1SYSTEMD.NETWORK(5) systemd.network SYSTEMD.NETWORK(5)
2
6 systemd.network - Network configuration
7
9 network.network
10
12 A plain ini-style text file that encodes network configuration for
13 matching network interfaces, used by systemd-networkd(8). See
14 systemd.syntax(7) for a general description of the syntax.
15 The main network file must have the extension .network; other
17 extensions are ignored. Networks are applied to links whenever the
18 links appear.
19 The .network files are read from the files located in the system
21 network directories /usr/lib/systemd/network and
22 /usr/local/lib/systemd/network, the volatile runtime network directory
23 /run/systemd/network and the local administration network directory
24 /etc/systemd/network. All configuration files are collectively sorted
25 and processed in alphanumeric order, regardless of the directories in
26 which they live. However, files with identical filenames replace each
27 other. It is recommended that each filename is prefixed with a number
28 (e.g. 10-eth0.network). Otherwise, the default .network files or those
29 generated by systemd-network-generator.service(8) may take precedence
30 over user configured files. Files in /etc/ have the highest priority,
31 files in /run/ take precedence over files with the same name under
32 /usr/. This can be used to override a system-supplied configuration
33 file with a local file if needed. As a special case, an empty file
34 (file size 0) or symlink with the same name pointing to /dev/null
35 disables the configuration file entirely (it is "masked").
36 Along with the network file foo.network, a "drop-in" directory
38 foo.network.d/ may exist. All files with the suffix ".conf" from this
39 directory will be merged in the alphanumeric order and parsed after the
40 main file itself has been parsed. This is useful to alter or add
41 configuration settings, without having to modify the main configuration
42 file. Each drop-in file must have appropriate section headers.
43 In addition to /etc/systemd/network, drop-in ".d" directories can be
45 placed in /usr/lib/systemd/network or /run/systemd/network directories.
46 Drop-in files in /etc/ take precedence over those in /run/ which in
47 turn take precedence over those in /usr/lib/. Drop-in files under any
48 of these directories take precedence over the main network file
49 wherever located.
50
52 The network file contains a [Match] section, which determines if a
53 given network file may be applied to a given interface; and a [Network]
54 section specifying how the interface should be configured. The first
55 (in alphanumeric order) of the network files that matches a given
56 interface is applied, all later files are ignored, even if they match
57 as well.
58 A network file is said to match a network interface if all matches
60 specified by the [Match] section are satisfied. When a network file
61 does not contain valid settings in [Match] section, then the file will
62 match all interfaces and systemd-networkd warns about that. Hint: to
63 avoid the warning and to make it clear that all interfaces shall be
64 matched, add the following:
65 Name=*
67 The following keys are accepted:
69 MACAddress=
71 A whitespace-separated list of hardware addresses. The acceptable
72 formats are:
73 colon-delimited hexadecimal
75 Each field must be one byte. E.g. "12:34:56:78:90:ab" or
76 "AA:BB:CC:DD:EE:FF".
77 hyphen-delimited hexadecimal
79 Each field must be one byte. E.g. "12-34-56-78-90-ab" or
80 "AA-BB-CC-DD-EE-FF".
81 dot-delimited hexadecimal
83 Each field must be two bytes. E.g. "1234.5678.90ab" or
84 "AABB.CCDD.EEFF".
85 IPv4 address format
87 E.g. "127.0.0.1" or "192.168.0.1".
88 IPv6 address format
90 E.g. "2001:0db8:85a3::8a2e:0370:7334" or "::1".
91 The total length of each MAC address must be 4 (for IPv4 tunnel), 6
93 (for Ethernet), 16 (for IPv6 tunnel), or 20 (for InfiniBand). This
94 option may appear more than once, in which case the lists are
95 merged. If the empty string is assigned to this option, the list of
96 hardware addresses defined prior to this is reset. Defaults to
97 unset.
98 PermanentMACAddress=
100 A whitespace-separated list of hardware's permanent addresses.
101 While MACAddress= matches the device's current MAC address, this
102 matches the device's permanent MAC address, which may be different
103 from the current one. Use full colon-, hyphen- or dot-delimited
104 hexadecimal, or IPv4 or IPv6 address format. This option may appear
105 more than once, in which case the lists are merged. If the empty
106 string is assigned to this option, the list of hardware addresses
107 defined prior to this is reset. Defaults to unset.
108 Path=
110 A whitespace-separated list of shell-style globs matching the
111 persistent path, as exposed by the udev property ID_PATH.
112 Driver=
114 A whitespace-separated list of shell-style globs matching the
115 driver currently bound to the device, as exposed by the udev
116 property ID_NET_DRIVER of its parent device, or if that is not set,
117 the driver as exposed by ethtool -i of the device itself. If the
118 list is prefixed with a "!", the test is inverted.
119 Type=
121 A whitespace-separated list of shell-style globs matching the
122 device type, as exposed by networkctl list. If the list is prefixed
123 with a "!", the test is inverted. Some valid values are "ether",
124 "loopback", "wlan", "wwan". Valid types are named either from the
125 udev "DEVTYPE" attribute, or "ARPHRD_" macros in linux/if_arp.h, so
126 this is not comprehensive.
127 Kind=
129 A whitespace-separated list of shell-style globs matching the
130 device kind, as exposed by networkctl status INTERFACE or ip -d
131 link show INTERFACE. If the list is prefixed with a "!", the test
132 is inverted. Some valid values are "bond", "bridge", "gre", "tun",
133 "veth". Valid kinds are given by netlink's "IFLA_INFO_KIND"
134 attribute, so this is not comprehensive.
135 Property=
137 A whitespace-separated list of udev property names with their
138 values after equals sign ("="). If multiple properties are
139 specified, the test results are ANDed. If the list is prefixed with
140 a "!", the test is inverted. If a value contains white spaces, then
141 please quote whole key and value pair. If a value contains
142 quotation, then please escape the quotation with "\".
143 Example: if a .link file has the following:
145 Property=ID_MODEL_ID=9999 "ID_VENDOR_FROM_DATABASE=vendor name" "KEY=with \"quotation\""
147 then, the .link file matches only when an interface has all the
149 above three properties.
150 Name=
152 A whitespace-separated list of shell-style globs matching the
153 device name, as exposed by the udev property "INTERFACE", or
154 device's alternative names. If the list is prefixed with a "!", the
155 test is inverted.
