net/Config.help

CONFIG_FILTER
  The Linux Socket Filter is derived from the Berkeley Packet Filter.
  If you say Y here, user-space programs can attach a filter to any
  socket and thereby tell the kernel that it should allow or disallow
  certain types of data to get through the socket.  Linux Socket
  Filtering works on all socket types except TCP for now.  See the
  text file <file:Documentation/networking/filter.txt> for more
  information.

  You need to say Y here if you want to use PPP packet filtering
  (see the CONFIG_PPP_FILTER option below).

  If unsure, say N.

CONFIG_NETFILTER
  Netfilter is a framework for filtering and mangling network packets
  that pass through your Linux box.

  The most common use of packet filtering is to run your Linux box as
  a firewall protecting a local network from the Internet. The type of
  firewall provided by this kernel support is called a "packet
  filter", which means that it can reject individual network packets
  based on type, source, destination etc. The other kind of firewall,
  a "proxy-based" one, is more secure but more intrusive and more
  bothersome to set up; it inspects the network traffic much more
  closely, modifies it and has knowledge about the higher level
  protocols, which a packet filter lacks. Moreover, proxy-based
  firewalls often require changes to the programs running on the local
  clients. Proxy-based firewalls don't need support by the kernel, but
  they are often combined with a packet filter, which only works if
  you say Y here.

  You should also say Y here if you intend to use your Linux box as
  the gateway to the Internet for a local network of machines without
  globally valid IP addresses. This is called "masquerading": if one
  of the computers on your local network wants to send something to
  the outside, your box can "masquerade" as that computer, i.e. it
  forwards the traffic to the intended outside destination, but
  modifies the packets to make it look like they came from the
  firewall box itself. It works both ways: if the outside host
  replies, the Linux box will silently forward the traffic to the
  correct local computer. This way, the computers on your local net
  are completely invisible to the outside world, even though they can
  reach the outside and can receive replies. It is even possible to
  run globally visible servers from within a masqueraded local network
  using a mechanism called portforwarding. Masquerading is also often
  called NAT (Network Address Translation).

  Another use of Netfilter is in transparent proxying: if a machine on
  the local network tries to connect to an outside host, your Linux
  box can transparently forward the traffic to a local server,
  typically a caching proxy server.

  Various modules exist for netfilter which replace the previous
  masquerading (ipmasqadm), packet filtering (ipchains), transparent
  proxying, and portforwarding mechanisms. Please see
  <file:Documentation/Changes> under "iptables" for the location of
  these packages.

  Make sure to say N to "Fast switching" below if you intend to say Y
  here, as Fast switching currently bypasses netfilter.

  Chances are that you should say Y here if you compile a kernel which
  will run as a router and N for regular hosts. If unsure, say N.

CONFIG_NETFILTER_DEBUG
  You can say Y here if you want to get additional messages useful in
  debugging the netfilter code.

CONFIG_INET
  These are the protocols used on the Internet and on most local
  Ethernets. It is highly recommended to say Y here (this will enlarge
  your kernel by about 144 KB), since some programs (e.g. the X window
  system) use TCP/IP even if your machine is not connected to any
  other computer. You will get the so-called loopback device which
  allows you to ping yourself (great fun, that!).

  For an excellent introduction to Linux networking, please read the
  NET-3-HOWTO, available from
  <http://www.linuxdoc.org/docs.html#howto>.

  This option is also necessary if you want to use the full power of
  term (term is a program which gives you almost full Internet
  connectivity if you have a regular dial up shell account on some
  Internet connected Unix computer; for more information, read
  <http://www.bart.nl/~patrickr/term-howto/Term-HOWTO.html>).

  If you say Y here and also to "/proc file system support" and
  "Sysctl support" below, you can change various aspects of the
  behavior of the TCP/IP code by writing to the (virtual) files in
  /proc/sys/net/ipv4/*; the options are explained in the file
  <file:Documentation/networking/ip-sysctl.txt>.

  Short answer: say Y.

CONFIG_UNIX
  If you say Y here, you will include support for Unix domain sockets;
  sockets are the standard Unix mechanism for establishing and
  accessing network connections.  Many commonly used programs such as
  the X Window system and syslog use these sockets even if your
  machine is not connected to any network.  Unless you are working on
  an embedded system or something similar, you therefore definitely
  want to say Y here.

