2 # Network configuration
5 menu "Networking support"
8 bool "Networking support"
10 Unless you really know what you are doing, you should say Y here.
11 The reason is that some programs need kernel networking support even
12 when running on a stand-alone machine that isn't connected to any
13 other computer. If you are upgrading from an older kernel, you
14 should consider updating your networking tools too because changes
15 in the kernel and the tools often go hand in hand. The tools are
16 contained in the package net-tools, the location and version number
17 of which are given in <file:Documentation/Changes>.
19 For a general introduction to Linux networking, it is highly
20 recommended to read the NET-HOWTO, available from
21 <http://www.tldp.org/docs.html#howto>.
23 menu "Networking options"
27 tristate "Packet socket"
29 The Packet protocol is used by applications which communicate
30 directly with network devices without an intermediate network
31 protocol implemented in the kernel, e.g. tcpdump. If you want them
34 To compile this driver as a module, choose M here: the module will
40 bool "Packet socket: mmapped IO"
43 If you say Y here, the Packet protocol driver will use an IO
44 mechanism that results in faster communication.
49 tristate "Unix domain sockets"
51 If you say Y here, you will include support for Unix domain sockets;
52 sockets are the standard Unix mechanism for establishing and
53 accessing network connections. Many commonly used programs such as
54 the X Window system and syslog use these sockets even if your
55 machine is not connected to any network. Unless you are working on
56 an embedded system or something similar, you therefore definitely
59 To compile this driver as a module, choose M here: the module will be
60 called unix. Note that several important services won't work
61 correctly if you say M here and then neglect to load the module.
63 Say Y unless you know what you are doing.
66 tristate "PF_KEY sockets"
69 PF_KEYv2 socket family, compatible to KAME ones.
70 They are required if you are going to use IPsec tools ported
73 Say Y unless you know what you are doing.
76 bool "TCP/IP networking"
78 These are the protocols used on the Internet and on most local
79 Ethernets. It is highly recommended to say Y here (this will enlarge
80 your kernel by about 144 KB), since some programs (e.g. the X window
81 system) use TCP/IP even if your machine is not connected to any
82 other computer. You will get the so-called loopback device which
83 allows you to ping yourself (great fun, that!).
85 For an excellent introduction to Linux networking, please read the
86 Linux Networking HOWTO, available from
87 <http://www.tldp.org/docs.html#howto>.
89 If you say Y here and also to "/proc file system support" and
90 "Sysctl support" below, you can change various aspects of the
91 behavior of the TCP/IP code by writing to the (virtual) files in
92 /proc/sys/net/ipv4/*; the options are explained in the file
93 <file:Documentation/networking/ip-sysctl.txt>.
97 source "net/ipv4/Kconfig"
99 # IPv6 as module will cause a CRASH if you try to unload it
101 tristate "The IPv6 protocol"
104 select CRYPTO if IPV6_PRIVACY
105 select CRYPTO_MD5 if IPV6_PRIVACY
107 This is complemental support for the IP version 6.
108 You will still be able to do traditional IPv4 networking as well.
110 For general information about IPv6, see
111 <http://playground.sun.com/pub/ipng/html/ipng-main.html>.
112 For Linux IPv6 development information, see <http://www.linux-ipv6.org>.
113 For specific information about IPv6 under Linux, read the HOWTO at
114 <http://www.bieringer.de/linux/IPv6/>.
116 To compile this protocol support as a module, choose M here: the
117 module will be called ipv6.
119 source "net/ipv6/Kconfig"
122 bool "Network packet filtering (replaces ipchains)"
124 Netfilter is a framework for filtering and mangling network packets
125 that pass through your Linux box.
127 The most common use of packet filtering is to run your Linux box as
128 a firewall protecting a local network from the Internet. The type of
129 firewall provided by this kernel support is called a "packet
130 filter", which means that it can reject individual network packets
131 based on type, source, destination etc. The other kind of firewall,
132 a "proxy-based" one, is more secure but more intrusive and more
133 bothersome to set up; it inspects the network traffic much more
134 closely, modifies it and has knowledge about the higher level
135 protocols, which a packet filter lacks. Moreover, proxy-based
136 firewalls often require changes to the programs running on the local
137 clients. Proxy-based firewalls don't need support by the kernel, but
138 they are often combined with a packet filter, which only works if
141 You should also say Y here if you intend to use your Linux box as
142 the gateway to the Internet for a local network of machines without
143 globally valid IP addresses. This is called "masquerading": if one
144 of the computers on your local network wants to send something to
145 the outside, your box can "masquerade" as that computer, i.e. it
146 forwards the traffic to the intended outside destination, but
147 modifies the packets to make it look like they came from the
148 firewall box itself. It works both ways: if the outside host
149 replies, the Linux box will silently forward the traffic to the
150 correct local computer. This way, the computers on your local net
151 are completely invisible to the outside world, even though they can
152 reach the outside and can receive replies. It is even possible to
153 run globally visible servers from within a masqueraded local network
154 using a mechanism called portforwarding. Masquerading is also often
155 called NAT (Network Address Translation).