156 WLANInterfaceType=
158 A whitespace-separated list of wireless network type. Supported
159 values are "ad-hoc", "station", "ap", "ap-vlan", "wds", "monitor",
160 "mesh-point", "p2p-client", "p2p-go", "p2p-device", "ocb", and
161 "nan". If the list is prefixed with a "!", the test is inverted.
162 SSID=
164 A whitespace-separated list of shell-style globs matching the SSID
165 of the currently connected wireless LAN. If the list is prefixed
166 with a "!", the test is inverted.
167 BSSID=
169 A whitespace-separated list of hardware address of the currently
170 connected wireless LAN. Use full colon-, hyphen- or dot-delimited
171 hexadecimal. See the example in MACAddress=. This option may appear
172 more than once, in which case the lists are merged. If the empty
173 string is assigned to this option, the list is reset.
174 Host=
176 Matches against the hostname or machine ID of the host. See
177 ConditionHost= in systemd.unit(5) for details. When prefixed with
178 an exclamation mark ("!"), the result is negated. If an empty
179 string is assigned, then previously assigned value is cleared.
180 Virtualization=
182 Checks whether the system is executed in a virtualized environment
183 and optionally test whether it is a specific implementation. See
184 ConditionVirtualization= in systemd.unit(5) for details. When
185 prefixed with an exclamation mark ("!"), the result is negated. If
186 an empty string is assigned, then previously assigned value is
187 cleared.
188 KernelCommandLine=
190 Checks whether a specific kernel command line option is set. See
191 ConditionKernelCommandLine= in systemd.unit(5) for details. When
192 prefixed with an exclamation mark ("!"), the result is negated. If
193 an empty string is assigned, then previously assigned value is
194 cleared.
195 KernelVersion=
197 Checks whether the kernel version (as reported by uname -r) matches
198 a certain expression. See ConditionKernelVersion= in
199 systemd.unit(5) for details. When prefixed with an exclamation mark
200 ("!"), the result is negated. If an empty string is assigned, then
201 previously assigned value is cleared.
202 Architecture=
204 Checks whether the system is running on a specific architecture.
205 See ConditionArchitecture= in systemd.unit(5) for details. When
206 prefixed with an exclamation mark ("!"), the result is negated. If
207 an empty string is assigned, then previously assigned value is
208 cleared.
209 Firmware=
211 Checks whether the system is running on a machine with the
212 specified firmware. See ConditionFirmware= in systemd.unit(5) for
213 details. When prefixed with an exclamation mark ("!"), the result
214 is negated. If an empty string is assigned, then previously
215 assigned value is cleared.
216
218 The [Link] section accepts the following keys:
219 MACAddress=
221 The hardware address to set for the device.
222 MTUBytes=
224 The maximum transmission unit in bytes to set for the device. The
225 usual suffixes K, M, G, are supported and are understood to the
226 base of 1024.
227 Note that if IPv6 is enabled on the interface, and the MTU is
229 chosen below 1280 (the minimum MTU for IPv6) it will automatically
230 be increased to this value.
231 ARP=
233 Takes a boolean. If set to true, the ARP (low-level Address
234 Resolution Protocol) for this interface is enabled. When unset, the
235 kernel's default will be used.
236 For example, disabling ARP is useful when creating multiple MACVLAN
238 or VLAN virtual interfaces atop a single lower-level physical
239 interface, which will then only serve as a link/"bridge" device
240 aggregating traffic to the same physical link and not participate
241 in the network otherwise. Defaults to unset.
242 Multicast=
244 Takes a boolean. If set to true, the multicast flag on the device
245 is enabled. Defaults to unset.
246 AllMulticast=
248 Takes a boolean. If set to true, the driver retrieves all multicast
249 packets from the network. This happens when multicast routing is
250 enabled. Defaults to unset.
251 Promiscuous=
253 Takes a boolean. If set to true, promiscuous mode of the interface
254 is enabled. Defaults to unset.
255 If this is set to false for the underlying link of a "passthru"
257 mode MACVLAN/MACVTAP, the virtual interface will be created with
258 the "nopromisc" flag set.
259 Unmanaged=
261 Takes a boolean. When "yes", no attempts are made to bring up or
262 configure matching links, equivalent to when there are no matching
263 network files. Defaults to "no".
264 This is useful for preventing later matching network files from
266 interfering with certain interfaces that are fully controlled by
267 other applications.
268 Group=
270 Link groups are similar to port ranges found in managed switches.
271 When network interfaces are added to a numbered group, operations
272 on all the interfaces from that group can be performed at once.
273 Takes an unsigned integer in the range 0...2147483647. Defaults to
274 unset.
275 RequiredForOnline=
277 Takes a boolean or a minimum operational state and an optional
278 maximum operational state. Please see networkctl(1) for possible
279 operational states. When "yes", the network is deemed required when
280 determining whether the system is online (including when running
281 systemd-networkd-wait-online). When "no", the network is ignored
282 when determining the online state. When a minimum operational state
283 and an optional maximum operational state are set, "yes" is
284 implied, and this controls the minimum and maximum operational
285 state required for the network interface to be considered online.
286 Defaults to "yes" when ActivationPolicy= is not set, or set to
288 "up", "always-up", or "bound". Defaults to "no" when
289 ActivationPolicy= is set to "manual" or "down". This is forced to
290 "no" when ActivationPolicy= is set to "always-down".
291 The network will be brought up normally (as configured by
293 ActivationPolicy=), but in the event that there is no address being
294 assigned by DHCP or the cable is not plugged in, the link will
295 simply remain offline and be skipped automatically by
296 systemd-networkd-wait-online if "RequiredForOnline=no".
297 RequiredFamilyForOnline=
299 Takes an address family. When specified, an IP address in the given
300 family is deemed required when determining whether the link is
301 online (including when running systemd-networkd-wait-online). Takes
302 one of "ipv4", "ipv6", "both", or "any". Defaults to "any". Note
303 that this option has no effect if "RequiredForOnline=no", or if
304 "RequiredForOnline=" specifies a minimum operational state below
305 "degraded".
306 ActivationPolicy=
308 Specifies the policy for systemd-networkd managing the link
309 administrative state. Specifically, this controls how
310 systemd-networkd changes the network device's "IFF_UP" flag, which
311 is sometimes controlled by system administrators by running e.g.,
312 ip link set dev eth0 up or ip link set dev eth0 down, and can also
313 be changed with networkctl up eth0 or networkctl down eth0.