  However, the socket support is also available as a module ( = code
  which can be inserted in and removed from the running kernel
  whenever you want).  If you want to compile it as a module, say M
  here and read <file:Documentation/modules.txt>. The module will be
  called unix.o.  If you try building this as a module and you have
  said Y to "Kernel module loader support" above, be sure to add
  'alias net-pf-1 unix' to your /etc/modules.conf file. Note that
  several important services won't work correctly if you say M here
  and then neglect to load the module.

  Say Y unless you know what you are doing.

CONFIG_IPV6
  This is experimental support for the next version of the Internet
  Protocol: IP version 6 (also called IPng "IP next generation").
  Features of this new protocol include: expanded address space,
  authentication and privacy, and seamless interoperability with the
  current version of IP (IP version 4). For general information about
  IPv6, see <http://playground.sun.com/pub/ipng/html/ipng-main.html>;
  for specific information about IPv6 under Linux read the HOWTO at
  <http://www.bieringer.de/linux/IPv6/> and the file net/ipv6/README
  in the kernel source.

  If you want to use IPv6, please upgrade to the newest net-tools as
  given in <file:Documentation/Changes>. You will still be able to do
  regular IPv4 networking as well.

  This protocol support is also available as a module ( = code which
  can be inserted in and removed from the running kernel whenever you
  want). The module will be called ipv6.o. If you want to compile it
  as a module, say M here and read <file:Documentation/modules.txt>.

  It is safe to say N here for now.

CONFIG_IPX
  This is support for the Novell networking protocol, IPX, commonly
  used for local networks of Windows machines.  You need it if you
  want to access Novell NetWare file or print servers using the Linux
  Novell client ncpfs (available from
  <ftp://platan.vc.cvut.cz/pub/linux/ncpfs/>) or from
  within the Linux DOS emulator DOSEMU (read the DOSEMU-HOWTO,
  available from <http://www.linuxdoc.org/docs.html#howto>).  In order
  to do the former, you'll also have to say Y to "NCP file system
  support", below.

  IPX is similar in scope to IP, while SPX, which runs on top of IPX,
  is similar to TCP. There is also experimental support for SPX in
  Linux (see "SPX networking", below).

  To turn your Linux box into a fully featured NetWare file server and
  IPX router, say Y here and fetch either lwared from
  <ftp://ibiblio.org/pub/Linux/system/network/daemons/> or
  mars_nwe from <ftp://www.compu-art.de/mars_nwe/>. For more
  information, read the IPX-HOWTO available from
  <http://www.linuxdoc.org/docs.html#howto>.

  General information about how to connect Linux, Windows machines and
  Macs is on the WWW at <http://www.eats.com/linux_mac_win.html>.

  The IPX driver would enlarge your kernel by about 16 KB. This driver
  is also available as a module ( = code which can be inserted in and
  removed from the running kernel whenever you want).  The module will
  be called ipx.o.  If you want to compile it as a module, say M here
  and read <file:Documentation/modules.txt>.  Unless you want to
  integrate your Linux box with a local Novell network, say N.

CONFIG_DECNET
  The DECnet networking protocol was used in many products made by
  Digital (now Compaq).  It provides reliable stream and sequenced
  packet communications over which run a variety of services similar
  to those which run over TCP/IP.

  To find some tools to use with the kernel layer support, please
  look at Patrick Caulfield's web site:
  <http://linux.dreamtime.org/decnet/>.

  More detailed documentation is available in
  <file:Documentation/networking/decnet.txt>.

  Be sure to say Y to "/proc file system support" and "Sysctl support"
  below when using DECnet, since you will need sysctl support to aid
  in configuration at run time.

  The DECnet code is also available as a module ( = code which can be
  inserted in and removed from the running kernel whenever you want).
  The module is called decnet.o.

CONFIG_ATALK
  AppleTalk is the protocol that Apple computers can use to communicate
  on a network.  If your Linux box is connected to such a network and you
  wish to connect to it, say Y.  You will need to use the netatalk package
  so that your Linux box can act as a print and file server for Macs as
  well as access AppleTalk printers.  Check out
  <http://www.zettabyte.net/netatalk/> on the WWW for details.
  EtherTalk is the name used for AppleTalk over Ethernet and the
  cheaper and slower LocalTalk is AppleTalk over a proprietary Apple
  network using serial links.  EtherTalk and LocalTalk are fully
  supported by Linux.

