tcp(7)

✨ tcp — the TCP protocol, bestie edition ✨

okay so this is the tcp(7) manual page, straight out of the Miscellaneous Information Manual, and we're gonna walk through the entire thing together because TCP is literally the main character of the internet and you deserve to know her 💅

---

🎀 NAME 🎀

tcp — the TCP protocol. that's it, that's the name, she's iconic, periodt.

---

🌸 SYNOPSIS 🌸

#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/tcp.h>

tcp_socket = socket(AF_INET, SOCK_STREAM, 0);

like, that's the whole vibe. you make a socket, you get TCP. slay.

---

💖 DESCRIPTION 💖

so this is an implementation of the TCP protocol as defined in RFC 793, RFC 1122 and RFC 2001, plus the NewReno and SACK extensions. she provides a reliable, stream-oriented, full-duplex connection between two sockets, sitting on top of ip(7), and she does it for both v4 and v6 versions. ngl, that's range.

TCP guarantees that the data arrives in order and she retransmits lost packets. she generates and checks a per-packet checksum to catch transmission errors. 🛡️

heads up bestie: TCP does not preserve record boundaries. so if you send three writes, you might receive them smushed together or chopped up. that's just her vibe. do not come for her about it 😭

A newly created TCP socket has no remote or local address and is not fully specified. to create an outgoing TCP connection, use connect(2) to establish a connection to another TCP socket. to receive new incoming connections, first bind(2) the socket to a local address and port, and then call listen(2) to put the socket into the listening state.

after that, a new socket for each incoming connection can be accepted using accept(2). a socket which has had accept(2) or connect(2) successfully called on it is fully specified and may transmit data. 🫶

and no, you literally cannot transmit data on listening or not-yet-connected sockets. she said no. 🚫

Linux supports the RFC 1323 TCP high performance extensions. these include:

• Protection Against Wrapped Sequence Numbers (PAWS)
• Window Scaling
• Timestamps

window scaling allows the use of large (> 64 kB) TCP windows in order to support links with high latency or bandwidth. to make use of them, the send and receive buffer sizes must be increased. they can be set globally with the /proc/sys/net/ipv4/tcp_wmem and /proc/sys/net/ipv4/tcp_rmem files, or on individual sockets by using the SO_SNDBUF and SO_RCVBUF socket options with the setsockopt(2) call.

The maximum sizes for socket buffers declared via the SO_SNDBUF and SO_RCVBUF mechanisms are limited by the values in the /proc/sys/net/core/rmem_max and /proc/sys/net/core/wmem_max files. 🎯

⚠️ note that TCP actually allocates twice the size of the buffer requested in the setsockopt(2) call, and so a succeeding getsockopt(2) call will not return the same size of buffer as requested in the setsockopt(2) call. TCP uses the extra space for administrative purposes and internal kernel structures, and the /proc file values reflect the larger sizes compared to the actual TCP windows. it's giving "why is my math not mathing" energy, i know, but that's fr fr how it works 💀

on individual connections, the socket buffer size must be set prior to the listen(2) or connect(2) calls in order to have it take effect. see socket(7) for more info.

---

🌈 urgent data 🌈

TCP supports urgent data. urgent data is used to signal the receiver that some important message is part of the data stream and that it should be processed ASAP. to send urgent data, specify the MSG_OOB option to send(2).

when urgent data is received, the kernel sends a SIGURG signal to the process or process group that has been set as the socket "owner" using the SIOCSPGRP or FIOSETOWN ioctls (or the POSIX.1-specified fcntl(2) F_SETOWN operation).

when the SO_OOBINLINE socket option is enabled, urgent data is put into the normal data stream (a program can test for its location using the SIOCATMARK ioctl described below), otherwise it can be received only when the MSG_OOB flag is set for recv(2) or recvmsg(2).

When out-of-band data is present, select(2) indicates the file descriptor as having an exceptional condition and poll(2) indicates a POLLPRI event. 👑

Linux 2.4 introduced a number of changes for improved throughput and scaling, as well as enhanced functionality. some of these features include:

• support for zero-copy sendfile(2)
• Explicit Congestion Notification
• new management of TIME_WAIT sockets
• keep-alive socket options
• support for Duplicate SACK extensions

---

🦋 Address formats 🦋

TCP is built on top of IP (see ip(7)). the address formats defined by ip(7) apply to TCP.

TCP supports point-to-point communication only. broadcasting and multicasting are not supported. she's exclusive, sorry. 💅

---

🧚 /proc interfaces 🧚

System-wide TCP parameter settings can be accessed by files in the directory /proc/sys/net/ipv4/. in addition, most IP /proc interfaces also apply to TCP; see ip(7).

Variables described as Boolean take an integer value, with a nonzero value ("true") meaning that the corresponding option is enabled, and a zero value ("false") meaning that the option is disabled.

---

✨ tcp_abc ✨

(Integer; default: 0; Linux 2.6.15 to Linux 3.8)

Control the Appropriate Byte Count (ABC), defined in RFC 3465. ABC is a way of increasing the congestion window (cwnd) more slowly in response to partial acknowledgements. possible values are:

• 0 — increase cwnd once per acknowledgement (no ABC)
• 1 — increase cwnd once per acknowledgement of full sized segment
• 2 — allow increase cwnd by two if acknowledgement is of two segments to compensate for delayed acknowledgements.