314 Takes one of "up", "always-up", "manual", "always-down", "down", or
316 "bound". When "manual", systemd-networkd will not change the link's
317 admin state automatically; the system administrator must bring the
318 interface up or down manually, as desired. When "up" (the default)
319 or "always-up", or "down" or "always-down", systemd-networkd will
320 set the link up or down, respectively, when the interface is
321 (re)configured. When "always-up" or "always-down", systemd-networkd
322 will set the link up or down, respectively, any time
323 systemd-networkd detects a change in the administrative state. When
324 BindCarrier= is also set, this is automatically set to "bound" and
325 any other value is ignored.
326 When the policy is set to "down" or "manual", the default value of
328 RequiredForOnline= is "no". When the policy is set to
329 "always-down", the value of RequiredForOnline= forced to "no".
330 The administrative state is not the same as the carrier state, so
332 using "always-up" does not mean the link will never lose carrier.
333 The link carrier depends on both the administrative state as well
334 as the network device's physical connection. However, to avoid
335 reconfiguration failures, when using "always-up",
336 IgnoreCarrierLoss= is forced to true.
337
339 The [SR-IOV] section accepts the following keys. Specify several
340 [SR-IOV] sections to configure several SR-IOVs. SR-IOV provides the
341 ability to partition a single physical PCI resource into virtual PCI
342 functions which can then be injected into a VM. In the case of network
343 VFs, SR-IOV improves north-south network performance (that is, traffic
344 with endpoints outside the host machine) by allowing traffic to bypass
345 the host machine’s network stack.
346 VirtualFunction=
348 Specifies a Virtual Function (VF), lightweight PCIe function
349 designed solely to move data in and out. Takes an integer in the
350 range 0...2147483646. This option is compulsory.
351 VLANId=
353 Specifies VLAN ID of the virtual function. Takes an integer in the
354 range 1...4095.
355 QualityOfService=
357 Specifies quality of service of the virtual function. Takes an
358 integer in the range 1...4294967294.
359 VLANProtocol=
361 Specifies VLAN protocol of the virtual function. Takes "802.1Q" or
362 "802.1ad".
363 MACSpoofCheck=
365 Takes a boolean. Controls the MAC spoof checking. When unset, the
366 kernel's default will be used.
367 QueryReceiveSideScaling=
369 Takes a boolean. Toggle the ability of querying the receive side
370 scaling (RSS) configuration of the virtual function (VF). The VF
371 RSS information like RSS hash key may be considered sensitive on
372 some devices where this information is shared between VF and the
373 physical function (PF). When unset, the kernel's default will be
374 used.
375 Trust=
377 Takes a boolean. Allows one to set trust mode of the virtual
378 function (VF). When set, VF users can set a specific feature which
379 may impact security and/or performance. When unset, the kernel's
380 default will be used.
381 LinkState=
383 Allows one to set the link state of the virtual function (VF).
384 Takes a boolean or a special value "auto". Setting to "auto" means
385 a reflection of the physical function (PF) link state, "yes" lets
386 the VF to communicate with other VFs on this host even if the PF
387 link state is down, "no" causes the hardware to drop any packets
388 sent by the VF. When unset, the kernel's default will be used.
389 MACAddress=
391 Specifies the MAC address for the virtual function.
392
394 The [Network] section accepts the following keys:
395 Description=
397 A description of the device. This is only used for presentation
398 purposes.
399 DHCP=
401 Enables DHCPv4 and/or DHCPv6 client support. Accepts "yes", "no",
402 "ipv4", or "ipv6". Defaults to "no".
403 Note that DHCPv6 will by default be triggered by Router
405 Advertisement, if that is enabled, regardless of this parameter. By
406 explicitly enabling DHCPv6 support here, the DHCPv6 client will be
407 started in the mode specified by the
408 <variable>WithoutRA=</variable> setting in the [DHCPv6] section,
409 regardless of the presence of routers on the link, or what flags
410 the routers pass. See "IPv6AcceptRA=".
411 Furthermore, note that by default the domain name specified through
413 DHCP is not used for name resolution. See option UseDomains= below.
414 See the [DHCPv4] or [DHCPv6] sections below for further
416 configuration options for the DHCP client support.
417 DHCPServer=
419 Takes a boolean. If set to "yes", DHCPv4 server will be started.
420 Defaults to "no". Further settings for the DHCP server may be set
421 in the [DHCPServer] section described below.
422 LinkLocalAddressing=
424 Enables link-local address autoconfiguration. Accepts yes, no,
425 ipv4, and ipv6. An IPv6 link-local address is configured when yes
426 or ipv6. An IPv4 link-local address is configured when yes or ipv4
427 and when DHCPv4 autoconfiguration has been unsuccessful for some
428 time. (IPv4 link-local address autoconfiguration will usually
429 happen in parallel with repeated attempts to acquire a DHCPv4
430 lease).
431 Defaults to no when KeepMaster= or Bridge= is set or when the
433 specified MACVLAN=/MACVTAP= has Mode=passthru, or ipv6 otherwise.
434 IPv6LinkLocalAddressGenerationMode=
436 Specifies how IPv6 link-local address is generated. Takes one of
437 "eui64", "none", "stable-privacy" and "random". When unset,
438 "stable-privacy" is used if IPv6StableSecretAddress= is specified,
439 and if not, "eui64" is used. Note that if LinkLocalAddressing= is
440 "no" or "ipv4", then IPv6LinkLocalAddressGenerationMode= will be
441 ignored. Also, even if LinkLocalAddressing= is "yes" or "ipv6",
442 setting IPv6LinkLocalAddressGenerationMode=none disables to
443 configure an IPv6 link-local address.
444 IPv6StableSecretAddress=
446 Takes an IPv6 address. The specified address will be used as a
447 stable secret for generating IPv6 link-local address. If this
448 setting is specified, and IPv6LinkLocalAddressGenerationMode= is
449 unset, then IPv6LinkLocalAddressGenerationMode=stable-privacy is
450 implied. If this setting is not specified, and "stable-privacy" is
451 set to IPv6LinkLocalAddressGenerationMode=, then a stable secret
452 address will be generated from the local machine ID and the
453 interface name.
454 IPv4LLRoute=
456 Takes a boolean. If set to true, sets up the route needed for
457 non-IPv4LL hosts to communicate with IPv4LL-only hosts. Defaults to
458 false.