  General information about how to connect Linux, Windows machines and
  Macs is on the WWW at <http://www.eats.com/linux_mac_win.html>.  The
  NET-3-HOWTO, available from
  <http://www.linuxdoc.org/docs.html#howto>, contains valuable
  information as well.

  This driver is also available as a module ( = code which can be
  inserted in and removed from the running kernel whenever you want).
  The module is called appletalk.o.  If you want to compile it as a
  module, say M here and read <file:Documentation/modules.txt>.  You
  almost certainly want to compile it as a module so you can restart
  your AppleTalk stack without rebooting your machine.  I hear that
  the GNU boycott of Apple is over, so even politically correct people
  are allowed to say Y here.

CONFIG_X25
  X.25 is a set of standardized network protocols, similar in scope to
  frame relay; the one physical line from your box to the X.25 network
  entry point can carry several logical point-to-point connections
  (called "virtual circuits") to other computers connected to the X.25
  network. Governments, banks, and other organizations tend to use it
  to connect to each other or to form Wide Area Networks (WANs). Many
  countries have public X.25 networks. X.25 consists of two
  protocols: the higher level Packet Layer Protocol (PLP) (say Y here
  if you want that) and the lower level data link layer protocol LAPB
  (say Y to "LAPB Data Link Driver" below if you want that).

  You can read more about X.25 at <http://www.sangoma.com/x25.htm> and
  <http://www.cisco.com/univercd/data/doc/software/11_0/rpcg/cx25.htm>.
  Information about X.25 for Linux is contained in the files
  <file:Documentation/networking/x25.txt> and
  <file:Documentation/networking/x25-iface.txt>.

  One connects to an X.25 network either with a dedicated network card
  using the X.21 protocol (not yet supported by Linux) or one can do
  X.25 over a standard telephone line using an ordinary modem (say Y
  to "X.25 async driver" below) or over Ethernet using an ordinary
  Ethernet card and either the 802.2 LLC protocol (say Y to "802.2
  LLC" below) or LAPB over Ethernet (say Y to "LAPB Data Link Driver"
  and "LAPB over Ethernet driver" below).

  If you want to compile this driver as a module ( = code which can be
  inserted in and removed from the running kernel whenever you want),
  say M here and read <file:Documentation/modules.txt>.  The module
  will be called x25.o. If unsure, say N.

CONFIG_LAPB
  Link Access Procedure, Balanced (LAPB) is the data link layer (i.e.
  the lower) part of the X.25 protocol. It offers a reliable
  connection service to exchange data frames with one other host, and
  it is used to transport higher level protocols (mostly X.25 Packet
  Layer, the higher part of X.25, but others are possible as well).
  Usually, LAPB is used with specialized X.21 network cards, but Linux
  currently supports LAPB only over Ethernet connections. If you want
  to use LAPB connections over Ethernet, say Y here and to "LAPB over
  Ethernet driver" below. Read
  <file:Documentation/networking/lapb-module.txt> for technical
  details.

  If you want to compile this driver as a module though ( = code which
  can be inserted in and removed from the running kernel whenever you
  want), say M here and read <file:Documentation/modules.txt>.  The
  module will be called lapb.o.  If unsure, say N.

CONFIG_LLC
  This is a Logical Link Layer protocol used for X.25 connections over
  Ethernet, using ordinary Ethernet cards.

CONFIG_NET_DIVERT
  The Frame Diverter allows you to divert packets from the
  network, that are not aimed at the interface receiving it (in
  promisc. mode). Typically, a Linux box setup as an Ethernet bridge
  with the Frames Diverter on, can do some *really* transparent www
  caching using a Squid proxy for example.

  This is very useful when you don't want to change your router's
  config (or if you simply don't have access to it).

  The other possible usages of diverting Ethernet Frames are
  numberous:
   - reroute smtp traffic to another interface
   - traffic-shape certain network streams
   - transparently proxy smtp connections
   - etc...

  For more informations, please refer to:
    <http://diverter.sourceforge.net/>
    <http://perso.wanadoo.fr/magpie/EtherDivert.html>

  If unsure, say N.