---

💀 tcp_abort_on_overflow 💀

(Boolean; default: disabled; since Linux 2.4)

Enable resetting connections if the listening service is too slow and unable to keep up and accept them. it means that if overflow occurred due to a burst, the connection will recover.

⚠️ Enable this option only if you are really sure that the listening daemon cannot be tuned to accept connections faster. enabling this option can harm the clients of your server. like, actually harm them. not cute. 🙈

---

🍓 tcp_adv_win_scale 🍓

(integer; default: 2; since Linux 2.4)

Count buffering overhead as bytes/2^tcp_adv_win_scale, if tcp_adv_win_scale is greater than 0; or bytes-bytes/2^(-tcp_adv_win_scale), if tcp_adv_win_scale is less than or equal to zero.

The socket receive buffer space is shared between the application and kernel. TCP maintains part of the buffer as the TCP window — this is the size of the receive window advertised to the other end. the rest of the space is used as the "application" buffer, used to isolate the network from scheduling and application latencies.

the tcp_adv_win_scale default value of 2 implies that the space used for the application buffer is one fourth that of the total. math girlie said what she said 🎀

---

🌟 tcp_allowed_congestion_control 🌟

(String; default: see text; since Linux 2.4.20)

Show/set the congestion control algorithm choices available to unprivileged processes (see the description of the TCP_CONGESTION socket option). the items in the list are separated by white space and terminated by a newline character.

The list is a subset of those listed in tcp_available_congestion_control. the default value for this list is "reno" plus the default setting of tcp_congestion_control.

---

🫶 tcp_autocorking 🫶

(Boolean; default: enabled; since Linux 3.14)

If this option is enabled, the kernel tries to coalesce small writes (from consecutive write(2) and sendmsg(2) calls) as much as possible, in order to decrease the total number of sent packets.

Coalescing is done if at least one prior packet for the flow is waiting in Qdisc queues or device transmit queue. applications can still use the TCP_CORK socket option to obtain optimal behavior when they know how/when to uncork their sockets. 🍾

---

💜 tcp_available_congestion_control 💜

(String; read-only; since Linux 2.4.20)

Show a list of the congestion-control algorithms that are registered. the items in the list are separated by white space and terminated by a newline character.

This list is a limiting set for the list in tcp_allowed_congestion_control. more congestion-control algorithms may be available as modules, but not loaded. 👀

---

🌸 tcp_app_win 🌸

(integer; default: 31; since Linux 2.4)

This variable defines how many bytes of the TCP window are reserved for buffering overhead.

A maximum of (window/2^tcp_app_win, mss) bytes in the window are reserved for the application buffer. a value of 0 implies that no amount is reserved.

---

⭐ tcp_base_mss ⭐

(Integer; default: 512; since Linux 2.6.17)

The initial value of search_low to be used by the packetization layer Path MTU discovery (MTU probing). if MTU probing is enabled, this is the initial MSS used by the connection.

---

👑 tcp_bic 👑

(Boolean; default: disabled; Linux 2.4.27/2.6.6 to Linux 2.6.13)

Enable the BIC TCP congestion control algorithm. BIC-TCP is a sender-side-only change that ensures a linear RTT fairness under large windows while offering both scalability and bounded TCP-friendliness.

The protocol combines two schemes called additive increase and binary search increase. when the congestion window is large, additive increase with a large increment ensures linear RTT fairness as well as good scalability. under small congestion windows, binary search increase provides TCP friendliness.

---

🎀 tcp_bic_low_window 🎀

(integer; default: 14; Linux 2.4.27/2.6.6 to Linux 2.6.13)

Set the threshold window (in packets) where BIC TCP starts to adjust the congestion window. below this threshold BIC TCP behaves the same as the default TCP Reno.

---

🌈 tcp_bic_fast_convergence 🌈

(Boolean; default: enabled; Linux 2.4.27/2.6.6 to Linux 2.6.13)

Force BIC TCP to more quickly respond to changes in congestion window. allows two flows sharing the same connection to converge more rapidly.

---

🔥 tcp_congestion_control 🔥

(String; default: see text; since Linux 2.4.13)

Set the default congestion-control algorithm to be used for new connections. the algorithm "reno" is always available, but additional choices may be available depending on kernel configuration. the default value for this file is set as part of kernel configuration.

---

💫 tcp_dma_copybreak 💫

(integer; default: 4096; since Linux 2.6.24)

Lower limit, in bytes, of the size of socket reads that will be offloaded to a DMA copy engine, if one is present in the system and the kernel was configured with the CONFIG_NET_DMA option.

---

🎁 tcp_dsack 🎁

(Boolean; default: enabled; since Linux 2.4)

Enable RFC 2883 TCP Duplicate SACK support.

---

🚀 tcp_fastopen 🚀

(Bitmask; default: 0x1; since Linux 3.7)

Enables RFC 7413 Fast Open support. the flag is used as a bitmap with the following values:

• 0x1 — Enables client side Fast Open support
• 0x2 — Enables server side Fast Open support
• 0x4 — Allows client side to transmit data in SYN without Fast Open option
• 0x200 — Allows server side to accept SYN data without Fast Open option

---

...and bestie, there's SO much more coming, don't you dare close this tab 💖

• 0x400 — Enables Fast Open on all listeners, even the ones with no TCP_FASTOPEN socket option ✨

