Go to main content

Oracle® Solaris 11.4 Tunable Parameters Reference Manual

Exit Print View

Updated: January 2019
 
 

IP Tunable Parameters

This section describes parameters pertaining to the IP protocol.

_addrs_per_if Parameter

Description

Defines the maximum number of logical IP interfaces associated with a real interface. Each logical interface in the Oracle Solaris kernel maps to a single IP address.

Default

256

Range

1 to 8,192

Dynamic?

Yes

When to Change

Do not change the value. If more logical interfaces are required, you might consider increasing the value. However, recognize that this change might have a negative impact on IP's performance.

Commitment Level

Unstable

_forwarding_src_routed Parameter (IPv4 or IPv6)

Description

Controls whether IPv4 or IPv6 forwards packets with source IPv4 routing options or IPv6 routing headers.

Default

Off

Range

Off or On

Dynamic?

Yes

When to Change

Keep this parameter disabled to prevent denial of service attacks.

Commitment Level

Unstable

_icmp_err_interval and _icmp_err_burst Parameters

Description

Controls the rate of IP in generating ICMP error messages. IP generates only up to _icmp_err_burst IP error messages in any _icmp_err_interval.

The _icmp_err_interval parameter protects IP from denial of service attacks. Setting this parameter to 0 disables rate limiting. It does not disable the generation of error messages.

Default

100 milliseconds for _icmp_err_interval

10 error messages for _icmp_err_burst

Range

0 – 99,999 milliseconds for _icmp_err_interval

1 – 99,999 error messages for _icmp_err_burst

Dynamic?

Yes

When to Change

If you need a higher error message generation rate for diagnostic purposes.

Commitment Level

Unstable

_policy_mask Parameter

Description

Enables or disables IPQoS processing in any of the following callout positions: forward outbound, forward inbound, local outbound, and local inbound. This parameter is a bitmask as follows:

Not Used
Not Used
Not Used
Not Used
Forward Outbound
Forward Inbound
Local Outbound
Local Inbound
X
X
X
X
0
0
0
0

A 1 in any of the position masks or disables IPQoS processing in that particular callout position. For example, a value of 0x01 disables IPQoS processing for all the local inbound packets.

Default

The default value is 0, meaning that IPQoS processing is enabled in all the callout positions.

Range

0 (0x00) to 15 (0x0F). A value of 15 indicates that IPQoS processing is disabled in all the callout positions.

Dynamic?

Yes

When to Change

If you want to enable or disable IPQoS processing in any of the callout positions.

Commitment Level

Unstable

_respond_to_echo_broadcast (IP) and _respond_to_echo_multicast Parameters (IPv4 or IPv6)

Description

Controls whether IP responds to a broadcast ICMPv4 echo request or a multicast ICMPv4 or ICMPv6 echo request.

Default

1 (enabled)

Range

0 (disabled) or 1 (enabled)

Dynamic?

Yes

When to Change

If you do not want this behavior for security reasons, disable it.

Commitment Level

Unstable

hoplimit Parameter (IPv6)

Description

Sets the value of the hop limit in the IPv6 header for the outbound ICMPv6 error and reply packets. The hop limit defines the maximum number of routers a packet can pass through on the path to the destination. It is primarily used to clear messages from the network when a misconfiguration would otherwise case messages to endlessly loop through the same set of routers.

The hoplimit set on outbound ICMP requests and on UDP, TCP, and SCTP messages is not controlled by this property. It is instead controlled by the _ipv6_hoplimit property for each respective protocol.

Default

255

Range

1 to 255

Dynamic?

Yes

When to Change

Generally, you do not need to change this value.

Commitment Level

Stable

hostmodel Parameter (IPv4 or IPv6)

Description

Controls send and receive behavior for IPv4 or IPv6 packets on a multi-homed system.

Default

weak

Range

weak, strong, or src-priority

  • weak

    • Outgoing packets - The source address of the packet going out need not match the address configured on the outgoing interface.

    • Incoming packets - The destination address of the incoming packet need not match the address configured on the incoming interface.

  • strong

    • Outgoing packets - The source address of the packet going out must match the address configured on the outgoing interface.

    • Incoming packets - The destination address of the incoming packet must match the address configured on the incoming interface.

  • src-priority

    • Outgoing packets - If multiple routes for the IP destination in the packet are available, the system prefers routes where the IP source address in the packet is configured on the outgoing interface.