459 DefaultRouteOnDevice=
461 Takes a boolean. If set to true, sets up the default route bound to
462 the interface. Defaults to false. This is useful when creating
463 routes on point-to-point interfaces. This is equivalent to e.g. the
464 following,
465 ip route add default dev veth99
467 or,
469 [Route]
471 Gateway=0.0.0.0
472 Currently, there are no way to specify e.g., the table for the
474 route configured by this setting. To configure the default route
475 with such an additional property, please use the following instead:
476 [Route]
478 Gateway=0.0.0.0
479 Table=1234
480 LLMNR=
482 Takes a boolean or "resolve". When true, enables Link-Local
483 Multicast Name Resolution[1] on the link. When set to "resolve",
484 only resolution is enabled, but not host registration and
485 announcement. Defaults to true. This setting is read by systemd-
486 resolved.service(8).
487 MulticastDNS=
489 Takes a boolean or "resolve". When true, enables Multicast DNS[2]
490 support on the link. When set to "resolve", only resolution is
491 enabled, but not host or service registration and announcement.
492 Defaults to false. This setting is read by systemd-
493 resolved.service(8).
494 DNSOverTLS=
496 Takes a boolean or "opportunistic". When true, enables
497 DNS-over-TLS[3] support on the link. When set to "opportunistic",
498 compatibility with non-DNS-over-TLS servers is increased, by
499 automatically turning off DNS-over-TLS servers in this case. This
500 option defines a per-interface setting for resolved.conf(5)'s
501 global DNSOverTLS= option. Defaults to unset, and the global
502 setting will be used. This setting is read by systemd-
503 resolved.service(8).
504 DNSSEC=
506 Takes a boolean or "allow-downgrade". When true, enables DNSSEC[4]
507 DNS validation support on the link. When set to "allow-downgrade",
508 compatibility with non-DNSSEC capable networks is increased, by
509 automatically turning off DNSSEC in this case. This option defines
510 a per-interface setting for resolved.conf(5)'s global DNSSEC=
511 option. Defaults to unset, and the global setting will be used.
512 This setting is read by systemd-resolved.service(8).
513 DNSSECNegativeTrustAnchors=
515 A space-separated list of DNSSEC negative trust anchor domains. If
516 specified and DNSSEC is enabled, look-ups done via the interface's
517 DNS server will be subject to the list of negative trust anchors,
518 and not require authentication for the specified domains, or
519 anything below it. Use this to disable DNSSEC authentication for
520 specific private domains, that cannot be proven valid using the
521 Internet DNS hierarchy. Defaults to the empty list. This setting is
522 read by systemd-resolved.service(8).
523 LLDP=
525 Controls support for Ethernet LLDP packet reception. LLDP is a
526 link-layer protocol commonly implemented on professional routers
527 and bridges which announces which physical port a system is
528 connected to, as well as other related data. Accepts a boolean or
529 the special value "routers-only". When true, incoming LLDP packets
530 are accepted and a database of all LLDP neighbors maintained. If
531 "routers-only" is set only LLDP data of various types of routers is
532 collected and LLDP data about other types of devices ignored (such
533 as stations, telephones and others). If false, LLDP reception is
534 disabled. Defaults to "routers-only". Use networkctl(1) to query
535 the collected neighbor data. LLDP is only available on Ethernet
536 links. See EmitLLDP= below for enabling LLDP packet emission from
537 the local system.
538 EmitLLDP=
540 Controls support for Ethernet LLDP packet emission. Accepts a
541 boolean parameter or the special values "nearest-bridge",
542 "non-tpmr-bridge" and "customer-bridge". Defaults to false, which
543 turns off LLDP packet emission. If not false, a short LLDP packet
544 with information about the local system is sent out in regular
545 intervals on the link. The LLDP packet will contain information
546 about the local hostname, the local machine ID (as stored in
547 machine-id(5)) and the local interface name, as well as the pretty
548 hostname of the system (as set in machine-info(5)). LLDP emission
549 is only available on Ethernet links. Note that this setting passes
550 data suitable for identification of host to the network and should
551 thus not be enabled on untrusted networks, where such
552 identification data should not be made available. Use this option
553 to permit other systems to identify on which interfaces they are
554 connected to this system. The three special values control
555 propagation of the LLDP packets. The "nearest-bridge" setting
556 permits propagation only to the nearest connected bridge,
557 "non-tpmr-bridge" permits propagation across Two-Port MAC Relays,
558 but not any other bridges, and "customer-bridge" permits
559 propagation until a customer bridge is reached. For details about
560 these concepts, see IEEE 802.1AB-2016[5]. Note that configuring
561 this setting to true is equivalent to "nearest-bridge", the
562 recommended and most restricted level of propagation. See LLDP=
563 above for an option to enable LLDP reception.
564 BindCarrier=
566 A link name or a list of link names. When set, controls the
567 behavior of the current link. When all links in the list are in an
568 operational down state, the current link is brought down. When at
569 least one link has carrier, the current interface is brought up.
570 This forces ActivationPolicy= to be set to "bound".
572 Address=
574 A static IPv4 or IPv6 address and its prefix length, separated by a
575 "/" character. Specify this key more than once to configure several
576 addresses. The format of the address must be as described in
577 inet_pton(3). This is a short-hand for an [Address] section only
578 containing an Address key (see below). This option may be specified
579 more than once.
580 If the specified address is "0.0.0.0" (for IPv4) or "::" (for
582 IPv6), a new address range of the requested size is automatically
583 allocated from a system-wide pool of unused ranges. Note that the
584 prefix length must be equal or larger than 8 for IPv4, and 64 for
585 IPv6. The allocated range is checked against all current network
586 interfaces and all known network configuration files to avoid
587 address range conflicts. The default system-wide pool consists of
588 192.168.0.0/16, 172.16.0.0/12 and 10.0.0.0/8 for IPv4, and fd00::/8
589 for IPv6. This functionality is useful to manage a large number of
590 dynamically created network interfaces with the same network
591 configuration and automatic address range assignment.
592 Gateway=
594 The gateway address, which must be in the format described in
595 inet_pton(3). This is a short-hand for a [Route] section only
596 containing a Gateway= key. This option may be specified more than
597 once.
