kconfig"