proc_sys_net_ipv4(5)

🦋 NAME 🦋

/proc/sys/net/ipv4/ — it's giving IPv4, bestie 💖

This lil page lives in the File Formats Manual section (that's section 5, iykyk).

---

✨ DESCRIPTION ✨

Okay so, plot twist: the IP protocol has a whole set of /proc interfaces that let you configure certain global parameters. You get at them by reading or writing the files inside the directory /proc/sys/net/ipv4/. That's it. That's the door. 🚪✨

And real quick, because the internet is full of chaos: when something here is described as a Boolean, it takes an integer value. A nonzero value means "true" (the option is enabled, she's ON 💅), and a zero value means "false" (the option is disabled, she's asleep 😴).

---

🌸 /proc/sys/net/ipv4/ip_always_defrag 🌸

(Boolean; since Linux 2.2.13)

History lesson, bestie: New with Linux 2.2.13. In earlier kernel versions this feature was controlled at compile time by the CONFIG_IP_ALWAYS_DEFRAG option. This option is not present in Linux 2.4.x and later. So if you're on anything modern, she's gone, she has left the chat 👋

When this boolean flag is enabled (not equal 0), incoming fragments — and by fragments we mean parts of IP packets that got chopped up because some host between origin and destination decided the packets were too large and cut them into pieces 🔪 — will be reassembled (defragmented) before being processed, even if they're about to be forwarded.

Enable only if you're running either a firewall that is the sole link to your network, or a transparent proxy. Never ever use it for a normal router or host. Otherwise fragmented communication can be disturbed if the fragments travel over different links. And defragmentation also has a large memory and CPU time cost — she's expensive 💸😭

This is automagically turned on when masquerading or transparent proxying are configured. Magic. ✨

---

💀 /proc/sys/net/ipv4/ip_autoconfig 💀

(since Linux 2.2 to Linux 2.6.17)

Not documented. That's the whole vibe. Nobody wrote it down. Moving on 🙈

---

🎀 /proc/sys/net/ipv4/ip_default_ttl 🎀

(integer; default: 64; since Linux 2.2)

Sets the default time-to-live value of outgoing packets. And yes, you can change it per socket with the IP_TTL option. Flexible queen 👑

---

🦋 /proc/sys/net/ipv4/ip_dynaddr 🦋

(Boolean; default: disabled; since Linux 2.0.31)

Enables dynamic socket address and masquerading entry rewriting on interface address change. Super useful for a dialup interface with changing IP addresses — the classic glow-up-when-your-IP-changes situation.

The values, let her explain herself:

• 0 means no rewriting
• 1 turns it on
• 2 enables verbose mode 🔊

---

🔥 /proc/sys/net/ipv4/ip_forward 🔥

(Boolean; default: disabled; since Linux 1.2)

Enables IP forwarding with a boolean flag. And plot twist: IP forwarding can also be set on a per-interface basis, so you're not locked in 💅

---

🌈 /proc/sys/net/ipv4/ip_local_port_range 🌈

(since Linux 2.2)

This file contains two integers that define the default local port range allocated to sockets that aren't explicitly bound to a port number — aka the range used for ephemeral ports. Living on the edge, ephemeral, iconic ✨

An ephemeral port gets allocated to a socket in these circumstances, and I need you to memorize them because this is the whole point of the page:

• the port number in a socket address is specified as 0 when calling bind(2);
• listen(2) is called on a stream socket that was not previously bound;
• connect(2) was called on a socket that was not previously bound;
• sendto(2) is called on a datagram socket that was not previously bound.

Allocation of ephemeral ports starts with the first number in /proc/sys/net/ipv4/ip_local_port_range and ends with the second number. And if the range of ephemeral ports is exhausted, then the relevant system call returns an error — but see BUGS 👀

⚠️ Heads up, bestie: the port range in /proc/sys/net/ipv4/ip_local_port_range should not conflict with the ports used by masquerading (although the case is handled, so she's forgiving). Also, arbitrary choices may cause problems with some firewall packet filters that make assumptions about the local ports in use. The first number should be at least greater than 1024, or better, greater than 4096, to avoid clashes with well known ports and to minimize firewall problems. Don't be chaotic about it 🙏

---

🧚 /proc/sys/net/ipv4/ip_no_pmtu_disc 🧚

(Boolean; default: disabled; since Linux 2.2)

If enabled, don't do Path MTU Discovery for TCP sockets by default.

Now, Path MTU discovery may fail if misconfigured firewalls (that drop all ICMP packets) or misconfigured interfaces (e.g., a point-to-point link where the both ends don't agree on the MTU) are on the path. But listen — it is better to fix the broken routers on the path than to turn off Path MTU Discovery globally, because not doing it incurs a high cost to the network. Fix the router, don't punish the network 💅

---

💜 /proc/sys/net/ipv4/ip_nonlocal_bind 💜

(Boolean; default: disabled; since Linux 2.4)

If set, allows processes to bind(2) to nonlocal IP addresses, which can be quite useful, but may break some applications 💀

Useful and dangerous at the same time, truly main character energy.

---

⭐ /proc/sys/net/ipv4/ip6frag_time ⭐

(integer; default: 30)

Time in seconds to keep an IPv6 fragment in memory. Your girl has a timer ⏳

---

🍓 /proc/sys/net/ipv4/ip6frag_secret_interval 🍓

(integer; default: 600)

Regeneration interval (in seconds) of the hash secret (or lifetime for the hash secret) for IPv6 fragments. Yes, the IPv4 directory has IPv6 fragment knobs in it, don't ask, just accept her 🌸

---

👑 /proc/sys/net/ipv4/ipfrag_high_thresh 👑

👑 /proc/sys/net/ipv4/ipfrag_low_thresh 👑

(integer)

If the amount of queued IP fragments reaches /proc/sys/net/ipv4/ipfrag_high_thresh, the queue is pruned down to /proc/sys/net/ipv4/ipfrag_low_thresh. Contains an integer with the number of bytes. High thresh and low thresh, the duo of the century 🫶📏

---

🐇 /proc/sys/net/ipv4/neigh/* 🐇

See arp(7). Yeah, that's the whole thing. Go read arp(7), bestie 💖

---

🫶 SEE ALSO 🫶

• proc(5)
• proc_sys_net(5)
• ip(7)

---

And that's the page!! 🎀✨ This was brought to you by Linux man-pages 6.20, dated 2025-12-25 — yes, Christmas day, she's a holiday icon 🎄👑 Go forth and sysctl responsibly, no cap 💅💖