598 DNS=
600 A DNS server address, which must be in the format described in
601 inet_pton(3). This option may be specified more than once. Each
602 address can optionally take a port number separated with ":", a
603 network interface name or index separated with "%", and a Server
604 Name Indication (SNI) separated with "#". When IPv6 address is
605 specified with a port number, then the address must be in the
606 square brackets. That is, the acceptable full formats are
607 "111.222.333.444:9953%ifname#example.com" for IPv4 and
608 "[1111:2222::3333]:9953%ifname#example.com" for IPv6. If an empty
609 string is assigned, then the all previous assignments are cleared.
610 This setting is read by systemd-resolved.service(8).
611 Domains=
613 A whitespace-separated list of domains which should be resolved
614 using the DNS servers on this link. Each item in the list should be
615 a domain name, optionally prefixed with a tilde ("~"). The domains
616 with the prefix are called "routing-only domains". The domains
617 without the prefix are called "search domains" and are first used
618 as search suffixes for extending single-label hostnames (hostnames
619 containing no dots) to become fully qualified domain names (FQDNs).
620 If a single-label hostname is resolved on this interface, each of
621 the specified search domains are appended to it in turn, converting
622 it into a fully qualified domain name, until one of them may be
623 successfully resolved.
624 Both "search" and "routing-only" domains are used for routing of
626 DNS queries: look-ups for hostnames ending in those domains (hence
627 also single label names, if any "search domains" are listed), are
628 routed to the DNS servers configured for this interface. The domain
629 routing logic is particularly useful on multi-homed hosts with DNS
630 servers serving particular private DNS zones on each interface.
631 The "routing-only" domain "~." (the tilde indicating definition of
633 a routing domain, the dot referring to the DNS root domain which is
634 the implied suffix of all valid DNS names) has special effect. It
635 causes all DNS traffic which does not match another configured
636 domain routing entry to be routed to DNS servers specified for this
637 interface. This setting is useful to prefer a certain set of DNS
638 servers if a link on which they are connected is available.
639 This setting is read by systemd-resolved.service(8). "Search
641 domains" correspond to the domain and search entries in
642 resolv.conf(5). Domain name routing has no equivalent in the
643 traditional glibc API, which has no concept of domain name servers
644 limited to a specific link.
645 DNSDefaultRoute=
647 Takes a boolean argument. If true, this link's configured DNS
648 servers are used for resolving domain names that do not match any
649 link's configured Domains= setting. If false, this link's
650 configured DNS servers are never used for such domains, and are
651 exclusively used for resolving names that match at least one of the
652 domains configured on this link. If not specified defaults to an
653 automatic mode: queries not matching any link's configured domains
654 will be routed to this link if it has no routing-only domains
655 configured.
656 NTP=
658 An NTP server address (either an IP address, or a hostname). This
659 option may be specified more than once. This setting is read by
660 systemd-timesyncd.service(8).
661 IPForward=
663 Configures IP packet forwarding for the system. If enabled,
664 incoming packets on any network interface will be forwarded to any
665 other interfaces according to the routing table. Takes a boolean,
666 or the values "ipv4" or "ipv6", which only enable IP packet
667 forwarding for the specified address family. This controls the
668 net.ipv4.ip_forward and net.ipv6.conf.all.forwarding sysctl options
669 of the network interface (see ip-sysctl.txt[6] for details about
670 sysctl options). Defaults to "no".
671 Note: this setting controls a global kernel option, and does so one
673 way only: if a network that has this setting enabled is set up the
674 global setting is turned on. However, it is never turned off again,
675 even after all networks with this setting enabled are shut down
676 again.
677 To allow IP packet forwarding only between specific network
679 interfaces use a firewall.
680 IPMasquerade=
682 Configures IP masquerading for the network interface. If enabled,
683 packets forwarded from the network interface will be appear as
684 coming from the local host. Takes one of "ipv4", "ipv6", "both", or
685 "no". Defaults to "no". If enabled, this automatically sets
686 IPForward= to one of "ipv4", "ipv6" or "yes".
687 Note. Any positive boolean values such as "yes" or "true" are now
689 deprecated. Please use one of the values in the above.
690 IPv6PrivacyExtensions=
692 Configures use of stateless temporary addresses that change over
693 time (see RFC 4941[7], Privacy Extensions for Stateless Address
694 Autoconfiguration in IPv6). Takes a boolean or the special values
695 "prefer-public" and "kernel". When true, enables the privacy
696 extensions and prefers temporary addresses over public addresses.
697 When "prefer-public", enables the privacy extensions, but prefers
698 public addresses over temporary addresses. When false, the privacy
699 extensions remain disabled. When "kernel", the kernel's default
700 setting will be left in place. Defaults to "no".
701 IPv6AcceptRA=
703 Takes a boolean. Controls IPv6 Router Advertisement (RA) reception
704 support for the interface. If true, RAs are accepted; if false, RAs
705 are ignored. When RAs are accepted, they may trigger the start of
706 the DHCPv6 client if the relevant flags are set in the RA data, or
707 if no routers are found on the link. The default is to disable RA
708 reception for bridge devices or when IP forwarding is enabled, and
709 to enable it otherwise. Cannot be enabled on bond devices and when
710 link-local addressing is disabled.
711 Further settings for the IPv6 RA support may be configured in the
713 [IPv6AcceptRA] section, see below.
714 Also see ip-sysctl.txt[6] in the kernel documentation regarding
716 "accept_ra", but note that systemd's setting of 1 (i.e. true)
717 corresponds to kernel's setting of 2.
718 Note that kernel's implementation of the IPv6 RA protocol is always
720 disabled, regardless of this setting. If this option is enabled, a
721 userspace implementation of the IPv6 RA protocol is used, and the
722 kernel's own implementation remains disabled, since
723 systemd-networkd needs to know all details supplied in the
724 advertisements, and these are not available from the kernel if the
725 kernel's own implementation is used.
726 IPv6DuplicateAddressDetection=
728 Configures the amount of IPv6 Duplicate Address Detection (DAD)
729 probes to send. When unset, the kernel's default will be used.
730 IPv6HopLimit=
732 Configures IPv6 Hop Limit. For each router that forwards the
733 packet, the hop limit is decremented by 1. When the hop limit field
734 reaches zero, the packet is discarded. When unset, the kernel's
735 default will be used.
736 IPv4AcceptLocal=
738 Takes a boolean. Accept packets with local source addresses. In
739 combination with suitable routing, this can be used to direct
740 packets between two local interfaces over the wire and have them
741 accepted properly. When unset, the kernel's default will be used.