CONFIG_BRIDGE
  If you say Y here, then your Linux box will be able to act as an
  Ethernet bridge, which means that the different Ethernet segments it
  is connected to will appear as one Ethernet to the participants.
  Several such bridges can work together to create even larger
  networks of Ethernets using the IEEE 802.1 spanning tree algorithm.
  As this is a standard, Linux bridges will cooperate properly with
  other third party bridge products.

  In order to use the Ethernet bridge, you'll need the bridge
  configuration tools; see <file:Documentation/networking/bridge.txt>
  for location. Please read the Bridge mini-HOWTO for more
  information.

  Note that if your box acts as a bridge, it probably contains several
  Ethernet devices, but the kernel is not able to recognize more than
  one at boot time without help; for details read the Ethernet-HOWTO,
  available from in <http://www.linuxdoc.org/docs.html#howto>.

  If you want to compile this code as a module ( = code which can be
  inserted in and removed from the running kernel whenever you want),
  say M here and read <file:Documentation/modules.txt>.  The module
  will be called bridge.o.

  If unsure, say N.

CONFIG_PACKET
  The Packet protocol is used by applications which communicate
  directly with network devices without an intermediate network
  protocol implemented in the kernel, e.g. tcpdump.  If you want them
  to work, choose Y.

  This driver is also available as a module called af_packet.o ( =
  code which can be inserted in and removed from the running kernel
  whenever you want).  If you want to compile it as a module, say M
  here and read <file:Documentation/modules.txt>; if you use modprobe
  or kmod, you may also want to add "alias net-pf-17 af_packet" to
  /etc/modules.conf.

  If unsure, say Y.

CONFIG_PACKET_MMAP
  If you say Y here, the Packet protocol driver will use an IO
  mechanism that results in faster communication.

  If unsure, say N.

CONFIG_NETLINK_DEV
  This option will be removed soon. Any programs that want to use
  character special nodes like /dev/tap0 or /dev/route (all with major
  number 36) need this option, and need to be rewritten soon to use
  the real netlink socket.
  This is a backward compatibility option, choose Y for now.

CONFIG_ATM
  ATM is a high-speed networking technology for Local Area Networks
  and Wide Area Networks.  It uses a fixed packet size and is
  connection oriented, allowing for the negotiation of minimum
  bandwidth requirements.

  In order to participate in an ATM network, your Linux box needs an
  ATM networking card. If you have that, say Y here and to the driver
  of your ATM card below.

  Note that you need a set of user-space programs to actually make use
  of ATM.  See the file <file:Documentation/networking/atm.txt> for
  further details.

CONFIG_ATM_CLIP
  Classical IP over ATM for PVCs and SVCs, supporting InARP and
  ATMARP. If you want to communication with other IP hosts on your ATM
  network, you will typically either say Y here or to "LAN Emulation
  (LANE)" below.

CONFIG_ATM_CLIP_NO_ICMP
  Normally, an "ICMP host unreachable" message is sent if a neighbour
  cannot be reached because there is no VC to it in the kernel's
  ATMARP table. This may cause problems when ATMARP table entries are
  briefly removed during revalidation. If you say Y here, packets to
  such neighbours are silently discarded instead.

CONFIG_ATM_LANE
  LAN Emulation emulates services of existing LANs across an ATM
  network. Besides operating as a normal ATM end station client, Linux
  LANE client can also act as an proxy client bridging packets between
  ELAN and Ethernet segments. You need LANE if you want to try MPOA.

CONFIG_ATM_MPOA
  Multi-Protocol Over ATM allows ATM edge devices such as routers,
  bridges and ATM attached hosts establish direct ATM VCs across
  subnetwork boundaries. These shortcut connections bypass routers
  enhancing overall network performance.

CONFIG_ECONET
  Econet is a fairly old and slow networking protocol mainly used by
  Acorn computers to access file and print servers. It uses native
  Econet network cards. AUN is an implementation of the higher level
  parts of Econet that runs over ordinary Ethernet connections, on
  top of the UDP packet protocol, which in turn runs on top of the
  Internet protocol IP.

  If you say Y here, you can choose with the next two options whether
  to send Econet/AUN traffic over a UDP Ethernet connection or over
  a native Econet network card.

  This driver is also available as a module ( = code which can be
  inserted in and removed from the running kernel whenever you want).
  The module will be called econet.o. If you want to compile it as a
  module, say M here and read <file:Documentation/modules.txt>.