157 Another use of Netfilter is in transparent proxying: if a machine on
158 the local network tries to connect to an outside host, your Linux
159 box can transparently forward the traffic to a local server,
160 typically a caching proxy server.
162 Yet another use of Netfilter is building a bridging firewall. Using
163 a bridge with Network packet filtering enabled makes iptables "see"
164 the bridged traffic. For filtering on the lower network and Ethernet
165 protocols over the bridge, use ebtables (under bridge netfilter
168 Various modules exist for netfilter which replace the previous
169 masquerading (ipmasqadm), packet filtering (ipchains), transparent
170 proxying, and portforwarding mechanisms. Please see
171 <file:Documentation/Changes> under "iptables" for the location of
174 Make sure to say N to "Fast switching" below if you intend to say Y
175 here, as Fast switching currently bypasses netfilter.
177 Chances are that you should say Y here if you compile a kernel which
178 will run as a router and N for regular hosts. If unsure, say N.
182 config NETFILTER_DEBUG
183 bool "Network packet filtering debugging"
186 You can say Y here if you want to get additional messages useful in
187 debugging the netfilter code.
189 config BRIDGE_NETFILTER
190 bool "Bridged IP/ARP packets filtering"
191 depends on BRIDGE && NETFILTER && INET
194 Enabling this option will let arptables resp. iptables see bridged
195 ARP resp. IP traffic. If you want a bridging firewall, you probably
196 want this option enabled.
197 Enabling or disabling this option doesn't enable or disable
202 source "net/ipv4/netfilter/Kconfig"
203 source "net/ipv6/netfilter/Kconfig"
204 source "net/decnet/netfilter/Kconfig"
205 source "net/bridge/netfilter/Kconfig"
208 tristate "PlanetLab Virtualized NETwork access"
209 depends on IP_NF_CONNTRACK
211 VNET associates IP connections with VServer virtual contexts
212 and ensures that unprivileged contexts can receive only packets
213 related to connections initiated by, or bound to, sockets
214 created in their contexts.
216 For now, enabling or disabling this option does not compile
217 the driver or activate any non-default code paths. Compile
218 and load the VNET module separately.
228 source "net/xfrm/Kconfig"
230 source "net/sctp/Kconfig"
233 tristate "Asynchronous Transfer Mode (ATM) (EXPERIMENTAL)"
234 depends on EXPERIMENTAL
236 ATM is a high-speed networking technology for Local Area Networks
237 and Wide Area Networks. It uses a fixed packet size and is
238 connection oriented, allowing for the negotiation of minimum
239 bandwidth requirements.
241 In order to participate in an ATM network, your Linux box needs an
242 ATM networking card. If you have that, say Y here and to the driver
243 of your ATM card below.
245 Note that you need a set of user-space programs to actually make use
246 of ATM. See the file <file:Documentation/networking/atm.txt> for
250 tristate "Classical IP over ATM (EXPERIMENTAL)"
251 depends on ATM && INET
253 Classical IP over ATM for PVCs and SVCs, supporting InARP and
254 ATMARP. If you want to communication with other IP hosts on your ATM
255 network, you will typically either say Y here or to "LAN Emulation
258 config ATM_CLIP_NO_ICMP
259 bool "Do NOT send ICMP if no neighbour (EXPERIMENTAL)"
262 Normally, an "ICMP host unreachable" message is sent if a neighbour
263 cannot be reached because there is no VC to it in the kernel's
264 ATMARP table. This may cause problems when ATMARP table entries are
265 briefly removed during revalidation. If you say Y here, packets to
266 such neighbours are silently discarded instead.
269 tristate "LAN Emulation (LANE) support (EXPERIMENTAL)"
272 LAN Emulation emulates services of existing LANs across an ATM
273 network. Besides operating as a normal ATM end station client, Linux
274 LANE client can also act as an proxy client bridging packets between
275 ELAN and Ethernet segments. You need LANE if you want to try MPOA.
278 tristate "Multi-Protocol Over ATM (MPOA) support (EXPERIMENTAL)"
279 depends on ATM && INET && ATM_LANE!=n
281 Multi-Protocol Over ATM allows ATM edge devices such as routers,
282 bridges and ATM attached hosts establish direct ATM VCs across
283 subnetwork boundaries. These shortcut connections bypass routers
284 enhancing overall network performance.