      If no such route is available, the system falls back to selecting the best route, as with the weak ES case.

    • Incoming packets - The destination address of the incoming packet must be configured on any one of the host's interface.

Dynamic?

Yes

When to Change

If a system has interfaces that cross strict networking domains (for example, a firewall or a VPN node), set this parameter to strong.

Commitment Level

Stable

recv-multicast-scaling Parameter

Description

Defines system-wide default value to enable receiving multicast packets through a more scalable data path that uses extra worker threads to deliver multicast packets. Multicast applications are usually streaming data type, where packets are small but the packet rate can be very high. The normal data path cannot handle very high packet rate without drops. This problem is especially acute when there are multiple receivers for the same multicast group. However, for the general case, there might be a tradeoff between latency and scalability.

Default

0 (off)

Range

0 (off) or 1 (on)

Dynamic?

Yes

When to Change

Change from the default setting in cases of high volume of UDP multicast traffic.

Commitment Level

Stable

send-redirects Parameter (IPv4 or IPv6)

Description

Controls whether IPv4 or IPv6 sends out ICMPv4 or ICMPv6 redirect messages.

Default

1 (enabled)

Range

0 (disabled) or 1 (enabled)

Dynamic?

Yes

When to Change

If you do not want this behavior for security reasons, disable it.

Commitment Level

Stable

ttl Parameter (IPv4)

Description

Controls the time to live (TTL) value in the IPv4 header for the outbound IPv4 ICMP error and reply packets. The TTL defines the maximum number of routers a packet can pass through on the path to the destination. It is primarily used to clear messages from the network when a misconfiguration would otherwise cause messages to endlessly loop through the same set of routers.

The ttl set on outbound ICMP requests and on UDP, TCP, and SCTP messages is not controlled by this property. It is instead controlled by the _ipv4_ttl Parameter property for each respective protocol.

Default

255

Range

1 to 255

Dynamic?

Yes

When to Change

Generally, you do not need to change this value.

Commitment Level

Stable

IP Tunable Parameters Related to Duplicate Address Detection

The following parameters can be configured to perform duplicate address detection (DAD) in the network.

_arp_defend_interval/_ndp_defend_interval Parameter

Description

Interval in which the system continues to broadcast announcements for a specific address using IPv4 ARP and IPv6 NDP, respectively, to detect duplicate addresses in the network after the initial duplicate address detection process completes successfully.

Default

300,000 milliseconds

Range

0-360,000

Dynamic?

Yes

When to Change

Never

Commitment Level

Unstable

_arp_defend_period/_ndp_defend_period Parameter

Description

Time period within which unrequested address-defense ARP or NDP messages are generated on any one physical network interface. These parameters work together with _arp_defend_rate/_ndp_defend_rate Parameter.

These parameters does not apply to normal ARP or NDP resolution or to address defense due to detected conflicts. Rather, the parameters are implemented only on unbidden conflict detection traffic.

Default

3,600 seconds

Range

0-3,600

Dynamic?

Yes

When to Change

Never

Commitment Level

Unstable

_arp_defend_rate/_ndp_defend_rate Parameter

Description

Number of unrequested address-defense ARP or NDP messages that can be generated in an hour period on any one physical network interface. The time period can be revised by configuring _arp_defend_period/_ndp_defend_period Parameter.

The _arp_defend_rate/_ndp_defend_rate work together with the _arp_defend_period/_ndp_defend_period to prevent a system with a large number of configured IP addresses from flooding the network with ARP traffic.

By default, the system will continuously broadcast an ARP announcement or NDP advertisement every five minutes for each address that already passed duplicate address detection. However, the total number of such ARP announcements or NDP advertisements from an interface is further limited to 100 messages per hour regardless of the number of configured addresses.

These parameters does not apply to normal ARP or NDP resolution nor to address defense due to detected conflicts. Rather, the parameters are implemented only on unbidden conflict detection traffic.

Default

100 messages/hour

Range

0-20,000

Dynamic?

Yes

When to Change

Never

Commitment Level

Unstable

_arp_fastprobe_count Parameter

Description

In a transmit-pause sequence, the number of probes that are transmitted to detect duplicate addresses before pausing. The length of time is defined in _arp_fastprobe_interval Parameter. The parameter is used for faster probing for duplicate addresses.

Default

3 packets

Range

0-20

Dynamic?