742 IPv4RouteLocalnet=
744 Takes a boolean. When true, the kernel does not consider loopback
745 addresses as martian source or destination while routing. This
746 enables the use of 127.0.0.0/8 for local routing purposes. When
747 unset, the kernel's default will be used.
748 IPv4ProxyARP=
750 Takes a boolean. Configures proxy ARP for IPv4. Proxy ARP is the
751 technique in which one host, usually a router, answers ARP requests
752 intended for another machine. By "faking" its identity, the router
753 accepts responsibility for routing packets to the "real"
754 destination. See RFC 1027[8]. When unset, the kernel's default will
755 be used.
756 IPv6ProxyNDP=
758 Takes a boolean. Configures proxy NDP for IPv6. Proxy NDP (Neighbor
759 Discovery Protocol) is a technique for IPv6 to allow routing of
760 addresses to a different destination when peers expect them to be
761 present on a certain physical link. In this case a router answers
762 Neighbour Advertisement messages intended for another machine by
763 offering its own MAC address as destination. Unlike proxy ARP for
764 IPv4, it is not enabled globally, but will only send Neighbour
765 Advertisement messages for addresses in the IPv6 neighbor proxy
766 table, which can also be shown by ip -6 neighbour show proxy.
767 systemd-networkd will control the per-interface `proxy_ndp` switch
768 for each configured interface depending on this option. When unset,
769 the kernel's default will be used.
770 IPv6ProxyNDPAddress=
772 An IPv6 address, for which Neighbour Advertisement messages will be
773 proxied. This option may be specified more than once.
774 systemd-networkd will add the IPv6ProxyNDPAddress= entries to the
775 kernel's IPv6 neighbor proxy table. This setting implies
776 IPv6ProxyNDP=yes but has no effect if IPv6ProxyNDP= has been set to
777 false. When unset, the kernel's default will be used.
778 IPv6SendRA=
780 Whether to enable or disable Router Advertisement sending on a
781 link. Takes a boolean value. When enabled, prefixes configured in
782 [IPv6Prefix] sections and routes configured in the
783 [IPv6RoutePrefix] sections are distributed as defined in the
784 [IPv6SendRA] section. If DHCPPrefixDelegation= is enabled, then the
785 delegated prefixes are also distributed. See DCHPPrefixDelegation=
786 setting and the [IPv6SendRA], [IPv6Prefix], [IPv6RoutePrefix], and
787 [DHCPPrefixDelegation] sections for more configuration options.
788 DHCPPrefixDelegation=
790 Takes a boolean value. When enabled, requests subnet prefixes on
791 another link via the DHCPv6 protocol or via the 6RD option in the
792 DHCPv4 protocol. An address within each delegated prefix will be
793 assigned, and the prefixes will be announced through IPv6 Router
794 Advertisement if IPv6SendRA= is enabled. This behaviour can be
795 configured in the [DHCPPrefixDelegation] section. Defaults to
796 disabled.
797 IPv6MTUBytes=
799 Configures IPv6 maximum transmission unit (MTU). An integer greater
800 than or equal to 1280 bytes. When unset, the kernel's default will
801 be used.
802 KeepMaster=
804 Takes a boolean value. When enabled, the current master interface
805 index will not be changed, and BatmanAdvanced=, Bond=, Bridge=, and
806 VRF= settings are ignored. This may be useful when a netdev with a
807 master interface is created by another program, e.g. systemd-
808 nspawn(1). Defaults to false.
809 BatmanAdvanced=, Bond=, Bridge=, VRF=
811 The name of the B.A.T.M.A.N. Advanced, bond, bridge, or VRF
812 interface to add the link to. See systemd.netdev(5).
813 IPoIB=, IPVLAN=, IPVTAP=, MACsec=, MACVLAN=, MACVTAP=, Tunnel=, VLAN=,
815 VXLAN=, Xfrm=
816 The name of an IPoIB, IPVLAN, IPVTAP, MACsec, MACVLAN, MACVTAP,
817 tunnel, VLAN, VXLAN, or Xfrm to be created on the link. See
818 systemd.netdev(5). This option may be specified more than once.
819 ActiveSlave=
821 Takes a boolean. Specifies the new active slave. The "ActiveSlave="
822 option is only valid for following modes: "active-backup",
823 "balance-alb", and "balance-tlb". Defaults to false.
824 PrimarySlave=
826 Takes a boolean. Specifies which slave is the primary device. The
827 specified device will always be the active slave while it is
828 available. Only when the primary is off-line will alternate devices
829 be used. This is useful when one slave is preferred over another,
830 e.g. when one slave has higher throughput than another. The
831 "PrimarySlave=" option is only valid for following modes:
832 "active-backup", "balance-alb", and "balance-tlb". Defaults to
833 false.
834 ConfigureWithoutCarrier=
836 Takes a boolean. Allows networkd to configure a specific link even
837 if it has no carrier. Defaults to false. If enabled, and the
838 IgnoreCarrierLoss= setting is not explicitly set, then it is
839 enabled as well.
840 IgnoreCarrierLoss=
842 Takes a boolean or a timespan. When true, systemd-networkd retains
843 both the static and dynamic configuration of the interface even if
844 its carrier is lost. When false, systemd-networkd drops both the
845 static and dynamic configuration of the interface. When a timespan
846 is specified, systemd-networkd waits for the specified timespan,
847 and ignores the carrier loss if the link regain its carrier within
848 the timespan. Setting 0 seconds is equivalent to "no", and
849 "infinite" is equivalent to "yes".
850 Setting a finite timespan may be useful when e.g. in the following
852 cases:
853 • A wireless interface connecting to a network which has multiple
855 access points with the same SSID.
856 • Enslaving a wireless interface to a bond interface, which may
858 disconnect from the connected access point and causes its
859 carrier to be lost.
860 • The driver of the interface resets when the MTU is changed.
862 When Bond= is specified to a wireless interface, defaults to 3
864 seconds. When the DHCPv4 client is enabled and UseMTU= in the
865 [DHCPv4] section enabled, defaults to 5 seconds. Otherwise,
866 defaults to the value specified with ConfigureWithoutCarrier=. When
867 ActivationPolicy= is set to "always-up", this is forced to "yes",
868 and ignored any user specified values.