287 tristate "RFC1483/2684 Bridged protocols"
288 depends on ATM && INET
290 ATM PVCs can carry ethernet PDUs according to rfc2684 (formerly 1483)
291 This device will act like an ethernet from the kernels point of view,
292 with the traffic being carried by ATM PVCs (currently 1 PVC/device).
293 This is sometimes used over DSL lines. If in doubt, say N.
295 config ATM_BR2684_IPFILTER
296 bool "Per-VC IP filter kludge"
297 depends on ATM_BR2684
299 This is an experimental mechanism for users who need to terminating a
300 large number of IP-only vcc's. Do not enable this unless you are sure
301 you know what you are doing.
304 tristate "802.1d Ethernet Bridging"
306 If you say Y here, then your Linux box will be able to act as an
307 Ethernet bridge, which means that the different Ethernet segments it
308 is connected to will appear as one Ethernet to the participants.
309 Several such bridges can work together to create even larger
310 networks of Ethernets using the IEEE 802.1 spanning tree algorithm.
311 As this is a standard, Linux bridges will cooperate properly with
312 other third party bridge products.
314 In order to use the Ethernet bridge, you'll need the bridge
315 configuration tools; see <file:Documentation/networking/bridge.txt>
316 for location. Please read the Bridge mini-HOWTO for more
319 If you enable iptables support along with the bridge support then you
320 turn your bridge into a bridging IP firewall.
321 iptables will then see the IP packets being bridged, so you need to
322 take this into account when setting up your firewall rules.
323 Enabling arptables support when bridging will let arptables see
324 bridged ARP traffic in the arptables FORWARD chain.
326 To compile this code as a module, choose M here: the module
327 will be called bridge.
332 tristate "802.1Q VLAN Support"
334 Select this and you will be able to create 802.1Q VLAN interfaces
335 on your ethernet interfaces. 802.1Q VLAN supports almost
336 everything a regular ethernet interface does, including
337 firewalling, bridging, and of course IP traffic. You will need
338 the 'vconfig' tool from the VLAN project in order to effectively
339 use VLANs. See the VLAN web page for more information:
340 <http://www.candelatech.com/~greear/vlan.html>
342 To compile this code as a module, choose M here: the module
343 will be called 8021q.
348 tristate "DECnet Support"
350 The DECnet networking protocol was used in many products made by
351 Digital (now Compaq). It provides reliable stream and sequenced
352 packet communications over which run a variety of services similar
353 to those which run over TCP/IP.
355 To find some tools to use with the kernel layer support, please
356 look at Patrick Caulfield's web site:
357 <http://linux-decnet.sourceforge.net/>.
359 More detailed documentation is available in
360 <file:Documentation/networking/decnet.txt>.
362 Be sure to say Y to "/proc file system support" and "Sysctl support"
363 below when using DECnet, since you will need sysctl support to aid
364 in configuration at run time.
366 The DECnet code is also available as a module ( = code which can be
367 inserted in and removed from the running kernel whenever you want).
368 The module is called decnet.
370 source "net/decnet/Kconfig"
372 source "net/llc/Kconfig"
375 tristate "The IPX protocol"
378 This is support for the Novell networking protocol, IPX, commonly
379 used for local networks of Windows machines. You need it if you
380 want to access Novell NetWare file or print servers using the Linux
381 Novell client ncpfs (available from
382 <ftp://platan.vc.cvut.cz/pub/linux/ncpfs/>) or from
383 within the Linux DOS emulator DOSEMU (read the DOSEMU-HOWTO,
384 available from <http://www.tldp.org/docs.html#howto>). In order
385 to do the former, you'll also have to say Y to "NCP file system
388 IPX is similar in scope to IP, while SPX, which runs on top of IPX,
389 is similar to TCP. There is also experimental support for SPX in
390 Linux (see "SPX networking", below).
392 To turn your Linux box into a fully featured NetWare file server and
393 IPX router, say Y here and fetch either lwared from
394 <ftp://ibiblio.org/pub/Linux/system/network/daemons/> or
395 mars_nwe from <ftp://www.compu-art.de/mars_nwe/>. For more
396 information, read the IPX-HOWTO available from
397 <http://www.tldp.org/docs.html#howto>.