---

• tcp_fastopen_key (since Linux 3.7) — sets the server-side RFC 7413 Fast Open key, the one used to generate the Fast Open cookie whenever server-side Fast Open support is on 💫
• tcp_ecn (Integer; default: see below; since Linux 2.4) — turns on RFC 3168 Explicit Congestion Notification bestie, and this file takes one of these values:
  • 0 — Disable ECN. Like, don't initiate it and don't accept it either. This was the default up to and including Linux 2.6.30.
  • 1 — Enable ECN when incoming connections ask for it, and also request ECN on outgoing connection attempts.
  • 2 — Enable ECN when incoming connections ask for it, but don't request it on outgoing connections. This value is supported and it's the default since Linux 2.6.31. 👑

Okay so heads up: when it's enabled, connectivity to some destinations could get affected because of older, misbehaving middle boxes chilling along the path, and that can make connections get dropped 😭 fr fr, that's a real risk. But to facilitate and encourage deployment with option 1, and to work around that buggy equipment, the tcp_ecn_fallback option got introduced. 🫶

• tcp_ecn_fallback (Boolean; default: enabled; since Linux 4.1) — enables the RFC 3168, Section 6.1.1.1 fallback. When it's enabled, outgoing ECN-setup SYNs that time out within the normal SYN retransmission timeout get resent with CWR and ECE cleared. 🔁
• tcp_fack (Boolean; default: enabled; since Linux 2.2) — enables TCP Forward Acknowledgement support 💅
• tcp_fin_timeout (integer; default: 60; since Linux 2.2) — how many seconds to wait for a final FIN packet before the socket is forcibly closed. And yes, this is strictly a violation of the TCP specification, but it's required to prevent denial-of-service attacks. In Linux 2.2 the default value was 180.
• tcp_frto (integer; default: see below; since Linux 2.4.21/2.6) — enables F-RTO, which is an enhanced recovery algorithm for TCP retransmission timeouts (RTOs). It's especially slay in wireless environments where packet loss is usually from random radio interference instead of intermediate router congestion 🦋 See RFC 4138 for more details.

This file can have one of these values:

• 0 — Disabled. This was the default up to and including Linux 2.6.23.
• 1 — The basic version of the F-RTO algorithm is enabled.
• 2 — Enable SACK-enhanced F-RTO if the flow uses SACK. The basic version can also be used when SACK is in use, though in that case scenario(s) exist where F-RTO interacts badly with the packet counting of the SACK-enabled TCP flow. This value is the default since Linux 2.6.24. ✨

Also, before Linux 2.6.22 this parameter was a Boolean value, supporting just values 0 and 1 above.

• tcp_frto_response (integer; default: 0; since Linux 2.6.22) — when F-RTO has detected that a TCP retransmission timeout was spurious (meaning the timeout would have been avoided if TCP had set a longer retransmission timeout), TCP has several options about what to do next. Possible values:
  • 0 — Rate-halving based; a smooth and conservative response, results in halved congestion window (cwnd) and slow-start threshold (ssthresh) after one RTT.
  • 1 — Very conservative response; not recommended because even though it's valid, it interacts poorly with the rest of Linux TCP; halves cwnd and ssthresh immediately.
  • 2 — Aggressive response; undoes congestion-control measures that are now known to be unnecessary (ignoring the possibility of a lost retransmission that would require TCP to be more cautious); cwnd and ssthresh get restored to the values they had prior to the timeout.
• tcp_keepalive_intvl (integer; default: 75; since Linux 2.4) — the number of seconds between TCP keep-alive probes ⏱️
• tcp_keepalive_probes (integer; default: 9; since Linux 2.2) — the max number of TCP keep-alive probes to send before giving up and killing the connection if no response comes back from the other end 💀
• tcp_keepalive_time (integer; default: 7200; since Linux 2.2) — the number of seconds a connection needs to be idle before TCP starts sending out keep-alive probes. Keep-alives are sent only when the SO_KEEPALIVE socket option is enabled. The default is 7200 seconds (2 hours). An idle connection gets terminated after approximately an additional 11 minutes (9 probes, an interval of 75 seconds apart) when keep-alive is enabled. 🕰️

Little heads up: underlying connection tracking mechanisms and application timeouts may be much shorter. Don't get caught lacking.

• tcp_low_latency (Boolean; default: disabled; since Linux 2.4.21/2.6; obsolete since Linux 4.14) — if enabled, the TCP stack makes decisions that prefer lower latency over higher throughput. If it's disabled, then higher throughput is preferred. An example of an application where this default should be changed would be a Beowulf compute cluster. Since Linux 4.14 this file still exists, but its value is ignored. 💀 rip
• tcp_max_orphans (integer; default: see below; since Linux 2.4) — the max number of orphaned TCP sockets (not attached to any user file handle) allowed in the system. When this number gets exceeded, the orphaned connection is reset and a warning gets printed. This limit exists only to prevent simple denial-of-service attacks. Lowering this limit is not recommended. Network conditions might require you to increase the number of orphans allowed, but note that each orphan can eat up to ~64 kB of unswappable memory 😭 The default initial value is set equal to the kernel parameter NR_FILE. This initial default is adjusted depending on the memory in the system.
• tcp_max_syn_backlog (integer; default: see below; since Linux 2.2) — the max number of queued connection requests that still haven't received an acknowledgement from the connecting client. If this number gets exceeded, the kernel will start dropping requests. The default value of 256 is increased to 1024 when the memory present in the system is adequate or greater (>= 128 MB), and reduced to 128 for those systems with very low memory (<= 32 MB).