869 KeepConfiguration=
871 Takes a boolean or one of "static", "dhcp-on-stop", "dhcp". When
872 "static", systemd-networkd will not drop static addresses and
873 routes on starting up process. When set to "dhcp-on-stop",
874 systemd-networkd will not drop addresses and routes on stopping the
875 daemon. When "dhcp", the addresses and routes provided by a DHCP
876 server will never be dropped even if the DHCP lease expires. This
877 is contrary to the DHCP specification, but may be the best choice
878 if, e.g., the root filesystem relies on this connection. The
879 setting "dhcp" implies "dhcp-on-stop", and "yes" implies "dhcp" and
880 "static". Defaults to "dhcp-on-stop" when systemd-networkd is
881 running in initrd, "yes" when the root filesystem is a network
882 filesystem, and "no" otherwise.
883
885 An [Address] section accepts the following keys. Specify several
886 [Address] sections to configure several addresses.
887 Address=
889 As in the [Network] section. This setting is mandatory. Each
890 [Address] section can contain one Address= setting.
891 Peer=
893 The peer address in a point-to-point connection. Accepts the same
894 format as the Address= setting.
895 Broadcast=
897 Takes an IPv4 address or boolean value. The address must be in the
898 format described in inet_pton(3). If set to true, then the IPv4
899 broadcast address will be derived from the Address= setting. If set
900 to false, then the broadcast address will not be set. Defaults to
901 true, except for wireguard interfaces, where it default to false.
902 Label=
904 Specifies the label for the IPv4 address. The label must be a 7-bit
905 ASCII string with a length of 1...15 characters. Defaults to unset.
906 PreferredLifetime=
908 Allows the default "preferred lifetime" of the address to be
909 overridden. Only three settings are accepted: "forever",
910 "infinity", which is the default and means that the address never
911 expires, and "0", which means that the address is considered
912 immediately "expired" and will not be used, unless explicitly
913 requested. A setting of PreferredLifetime=0 is useful for addresses
914 which are added to be used only by a specific application, which is
915 then configured to use them explicitly.
916 Scope=
918 The scope of the address, which can be "global" (valid everywhere
919 on the network, even through a gateway), "link" (only valid on this
920 device, will not traverse a gateway) or "host" (only valid within
921 the device itself, e.g. 127.0.0.1) or an integer in the range
922 0...255. Defaults to "global".
923 RouteMetric=
925 The metric of the prefix route, which is pointing to the subnet of
926 the configured IP address, taking the configured prefix length into
927 account. Takes an unsigned integer in the range 0...4294967295.
928 When unset or set to 0, the kernel's default value is used. This
929 setting will be ignored when AddPrefixRoute= is false.
930 HomeAddress=
932 Takes a boolean. Designates this address the "home address" as
933 defined in RFC 6275[9]. Supported only on IPv6. Defaults to false.
934 DuplicateAddressDetection=
936 Takes one of "ipv4", "ipv6", "both", or "none". When "ipv4",
937 performs IPv4 Address Conflict Detection. See RFC 5227[10]. When
938 "ipv6", performs IPv6 Duplicate Address Detection. See RFC
939 4862[11]. Defaults to "ipv4" for IPv4 link-local addresses, "ipv6"
940 for IPv6 addresses, and "none" otherwise.
941 ManageTemporaryAddress=
943 Takes a boolean. If true the kernel manage temporary addresses
944 created from this one as template on behalf of Privacy Extensions
945 RFC 3041[12]. For this to become active, the use_tempaddr sysctl
946 setting has to be set to a value greater than zero. The given
947 address needs to have a prefix length of 64. This flag allows using
948 privacy extensions in a manually configured network, just like if
949 stateless auto-configuration was active. Defaults to false.
950 AddPrefixRoute=
952 Takes a boolean. When true, the prefix route for the address is
953 automatically added. Defaults to true.
954 AutoJoin=
956 Takes a boolean. Joining multicast group on ethernet level via ip
957 maddr command would not work if we have an Ethernet switch that
958 does IGMP snooping since the switch would not replicate multicast
959 packets on ports that did not have IGMP reports for the multicast
960 addresses. Linux vxlan interfaces created via ip link add vxlan or
961 networkd's netdev kind vxlan have the group option that enables
962 them to do the required join. By extending ip address command with
963 option "autojoin" we can get similar functionality for openvswitch
964 (OVS) vxlan interfaces as well as other tunneling mechanisms that
965 need to receive multicast traffic. Defaults to "no".
966
968 A [Neighbor] section accepts the following keys. The neighbor section
969 adds a permanent, static entry to the neighbor table (IPv6) or ARP
970 table (IPv4) for the given hardware address on the links matched for
971 the network. Specify several [Neighbor] sections to configure several
972 static neighbors.
973 Address=
975 The IP address of the neighbor.
976 LinkLayerAddress=
978 The link layer address (MAC address or IP address) of the neighbor.
979
981 An [IPv6AddressLabel] section accepts the following keys. Specify
982 several [IPv6AddressLabel] sections to configure several address
983 labels. IPv6 address labels are used for address selection. See RFC
984 3484[13]. Precedence is managed by userspace, and only the label itself
985 is stored in the kernel.
986 Label=
988 The label for the prefix, an unsigned integer in the range
989 0...4294967294. 0xffffffff is reserved. This setting is mandatory.
990 Prefix=
992 IPv6 prefix is an address with a prefix length, separated by a
993 slash "/" character. This setting is mandatory.
994
996 An [RoutingPolicyRule] section accepts the following settings. Specify
997 several [RoutingPolicyRule] sections to configure several rules.
998 TypeOfService=
1000 Takes a number between 0 and 255 that specifies the type of service
1001 to match.
1002 From=
1004 Specifies the source address prefix to match. Possibly followed by
1005 a slash and the prefix length.
1006 To=
1008 Specifies the destination address prefix to match. Possibly
1009 followed by a slash and the prefix length.
1010 FirewallMark=
1012 Specifies the iptables firewall mark value to match (a number in
1013 the range 1...4294967295). Optionally, the firewall mask (also a
1014 number between 1...4294967295) can be suffixed with a slash ("/"),
1015 e.g., "7/255".
1016 Table=
1018 Specifies the routing table identifier to lookup if the rule
1019 selector matches. Takes one of predefined names "default", "main",
1020 and "local", and names defined in RouteTable= in networkd.conf(5),
1021 or a number between 1 and 4294967295. Defaults to "main".
1022 Priority=
1024 Specifies the priority of this rule. Priority= is an integer in
1025 the range 0...4294967295. Higher number means lower priority, and
1026 rules get processed in order of increasing number. Defaults to
1027 unset, and the kernel will pick a value dynamically.