CONFIG_ECONET_AUNUDP
  Say Y here if you want to send Econet/AUN traffic over a UDP
  connection (UDP is a packet based protocol that runs on top of the
  Internet protocol IP) using an ordinary Ethernet network card.

CONFIG_ECONET_NATIVE
  Say Y here if you have a native Econet network card installed in
  your computer.

CONFIG_WAN_ROUTER
  Wide Area Networks (WANs), such as X.25, frame relay and leased
  lines, are used to interconnect Local Area Networks (LANs) over vast
  distances with data transfer rates significantly higher than those
  achievable with commonly used asynchronous modem connections.
  Usually, a quite expensive external device called a `WAN router' is
  needed to connect to a WAN.

  As an alternative, WAN routing can be built into the Linux kernel.
  With relatively inexpensive WAN interface cards available on the
  market, a perfectly usable router can be built for less than half
  the price of an external router.  If you have one of those cards and
  wish to use your Linux box as a WAN router, say Y here and also to
  the WAN driver for your card, below.  You will then need the
  wan-tools package which is available from <ftp://ftp.sangoma.com/>.
  Read <file:Documentation/networking/wan-router.txt> for more
  information.

  The WAN routing support is also available as a module called
  wanrouter.o ( = code which can be inserted in and removed from the
  running kernel whenever you want).  If you want to compile it as a
  module, say M here and read <file:Documentation/modules.txt>.

  If unsure, say N.

CONFIG_NET_FASTROUTE
  Saying Y here enables direct NIC-to-NIC (NIC = Network Interface
  Card) data transfers on the local network, which is fast.

  IMPORTANT NOTE: This option is NOT COMPATIBLE with "Network packet
  filtering" (CONFIG_NETFILTER). Say N here if you say Y there.

  However, it will work with all options in the "Advanced router"
  section (except for "Use TOS value as routing key" and
  "Use FWMARK value as routing key").

  At the moment, few devices support fast switching (tulip is one of
  them, a modified 8390 driver can be found at
  <ftp://ftp.inr.ac.ru/ip-routing/fastroute/fastroute-8390.tar.gz>).

  If unsure, say N.

CONFIG_NET_HW_FLOWCONTROL
  This option enables NIC (Network Interface Card) hardware throttling
  during periods of extremal congestion. At the moment only a couple
  of device drivers support it (really only one -- tulip, a modified
  8390 driver can be found at
  <ftp://ftp.inr.ac.ru/ip-routing/fastroute/fastroute-8390.tar.gz>).

  Really, this option is applicable to any machine attached to a fast
  enough network, and even a 10 Mb NIC is able to kill a not very slow
  box, such as a 120MHz Pentium.

  However, do not say Y here if you did not experience any serious
  problems.

CONFIG_NET_SCHED
  When the kernel has several packets to send out over a network
  device, it has to decide which ones to send first, which ones to
  delay, and which ones to drop. This is the job of the packet
  scheduler, and several different algorithms for how to do this
  "fairly" have been proposed.

  If you say N here, you will get the standard packet scheduler, which
  is a FIFO (first come, first served). If you say Y here, you will be
  able to choose from among several alternative algorithms which can
  then be attached to different network devices. This is useful for
  example if some of your network devices are real time devices that
  need a certain minimum data flow rate, or if you need to limit the
  maximum data flow rate for traffic which matches specified criteria.
  This code is considered to be experimental.

  To administer these schedulers, you'll need the user-level utilities
  from the package iproute2+tc at <ftp://ftp.inr.ac.ru/ip-routing/>.
  That package also contains some documentation; for more, check out
  <http://snafu.freedom.org/linux2.2/iproute-notes.html>.

  This Quality of Service (QoS) support will enable you to use
  Differentiated Services (diffserv) and Resource Reservation Protocol
  (RSVP) on your Linux router if you also say Y to "QoS support",
  "Packet classifier API" and to some classifiers below. Documentation
  and software is at <http://icawww1.epfl.ch/linux-diffserv/>.

  If you say Y here and to "/proc file system" below, you will be able
  to read status information about packet schedulers from the file
  /proc/net/psched.

  The available schedulers are listed in the following questions; you
  can say Y to as many as you like. If unsure, say N now.

CONFIG_NET_PROFILE
  If you say Y here and to "/proc file system support" below, some
  obscure and undocumented information about the network code's
  performance will be written to /proc/net/profile. If you don't know
  what it is about, you don't need it: say N.