Before Linux 2.6.20, it was recommended that if this needed to be increased above 1024, the size of the SYNACK hash table (TCP_SYNQ_HSIZE) in include/net/tcp.h should be modified to keep

TCP_SYNQ_HSIZE * 16 <= tcp_max_syn_backlog

and the kernel should be recompiled. In Linux 2.6.20, the fixed sized TCP_SYNQ_HSIZE was removed in favor of dynamic sizing. 👑

• tcp_max_tw_buckets (integer; default: see below; since Linux 2.4) — the max number of sockets in TIME_WAIT state allowed in the system. This limit exists only to prevent simple denial-of-service attacks. The default value of NR_FILE*2 is adjusted depending on the memory in the system. If this number gets exceeded, the socket is closed and a warning gets printed. ⚠️
• tcp_moderate_rcvbuf (Boolean; default: enabled; since Linux 2.4.17/2.6.7) — if enabled, TCP performs receive buffer auto-tuning, attempting to automatically size the buffer (no greater than tcp_rmem[2]) to match the size required by the path for full throughput. 📈
• tcp_mem (since Linux 2.4) — this one's a vector of 3 integers: [low, pressure, high]. These bounds, measured in units of the system page size, are used by TCP to track its memory usage. The defaults are calculated at boot time from the amount of available memory. (TCP can only use low memory for this, which is limited to around 900 megabytes on 32-bit systems. 64-bit systems do not suffer this limitation. 🫶)
  • low — TCP doesn't regulate its memory allocation when the number of pages it has allocated globally is below this number.
  • pressure — when the amount of memory allocated by TCP exceeds this number of pages, TCP moderates its memory consumption. This memory pressure state is exited once the number of pages allocated falls below the low mark.
  • high — the maximum number of pages, globally, that TCP will allocate. This value overrides any other limits imposed by the kernel. 👑
• tcp_mtu_probing (integer; default: 0; since Linux 2.6.17) — this parameter controls TCP Packetization-Layer Path MTU Discovery. These values may be assigned to the file:
  • 0 — Disabled
  • 1 — Disabled by default, enabled when an ICMP black hole is detected 🕳️
  • 2 — Always enabled, use initial MSS of tcp_base_mss.
• tcp_no_metrics_save (Boolean; default: disabled; since Linux 2.6.6) — by default, TCP saves various connection metrics in the route cache when the connection closes, so that connections established in the near future can use these to set initial conditions. Usually this increases overall performance, but it may sometimes cause performance degradation. If tcp_no_metrics_save is enabled, TCP won't cache metrics on closing connections. 💾
• tcp_orphan_retries (integer; default: 8; since Linux 2.4) — the max number of attempts made to probe the other end of a connection that's been closed by our end.
• tcp_reordering (integer; default: 3; since Linux 2.4) — the maximum a packet can be reordered in a TCP packet stream without TCP assuming packet loss and going into slow start. And bestie, it is not advisable to change this number. This is a packet reordering detection metric designed to minimize unnecessary back off and retransmits provoked by reordering of packets on a connection. 🙅‍♀️
• tcp_retrans_collapse (Boolean; default: enabled; since Linux 2.2) — try to send full-sized packets during retransmit. 📦
• tcp_retries1 (integer; default: 3; since Linux 2.2) — okay so this is how many times TCP will try to retransmit a packet on an established connection, just chugging along normally, no extra drama, without dragging the network layers into it. But bestie, once we go over that number of retransmits, TCP finally gets the network layer to update the route if it can, and it does that before every new retransmit from then on. The default is 3, which is literally the RFC-specified minimum. iconic.
• tcp_retries2 (integer; default: 15; since Linux 2.2) — the maximum number of times a TCP packet gets retransmitted while in established state before it just gives up entirely 💀. Default is 15, and that maps to a duration of roughly 13 to 30 minutes, depending on the retransmission timeout. And ngl the RFC 1122 minimum limit of 100 seconds is typically considered way too short, so we do not do that.
• tcp_rfc1337 (Boolean; default: disabled; since Linux 2.2) — turns on TCP behavior that actually conforms to RFC 1337 ✨. When it's disabled, if a RST shows up while we're in TIME_WAIT state, we close the socket immediately — no waiting around for the TIME_WAIT period to finish. she's impatient like that.
• tcp_rmem (since Linux 2.4) — this one's a vector of 3 integers: [min, default, max] 🫶. TCP uses these bad boys to regulate receive buffer sizes, and it dynamically adjusts the size of the receive buffer from the defaults below, inside the range of these values, depending on how much memory the system has available.
  • min — the minimum size of the receive buffer that each TCP socket uses. Default value is the system page size. (On Linux 2.4 the default is 4 kB, lowered to PAGE_SIZE bytes on low-memory systems.) This value exists so that in memory pressure mode, allocations below this size will still succeed. It is not used to bound the size of the receive buffer declared using SO_RCVBUF on a socket, okay bestie, don't get it twisted.
  • default — the default size of the receive buffer for a TCP socket. This value overwrites the initial default buffer size from the generic global net.core.rmem_default that's defined for all protocols. The default value is 87380 bytes. (On Linux 2.4 this gets lowered to 43689 in low-memory systems.) If you want bigger receive buffer sizes, bump this value up — and yes that affects all sockets 💅. And to employ large TCP windows, net.ipv4.tcp_window_scaling has to be enabled, which it is by default ✨.
  • max — the maximum size of the receive buffer used by each TCP socket. This value does not override the global net.core.rmem_max. And it is not used to limit the size of the receive buffer declared using SO_RCVBUF on a socket either. The default value is calculated with this formula:

max(87380, min(4 MB, tcp_mem[1]*PAGE_SIZE/128))

(On Linux 2.4 the default is 87380*2 bytes, lowered to 87380 in low-memory systems.)