399 General information about how to connect Linux, Windows machines and
400 Macs is on the WWW at <http://www.eats.com/linux_mac_win.html>.
402 The IPX driver would enlarge your kernel by about 16 KB. To compile
403 this driver as a module, choose M here: the module will be called ipx.
404 Unless you want to integrate your Linux box with a local Novell
407 source "net/ipx/Kconfig"
410 tristate "Appletalk protocol support"
413 AppleTalk is the protocol that Apple computers can use to communicate
414 on a network. If your Linux box is connected to such a network and you
415 wish to connect to it, say Y. You will need to use the netatalk package
416 so that your Linux box can act as a print and file server for Macs as
417 well as access AppleTalk printers. Check out
418 <http://www.zettabyte.net/netatalk/> on the WWW for details.
419 EtherTalk is the name used for AppleTalk over Ethernet and the
420 cheaper and slower LocalTalk is AppleTalk over a proprietary Apple
421 network using serial links. EtherTalk and LocalTalk are fully
424 General information about how to connect Linux, Windows machines and
425 Macs is on the WWW at <http://www.eats.com/linux_mac_win.html>. The
426 NET-3-HOWTO, available from
427 <http://www.tldp.org/docs.html#howto>, contains valuable
430 To compile this driver as a module, choose M here: the module will be
431 called appletalk. You almost certainly want to compile it as a
432 module so you can restart your AppleTalk stack without rebooting
433 your machine. I hear that the GNU boycott of Apple is over, so
434 even politically correct people are allowed to say Y here.
436 source "drivers/net/appletalk/Kconfig"
439 tristate "CCITT X.25 Packet Layer (EXPERIMENTAL)"
440 depends on EXPERIMENTAL
442 X.25 is a set of standardized network protocols, similar in scope to
443 frame relay; the one physical line from your box to the X.25 network
444 entry point can carry several logical point-to-point connections
445 (called "virtual circuits") to other computers connected to the X.25
446 network. Governments, banks, and other organizations tend to use it
447 to connect to each other or to form Wide Area Networks (WANs). Many
448 countries have public X.25 networks. X.25 consists of two
449 protocols: the higher level Packet Layer Protocol (PLP) (say Y here
450 if you want that) and the lower level data link layer protocol LAPB
451 (say Y to "LAPB Data Link Driver" below if you want that).
453 You can read more about X.25 at <http://www.sangoma.com/x25.htm> and
454 <http://www.cisco.com/univercd/cc/td/doc/product/software/ios11/cbook/cx25.htm>.
455 Information about X.25 for Linux is contained in the files
456 <file:Documentation/networking/x25.txt> and
457 <file:Documentation/networking/x25-iface.txt>.
459 One connects to an X.25 network either with a dedicated network card
460 using the X.21 protocol (not yet supported by Linux) or one can do
461 X.25 over a standard telephone line using an ordinary modem (say Y
462 to "X.25 async driver" below) or over Ethernet using an ordinary
463 Ethernet card and the LAPB over Ethernet (say Y to "LAPB Data Link
464 Driver" and "LAPB over Ethernet driver" below).
466 To compile this driver as a module, choose M here: the module
467 will be called x25. If unsure, say N.
470 tristate "LAPB Data Link Driver (EXPERIMENTAL)"
471 depends on EXPERIMENTAL
473 Link Access Procedure, Balanced (LAPB) is the data link layer (i.e.
474 the lower) part of the X.25 protocol. It offers a reliable
475 connection service to exchange data frames with one other host, and
476 it is used to transport higher level protocols (mostly X.25 Packet
477 Layer, the higher part of X.25, but others are possible as well).
478 Usually, LAPB is used with specialized X.21 network cards, but Linux
479 currently supports LAPB only over Ethernet connections. If you want
480 to use LAPB connections over Ethernet, say Y here and to "LAPB over
481 Ethernet driver" below. Read
482 <file:Documentation/networking/lapb-module.txt> for technical
485 To compile this driver as a module, choose M here: the
486 module will be called lapb. If unsure, say N.
489 bool "Frame Diverter (EXPERIMENTAL)"
490 depends on EXPERIMENTAL
492 The Frame Diverter allows you to divert packets from the
493 network, that are not aimed at the interface receiving it (in
494 promisc. mode). Typically, a Linux box setup as an Ethernet bridge
495 with the Frames Diverter on, can do some *really* transparent www
496 caching using a Squid proxy for example.
498 This is very useful when you don't want to change your router's
499 config (or if you simply don't have access to it).