Yes

When to Change

Never

Commitment Level

Unstable

_arp_fastprobe_interval Parameter

Description

Similar function to _arp_probe_interval Parameter, which is the time between the sending of a set number of probes to detect duplicate addresses. To accelerate the process in bringing up an IP interface, and if the underlying driver can properly report link up or link down events, the system uses this parameter as the interval between sending out probes. This parameter works together with _arp_fastprobe_count Parameter.

Default

150 milliseconds

Range

10-20,000

Dynamic?

Yes

When to Change

Never

Commitment Level

Unstable

_arp_probe_count Parameter

Description

In a transmit-pause sequence, the number of probes that are transmitted to detect duplicate addresses before pausing. The length of the pause is determined by _arp_probe_interval Parameter. After the pause time expires, probing resumes.

Default

3 packets

Range

0-20

Dynamic?

Yes

When to Change

Never

Commitment Level

Unstable

_arp_probe_interval Parameter

Description

Time between the sending of a set number of probes to detect duplicate addresses. The number of probes that is sent after each interval is defined in _arp_probe_count Parameter.

Default

1,500 milliseconds

Range

10-20,000

Dynamic?

Yes

When to Change

Never

Commitment Level

Unstable

_defend_interval Parameter

Description

Length of time a system defends its local address when it is detected to be in conflict with another system's IP address. The number of attempts to defend the address within this period is defined in _max_defend Parameter.

Default

30 seconds

Range

0-999,999

Dynamic?

Yes

When to Change

Never

Commitment Level

Unstable

_dup_recovery Parameter

Description

Time between the transmission of probes after the system marks a non-temporary address down because it conflicts with the same address in a remote system. The local system sends out probes periodically to test whether the conflict persists. If the probe receives no reply, the conflict is considered cleared and the address is marked up again.

Default

300,000 milliseconds

Range

0-360,000

Dynamic?

Yes

When to Change

Never

Commitment Level

Unstable

_max_defend Parameter

Description

The number of times an IP address is defended if the address conflicts with another system's IP address. Defense of the address occurs within the time specified in _defend_interval Parameter.

Default

3 counts

Range

0-1,000

Dynamic?

Yes

When to Change

Never

Commitment Level

Unstable

_max_temp_defend Parameter

Description

Number of times a system defends a temporary local address or a DHCP controlled address when that address is in conflict with another system's IP address. When the value of _max_temp_defend is passed, the system gives up the address.

Default

1 count

Range

0-1,000

Dynamic?

Yes

When to Change

Never

Commitment Level

Unstable

arp-publish-count/ndp-unsolicit-count Parameter

Description

Number of unsolicited IPv4 ARP announcements or IPv6 NDP advertisements transmitted over an interface to update the address cache of network peers. The announcements are sent after a local IP address has been successfully brought up and are transmitted at intervals controlled by the arp-publish-interval/ndp-unsolicit-interval Parameter parameters.

Default

3 packets

Range

1-20

Dynamic?

Yes

When to Change

Never

Commitment Level

Stable

arp-publish-interval/ndp-unsolicit-interval Parameter

Description

Time between successive unsolicited IPv4 ARP announcements or IPv6 NDP advertisements that are sent after a local IP address is successfully brought up. The announcements are sent to update the address cache of network peers.

Default

2,000 milliseconds

Range

1,000-20,000

Dynamic?

Yes

When to Change

Never

Commitment Level

Stable

IP Tunable Parameters With Additional Cautions

Changing the following parameters is not recommended.

_icmp_return_data_bytes Parameter (IPv4 or IPv6)

Description

When IPv4 or IPv6 sends an ICMPv4 or ICMPv6 error message, it includes the IP header of the packet that caused the error message. This parameter controls how many extra bytes of the packet beyond the IPv4 or IPv6 header are included in the ICMPv4 or ICMPv6 error message.

Default

64 for IPv4

1,280 for IPv6

Range

8-65,536 for IPv4

8-1,280 for IPv6

Dynamic?

Yes

When to Change

Do not change the value. Including more information in an ICMP error message might help in diagnosing network problems. If this feature is needed, increase the value.

Commitment Level

Unstable

_pathmtu_interval Parameter

Description

Specifies the interval in milliseconds at which IP flushes the path maximum transfer unit (PMTU) discovery information, and tries to rediscover PMTU.

Refer to RFC 1191 on PMTU discovery.

Default

1,200 milliseconds (20 minutes)

Range

2-999,999,999

Dynamic?

Yes

When to Change

Do not change this value.

Commitment Level

Unstable