• tcp_sack (Boolean; default: enabled; since Linux 2.2) — enables RFC 2018 TCP Selective Acknowledgements. slay, selective acking.
• tcp_slow_start_after_idle (Boolean; default: enabled; since Linux 2.6.18) — when enabled, you get RFC 2861 behavior and the congestion window times out after an idle period. An idle period is defined as the current RTO (retransmission timeout). If it's disabled, the congestion window will not be timed out after an idle period 🌸.
• tcp_stdurg (Boolean; default: disabled; since Linux 2.2) — if you enable this, TCP uses the RFC 1122 interpretation of the TCP urgent-pointer field, where the urgent pointer points to the last byte of urgent data. If it's disabled, you get the BSD-compatible interpretation — the urgent pointer points to the first byte after the urgent data. And heads up bestie, enabling this option may lead to interoperability problems 😭.

🚨 warning, fr fr: turning tcp_stdurg on can cause interop problems. don't do it casually.

• tcp_syn_retries (integer; default: 6; since Linux 2.2) — the max number of times the initial SYNs for an active TCP connection attempt get retransmitted. This value shouldn't be higher than 255. Default is 6, which corresponds to retrying for up to approximately 127 seconds. Before Linux 3.7, the default was 5, which (in conjunction with calculation based on other kernel parameters) corresponded to approximately 180 seconds. history lesson, periodt.
• tcp_synack_retries (integer; default: 5; since Linux 2.2) — the max number of times a SYN/ACK segment for a passive TCP connection will be retransmitted. And again, this number should not be higher than 255 👑.
• tcp_syncookies (integer; default: 1; since Linux 2.2) — enable TCP syncookies 🍪. The kernel must be compiled with CONFIG_SYN_COOKIES. Syncookies try to protect a socket from a SYN flood attack.

🛑 okay real talk: this should be used as a last resort, if at all. It's a violation of the TCP protocol, and it conflicts with other areas of TCP such as TCP extensions. It can cause problems for clients and relays. It is not recommended as a tuning mechanism for heavily loaded servers to help with overloaded or misconfigured conditions. For recommended alternatives, go look at tcp_max_syn_backlog, tcp_synack_retries, and tcp_abort_on_overflow.

Set it to one of these values:

• 0 — disable TCP syncookies.
• 1 — send out syncookies when the syn backlog queue of a socket overflows.
• 2 — (since Linux 3.12) send out syncookies unconditionally. This can be useful for network testing 🧪.

• tcp_timestamps (integer; default: 1; since Linux 2.2) — set to one of these values to enable or disable RFC 1323 TCP timestamps:
  • 0 — disable timestamps.
  • 1 — enable timestamps as defined in RFC1323, and use a random offset for each connection rather than only using the current time. the way that it randomizes? obsessed.
  • 2 — same as value 1, but without random offsets. Setting tcp_timestamps to this value is meaningful since Linux 4.10.
• tcp_tso_win_divisor (integer; default: 3; since Linux 2.6.9) — this parameter controls what percentage of the congestion window a single TCP Segmentation Offload (TSO) frame is allowed to consume. Setting it is a tradeoff between burstiness and building larger TSO frames ⚖️.
• tcp_tw_recycle (Boolean; default: disabled; Linux 2.4 to Linux 4.11) — enable fast recycling of TIME_WAIT sockets. Ngl, enabling this option is not recommended, because the remote IP may not use monotonically increasing timestamps (think devices behind NAT, devices with per-connection timestamp offsets 😭). See RFC 1323 (PAWS) and RFC 6191.
• tcp_tw_reuse (Boolean; default: disabled; since Linux 2.4.19/2.6) — allow reusing TIME_WAIT sockets for new connections when it's safe from a protocol viewpoint. Do not change this without the advice or request of technical experts 🙈.
• tcp_vegas_cong_avoid (Boolean; default: disabled; Linux 2.2 to Linux 2.6.13) — enable the TCP Vegas congestion avoidance algorithm. TCP Vegas is a sender-side-only change to TCP that anticipates the onset of congestion by estimating the bandwidth. It adjusts the sending rate by modifying the congestion window. TCP Vegas should give you less packet loss, but it's not as aggressive as TCP Reno — she's chill like that 🌸.
• tcp_westwood (Boolean; default: disabled; Linux 2.4.26/2.6.3 to Linux 2.6.13) — enable the TCP Westwood+ congestion control algorithm. TCP Westwood+ is a sender-side-only modification of the TCP Reno protocol stack that optimizes TCP congestion control performance. It's based on end-to-end bandwidth estimation to set the congestion window and slow start threshold after a congestion episode. Using that estimation, TCP Westwood+ adaptively sets a slow start threshold and a congestion window that take into account the bandwidth used at the time congestion is experienced. TCP Westwood+ significantly increases fairness with respect to TCP Reno in wired networks, and throughput over wireless links 🔥.
• tcp_window_scaling (Boolean; default: enabled; since Linux 2.2) — enable RFC 1323 TCP window scaling ✨. This lets you use a large window (> 64 kB) on a TCP connection, should the other end support it. Normally the 16-bit window length field in the TCP header limits the window size to less than 64 kB. If you want bigger windows, applications can increase the size of their socket buffers and the window scaling option will get employed. If tcp_window_scaling is disabled, TCP will not negotiate the use of window scaling with the other end during connection setup. not her being uncommunicative 💀.
• tcp_wmem (since Linux 2.4) — a vector of 3 integers: [min, default, max] 🫶. TCP uses these to regulate send buffer sizes, dynamically adjusting the size of the send buffer from the defaults below, within the range of these values, depending on memory available.
  • min — minimum size of the send buffer used by each TCP socket. The default value is the system page size. (On Linux 2.4 the default is 4 kB.) This value ensures that in memory pressure mode, allocations below this size will still succeed. It is not used to bound the size of the send buffer declared using SO_SNDBUF on a socket.
  • default — the default size of the send buffer for a TCP socket. This value overwrites the initial default buffer size from the generic global /proc/sys/net/core/wmem_default defined for all protocols. The default value is 16 kB. If larger send buffer sizes are desired, increase this value — affecting all sockets 💅. To employ large TCP windows, /proc/sys/net/ipv4/tcp_window_scaling must be set to a nonzero value (which is the default).
• max — the biggest the send buffer can get for each TCP socket 🫶. Important though: this does not override the value in /proc/sys/net/core/wmem_max, and it is not used to cap the send buffer you declared with SO_SNDBUF on a socket. The default value comes from this formula:

max(65536, min(4 MB, tcp_mem[1]*PAGE_SIZE/128))

(On Linux 2.4, the default was 128 kB, knocked down to 64 kB on low-memory systems. Retro 😌)

• tcp_workaround_signed_windows (Boolean; default: disabled; since Linux 2.6.26) — if you enable this, TCP assumes that no window-scaling option coming back means the remote TCP is broken, and it treats the window as a signed quantity. If it's disabled, it assumes the remote TCP is not broken, even when no window scaling option shows up from it. iykyk 💅

---

🔌✨ Socket options ✨🔌

To set or get a TCP socket option, you call getsockopt(2) to read it or setsockopt(2) to write it, with the option level argument set to IPPROTO_TCP. Unless it says otherwise, optval is a pointer to an int. Also, most IPPROTO_IP socket options are valid on TCP sockets — head to ip(7) for that tea 🍵.

Here's the list of TCP-specific socket options, bestie. And for details on some other socket options that also apply to TCP sockets, go see socket(7).

• TCP_CONGESTION (since Linux 2.6.13) — the argument here is a string 🎀. This option lets the caller set which TCP congestion control algorithm gets used, and they can do it per-socket. Unprivileged processes are limited to picking one of the algorithms listed in tcp_allowed_congestion_control (explained above). Privileged processes (CAP_NET_ADMIN) get the whole menu — any of the available congestion-control algorithms, as described up in tcp_available_congestion_control. 👑
• TCP_CORK (since Linux 2.2) — if it's set, don't send out partial frames. All those queued partial frames get sent the moment the option is cleared again. This is the move for prepending headers before you call sendfile(2), or just for throughput optimization. As currently implemented, there is a 200 millisecond ceiling on how long output stays corked by TCP_CORK — hit that ceiling and the queued data gets transmitted automatically. It can only be combined with TCP_NODELAY since Linux 2.5.71. And fr fr: this option should not be used in code intended to be portable. 🚫
• TCP_DEFER_ACCEPT (since Linux 2.4) — lets a listener be awakened only when data actually arrives on the socket 🌸. Takes an integer value (seconds), and this can bound the maximum number of attempts TCP will make to complete the connection. The kernel rounds this value up to the next larger TCP retransmit duration.

On a client socket, if it's nonzero, it delays sending the final ACK of the three-way handshake until the socket has data to send — in which case the ACK gets piggybacked onto the first data segment — or a delayed-ACK timeout is reached.