501 The other possible usages of diverting Ethernet Frames are
503 - reroute smtp traffic to another interface
504 - traffic-shape certain network streams
505 - transparently proxy smtp connections
508 For more informations, please refer to:
509 <http://diverter.sourceforge.net/>
510 <http://perso.wanadoo.fr/magpie/EtherDivert.html>
515 tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
516 depends on EXPERIMENTAL && INET
518 Econet is a fairly old and slow networking protocol mainly used by
519 Acorn computers to access file and print servers. It uses native
520 Econet network cards. AUN is an implementation of the higher level
521 parts of Econet that runs over ordinary Ethernet connections, on
522 top of the UDP packet protocol, which in turn runs on top of the
523 Internet protocol IP.
525 If you say Y here, you can choose with the next two options whether
526 to send Econet/AUN traffic over a UDP Ethernet connection or over
527 a native Econet network card.
529 To compile this driver as a module, choose M here: the module
530 will be called econet.
536 Say Y here if you want to send Econet/AUN traffic over a UDP
537 connection (UDP is a packet based protocol that runs on top of the
538 Internet protocol IP) using an ordinary Ethernet network card.
544 Say Y here if you have a native Econet network card installed in
548 tristate "WAN router"
549 depends on EXPERIMENTAL
551 Wide Area Networks (WANs), such as X.25, frame relay and leased
552 lines, are used to interconnect Local Area Networks (LANs) over vast
553 distances with data transfer rates significantly higher than those
554 achievable with commonly used asynchronous modem connections.
555 Usually, a quite expensive external device called a `WAN router' is
556 needed to connect to a WAN.
558 As an alternative, WAN routing can be built into the Linux kernel.
559 With relatively inexpensive WAN interface cards available on the
560 market, a perfectly usable router can be built for less than half
561 the price of an external router. If you have one of those cards and
562 wish to use your Linux box as a WAN router, say Y here and also to
563 the WAN driver for your card, below. You will then need the
564 wan-tools package which is available from <ftp://ftp.sangoma.com/>.
565 Read <file:Documentation/networking/wan-router.txt> for more
568 To compile WAN routing support as a module, choose M here: the
569 module will be called wanrouter.
573 menu "QoS and/or fair queueing"
576 bool "QoS and/or fair queueing"
578 When the kernel has several packets to send out over a network
579 device, it has to decide which ones to send first, which ones to
580 delay, and which ones to drop. This is the job of the packet
581 scheduler, and several different algorithms for how to do this
582 "fairly" have been proposed.
584 If you say N here, you will get the standard packet scheduler, which
585 is a FIFO (first come, first served). If you say Y here, you will be
586 able to choose from among several alternative algorithms which can
587 then be attached to different network devices. This is useful for
588 example if some of your network devices are real time devices that
589 need a certain minimum data flow rate, or if you need to limit the
590 maximum data flow rate for traffic which matches specified criteria.
591 This code is considered to be experimental.
593 To administer these schedulers, you'll need the user-level utilities
594 from the package iproute2+tc at <ftp://ftp.tux.org/pub/net/ip-routing/>.
595 That package also contains some documentation; for more, check out
596 <http://snafu.freedom.org/linux2.2/iproute-notes.html>.
598 This Quality of Service (QoS) support will enable you to use
599 Differentiated Services (diffserv) and Resource Reservation Protocol
600 (RSVP) on your Linux router if you also say Y to "QoS support",
601 "Packet classifier API" and to some classifiers below. Documentation
602 and software is at <http://diffserv.sourceforge.net/>.
604 If you say Y here and to "/proc file system" below, you will be able
605 to read status information about packet schedulers from the file
608 The available schedulers are listed in the following questions; you
609 can say Y to as many as you like. If unsure, say N now.
611 source "net/sched/Kconfig"
615 menu "Network testing"
618 tristate "Packet Generator (USE WITH CAUTION)"
621 This module will inject preconfigured packets, at a configurable
622 rate, out of a given interface. It is used for network interface
623 stress testing and performance analysis. If you don't understand
624 what was just said, you don't need it: say N.
626 Documentation on how to use the packet generator can be found
627 at <file:Documentation/networking/pktgen.txt>.
629 To compile this code as a module, choose M here: the
630 module will be called pktgen.
640 bool "Netpoll support for trapping incoming packets"
645 bool "Netpoll traffic trapping"
649 config NET_POLL_CONTROLLER
652 source "net/ax25/Kconfig"
654 source "net/irda/Kconfig"
656 source "net/bluetooth/Kconfig"
658 source "net/tux/Kconfig"
660 source "drivers/net/Kconfig"