Again: not for code intended to be portable, bestie 💀

• TCP_INFO (since Linux 2.4) — used to collect information about this socket 🔍. The kernel returns a struct tcp_info as defined in the file /usr/include/linux/tcp.h. And yes: this one also should not be used in code intended to be portable.
• TCP_KEEPCNT (since Linux 2.4) — the maximum number of keepalive probes TCP should send before it drops the connection 🫶. You already know: not in code intended to be portable.
• TCP_KEEPIDLE (since Linux 2.4) — the time (in seconds) the connection has to stay idle before TCP starts sending keepalive probes — but only if the socket option SO_KEEPALIVE has been set on this socket. Same disclaimer, icon: not for code intended to be portable ✨.
• TCP_KEEPINTVL (since Linux 2.4) — the time (in seconds) between individual keepalive probes ⏳. And, say it with me: not to be used in code intended to be portable.
• TCP_LINGER2 (since Linux 2.4) — the lifetime of orphaned FIN_WAIT2 state sockets 🥀. You can use this option to override the system-wide setting in the file /proc/sys/net/ipv4/tcp_fin_timeout, just for this socket. Do not confuse this with the socket(7) level option SO_LINGER — totally different girly. And no cap, this should not be used in code intended to be portable.
• TCP_MAXSEG — the maximum segment size for outgoing TCP packets 📦. In Linux 2.2 and earlier, and in Linux 2.6.28 and later, if this option is set before connection establishment, it also changes the MSS value announced to the other end in the initial packet. Values greater than the (eventual) interface MTU have no effect, and TCP will also impose its own minimum and maximum bounds over whatever value you provide.
• TCP_NODELAY — if set, disables the Nagle algorithm 🚀. That means segments are always sent as soon as possible, even if there's only a tiny amount of data. When it's not set, data gets buffered until there's a sufficient amount to send out, which avoids the frequent sending of small packets — the thing that gives you poor utilization of the network. Heads up: this option is overridden by TCP_CORK; however, setting this option forces an explicit flush of pending output, even if TCP_CORK is currently set. Not me being dramatic, that's literally the spec 💅
• TCP_QUICKACK (since Linux 2.4.4) — enable quickack mode if set, or disable quickack mode if cleared ⚡. In quickack mode, ACKs are sent immediately, rather than delayed if needed in accordance with normal TCP operation. This flag is not permanent — it only enables a switch to or from quickack mode. After that, subsequent operation of the TCP protocol will once again enter/leave quickack mode depending on internal protocol processing and factors such as delayed ACK timeouts occurring and data transfer. And you guessed it: this option should not be used in code intended to be portable.
• TCP_SYNCNT (since Linux 2.4) — set the number of SYN retransmits that TCP should send before it aborts the attempt to connect 🙈. It cannot exceed 255. Not portable, bestie, don't do it.
• TCP_SAVE_SYN (since Linux 4.3) — saves incoming SYN packet contents of the listening socket until it is read with TCP_SAVED_SYN once 📥. Could be set before or after the listen(2) call.
• TCP_SAVED_SYN (since Linux 4.3) — reads SYN packet contents saved by TCP_SAVE_SYN 📤. The saved SYN headers are freed after the first call. The data returned in TCP_SAVED_SYN are network (IPv4/IPv6) and TCP headers.
• TCP_USER_TIMEOUT (since Linux 2.6.37) — this option takes an unsigned int as an argument ⏱️. When the value is greater than 0, it specifies the maximum amount of time in milliseconds that transmitted data may remain unacknowledged, or buffered data may remain untransmitted (due to zero window size), before TCP will forcibly close the corresponding connection and return ETIMEDOUT to the application. If the option value is specified as 0, TCP will use the system default.

Increasing user timeouts allows a TCP connection to survive extended periods without end-to-end connectivity 🦋. Decreasing user timeouts allows applications to "fail fast", if so desired. Otherwise, failure may take up to 20 minutes with the current system defaults in a normal WAN environment. 😭

This option can be set during any state of a TCP connection, but it's effective only during the synchronized states of a connection (ESTABLISHED, FIN-WAIT-1, FIN-WAIT-2, CLOSE-WAIT, CLOSING, and LAST-ACK). Moreover, when used with the TCP keepalive (SO_KEEPALIVE) option, TCP_USER_TIMEOUT will override keepalive to determine when to close a connection due to keepalive failure.

The option has no effect on when TCP retransmits a packet, nor on when a keepalive probe is sent.

This option, like many others, will be inherited by the socket returned by accept(2), if it was set on the listening socket 🔥.

Further details on the user timeout feature can be found in RFC 793 and RFC 5482 ("TCP User Timeout Option").

• TCP_WINDOW_CLAMP (since Linux 2.4) — bounds the size of the advertised window to this value 📐. The kernel imposes a minimum size of SOCK_MIN_RCVBUF/2. This option should not be used in code intended to be portable.
• TCP_FASTOPEN (since Linux 3.6) — this option enables Fast Open (RFC 7413) on the listener socket 🚀✨. The value specifies the maximum length of pending SYNs (similar to the backlog argument in listen(2)). Once enabled, the listener socket grants the TCP Fast Open cookie on incoming SYN with TCP Fast Open option.

More importantly, it accepts the data in SYN with a valid Fast Open cookie and responds SYN-ACK acknowledging both the data and the SYN sequence. accept(2) returns a socket that is available for read and write when the handshake has not completed yet 👑. Thus the data exchange can commence before the handshake completes. This option requires enabling the server-side support on sysctl net.ipv4.tcp_fastopen (see above). For TCP Fast Open client-side support, see send(2) MSG_FASTOPEN or TCP_FASTOPEN_CONNECT below.

• TCP_FASTOPEN_CONNECT (since Linux 4.11) — this option enables an alternative way to perform Fast Open on the active side (client) 💜. When this option is enabled, connect(2) would behave differently depending on if a Fast Open cookie is available for the destination.

If a cookie is not available (i.e., first contact to the destination), connect(2) behaves as usual by sending a SYN immediately, except the SYN would include an empty Fast Open cookie option to solicit a cookie.

If a cookie is available, connect(2) would return 0 immediately but the SYN transmission is deferred. A subsequent write(2) or sendmsg(2) would trigger a SYN with data plus cookie in the Fast Open option 🌈. In other words, the actual connect operation is deferred until data is supplied.

---

okay bestie, we're in the home stretch, don't stop now 💖

heads up, this one comes with a big "but actually" — while TCP_FASTOPEN_CONNECT is designed for convenience, turning it on does change behaviors, and certain system calls might set different errno values. No cap.

With cookie present, write(2) or sendmsg(2) must be called right after connect(2) in order to send out SYN+data to complete 3WHS and establish the connection. And listen — calling read(2) right after connect(2) without a write(2) will cause the blocking socket to be blocked forever. Forever forever. 💀 That's not a vibe, that's a hang.

Your app should either set the TCP_FASTOPEN_CONNECT socket option before write(2) or sendmsg(2), or call write(2) or sendmsg(2) with the MSG_FASTOPEN flag directly — not both on the same connection, bestie, pick a lane.

Here's the typical call flow with this new option, literally verbatim from the source:

s = socket();
setsockopt(s, IPPROTO_TCP, TCP_FASTOPEN_CONNECT, 1, ...);
connect(s);
write(s);  /* write() should always follow connect()
            * in order to trigger SYN to go out.  */
read(s)/write(s);
/* ... */
close(s);

---

🦋 Sockets API 🦋

TCP provides limited support for out-of-band data, in the form of (a single byte of) urgent data. So minimal, so humble. In Linux this means if the other end sends newer out-of-band data, the older urgent data gets inserted as normal data into the stream (even when SO_OOBINLINE is not set). This differs from BSD-based stacks — so if you're porting something from BSD, vibe check it first, fr fr.

Linux uses the BSD compatible interpretation of the urgent pointer field by default. That violates RFC 1122, but it's required for interoperability with other stacks. It can be changed via /proc/sys/net/ipv4/tcp_stdurg.

It's possible to peek at out-of-band data using the recv(2) MSG_PEEK flag. 👀

Since Linux 2.4, Linux supports the use of MSG_TRUNC in the flags argument of recv(2) (and recvmsg(2)). This flag causes the received bytes of data to be discarded, rather than passed back in a caller-supplied buffer. Since Linux 2.4.4, MSG_TRUNC also has this effect when used in conjunction with MSG_OOB to receive out-of-band data.

🎀 Ioctls 🎀

The following ioctl(2) calls return information in value. The correct syntax is:

int value;
error = ioctl(tcp_socket, ioctl_type, &value);

ioctl_type is one of the following:

✨ SIOCINQ ✨

Returns the amount of queued unread data in the receive buffer. The socket must not be in LISTEN state, otherwise an error (EINVAL) is returned. SIOCINQ is defined in <linux/sockios.h>. Alternatively, you can use the synonymous FIONREAD, defined in <sys/ioctl.h>.

✨ SIOCATMARK ✨

Returns true (i.e., value is nonzero) if the inbound data stream is at the urgent mark.

If the SO_OOBINLINE socket option is set, and SIOCATMARK returns true, then the next read from the socket will return the urgent data. If the SO_OOBINLINE socket option is not set, and SIOCATMARK returns true, then the next read from the socket will return the bytes following the urgent data (to actually read the urgent data requires the recv(MSG_OOB) flag).

Note that a read never reads across the urgent mark. If an application is informed of the presence of urgent data via select(2) (using the exceptfds argument) or through delivery of a SIGURG signal, then it can advance up to the mark using a loop which repeatedly tests SIOCATMARK and performs a read (requesting any number of bytes) as long as SIOCATMARK returns false.

✨ SIOCOUTQ ✨

Returns the amount of unsent data in the socket send queue. The socket must not be in LISTEN state, otherwise an error (EINVAL) is returned. SIOCOUTQ is defined in <linux/sockios.h>. Alternatively, you can use the synonymous TIOCOUTQ, defined in <sys/ioctl.h>.

🌈 Error handling 🌈

When a network error occurs, TCP tries to resend the packet. If it doesn't succeed after some time, either ETIMEDOUT or the last received error on this connection is reported. Slow and steady, bestie, but slow.

Some applications require a quicker error notification. This can be enabled with the IPPROTO_IP level IP_RECVERR socket option. When this option is enabled, all incoming errors are immediately passed to the user program.

⚠️ Use this option with care — it makes TCP less tolerant to routing changes and other normal network conditions. It's giving main character energy but it's also giving fragile. Handle with your whole heart. 🫶

---

💅 ERRORS 💅

• EAFNOTSUPPORT — the passed socket address type in sin_family was not AF_INET.
• EPIPE — the other end closed the socket unexpectedly, or a read was executed on a shut down socket. Rude, honestly. 😭
• ETIMEDOUT — the other end didn't acknowledge retransmitted data after some time.

Any errors defined for ip(7) or the generic socket layer may also be returned for TCP.

---

⭐ VERSIONS ⭐

Support for Explicit Congestion Notification, zero-copy sendfile(2), reordering support and some SACK extensions (DSACK) were introduced in Linux 2.4. Support for forward acknowledgement (FACK), TIME_WAIT recycling, and per-connection keepalive socket options were introduced in Linux 2.3. Ancient history but iconic. 👑

---

💀 BUGS 💀

• Not all errors are documented. (Bestie. Bestie.)
• IPv6 is not described.

---

🌸 SEE ALSO 🌸

accept(2), bind(2), connect(2), getsockopt(2), listen(2), recvmsg(2), sendfile(2), sendmsg(2), socket(2), ip(7), socket(7)

The kernel source file Documentation/networking/ip-sysctl.rst.

• RFC 793 for the TCP specification.
• RFC 1122 for the TCP requirements and a description of the Nagle algorithm.
• RFC 1323 for TCP timestamp and window scaling options.
• RFC 1337 for a description of TIME_WAIT assassination hazards.
• RFC 3168 for a description of Explicit Congestion Notification.
• RFC 2581 for TCP congestion control algorithms.
• RFC 2018 and RFC 2883 for SACK and extensions to SACK.

---

and that's a wrap on the whole page, bestie!! 🎉 this one's from the Linux man-pages crew, version 6.20, dated 2026-04-19, and it's the tcp(7) page — you made it to the end, I'm so proud, go forth and slay your sockets 💖✨🦋