1028 IncomingInterface=
1030 Specifies incoming device to match. If the interface is loopback,
1031 the rule only matches packets originating from this host.
1032 OutgoingInterface=
1034 Specifies the outgoing device to match. The outgoing interface is
1035 only available for packets originating from local sockets that are
1036 bound to a device.
1037 SourcePort=
1039 Specifies the source IP port or IP port range match in forwarding
1040 information base (FIB) rules. A port range is specified by the
1041 lower and upper port separated by a dash. Defaults to unset.
1042 DestinationPort=
1044 Specifies the destination IP port or IP port range match in
1045 forwarding information base (FIB) rules. A port range is specified
1046 by the lower and upper port separated by a dash. Defaults to unset.
1047 IPProtocol=
1049 Specifies the IP protocol to match in forwarding information base
1050 (FIB) rules. Takes IP protocol name such as "tcp", "udp" or "sctp",
1051 or IP protocol number such as "6" for "tcp" or "17" for "udp".
1052 Defaults to unset.
1053 InvertRule=
1055 A boolean. Specifies whether the rule is to be inverted. Defaults
1056 to false.
1057 Family=
1059 Takes a special value "ipv4", "ipv6", or "both". By default, the
1060 address family is determined by the address specified in To= or
1061 From=. If neither To= nor From= are specified, then defaults to
1062 "ipv4".
1063 User=
1065 Takes a username, a user ID, or a range of user IDs separated by a
1066 dash. Defaults to unset.
1067 SuppressPrefixLength=
1069 Takes a number N in the range 0...128 and rejects routing decisions
1070 that have a prefix length of N or less. Defaults to unset.
1071 SuppressInterfaceGroup=
1073 Takes an integer in the range 0...2147483647 and rejects routing
1074 decisions that have an interface with the same group id. It has the
1075 same meaning as suppress_ifgroup in ip rule. Defaults to unset.
1076 Type=
1078 Specifies Routing Policy Database (RPDB) rule type. Takes one of
1079 "blackhole", "unreachable" or "prohibit".
1080
1082 The [NextHop] section is used to manipulate entries in the kernel's
1083 "nexthop" tables. The [NextHop] section accepts the following settings.
1084 Specify several [NextHop] sections to configure several hops.
1085 Id=
1087 The id of the next hop. Takes an integer in the range
1088 1...4294967295. If unspecified, then automatically chosen by
1089 kernel.
1090 Gateway=
1092 As in the [Network] section.
1093 Family=
1095 Takes one of the special values "ipv4" or "ipv6". By default, the
1096 family is determined by the address specified in Gateway=. If
1097 Gateway= is not specified, then defaults to "ipv4".
1098 OnLink=
1100 Takes a boolean. If set to true, the kernel does not have to check
1101 if the gateway is reachable directly by the current machine (i.e.,
1102 attached to the local network), so that we can insert the nexthop
1103 in the kernel table without it being complained about. Defaults to
1104 "no".
1105 Blackhole=
1107 Takes a boolean. If enabled, packets to the corresponding routes
1108 are discarded silently, and Gateway= cannot be specified. Defaults
1109 to "no".
1110 Group=
1112 Takes a whitespace separated list of nexthop IDs. Each ID must be
1113 in the range 1...4294967295. Optionally, each nexthop ID can take a
1114 weight after a colon ("id[:weight]"). The weight must be in the
1115 range 1...255. If the weight is not specified, then it is assumed
1116 that the weight is 1. This setting cannot be specified with
1117 Gateway=, Family=, Blackhole=. This setting can be specified
1118 multiple times. If an empty string is assigned, then the all
1119 previous assignments are cleared. Defaults to unset.
1120
1122 The [Route] section accepts the following settings. Specify several
1123 [Route] sections to configure several routes.
1124 Gateway=
1126 Takes the gateway address or the special values "_dhcp4" and
1127 "_ipv6ra". If "_dhcp4" or "_ipv6ra" is set, then the gateway
1128 address provided by DHCPv4 or IPv6 RA is used.
1129 GatewayOnLink=
1131 Takes a boolean. If set to true, the kernel does not have to check
1132 if the gateway is reachable directly by the current machine (i.e.,
1133 attached to the local network), so that we can insert the route in
1134 the kernel table without it being complained about. Defaults to
1135 "no".
1136 Destination=
1138 The destination prefix of the route. Possibly followed by a slash
1139 and the prefix length. If omitted, a full-length host route is
1140 assumed.
1141 Source=
1143 The source prefix of the route. Possibly followed by a slash and
1144 the prefix length. If omitted, a full-length host route is assumed.
1145 Metric=
1147 The metric of the route. Takes an unsigned integer in the range
1148 0...4294967295. Defaults to unset, and the kernel's default will be
1149 used.
1150 IPv6Preference=
1152 Specifies the route preference as defined in RFC 4191[14] for
1153 Router Discovery messages. Which can be one of "low" the route has
1154 a lowest priority, "medium" the route has a default priority or
1155 "high" the route has a highest priority.
1156 Scope=
1158 The scope of the IPv4 route, which can be "global", "site", "link",
1159 "host", or "nowhere":
1160 • "global" means the route can reach hosts more than one hop
1162 away.
1163 • "site" means an interior route in the local autonomous system.
1165 • "link" means the route can only reach hosts on the local
1167 network (one hop away).
1168 • "host" means the route will not leave the local machine (used
1170 for internal addresses like 127.0.0.1).
1171 • "nowhere" means the destination doesn't exist.
1173 For IPv4 route, defaults to "host" if Type= is "local" or "nat",
1175 and "link" if Type= is "broadcast", "multicast", "anycast", or
1176 "unicast". In other cases, defaults to "global". The value is not
1177 used for IPv6.
1178 PreferredSource=
1180 The preferred source address of the route. The address must be in
1181 the format described in inet_pton(3).
1182 Table=
1184 The table identifier for the route. Takes one of predefined names
1185 "default", "main", and "local", and names defined in RouteTable= in
1186 networkd.conf(5), or a number between 1 and 4294967295. The table
1187 can be retrieved using ip route show table num. If unset and Type=
1188 is "local", "broadcast", "anycast", or "nat", then "local" is used.
1189 In other cases, defaults to "main".
1190 Protocol=
1192 The protocol identifier for the route. Takes a number between 0 and
1193 255 or the special values "kernel", "boot", "static", "ra" and
1194 "dhcp". Defaults to "static".
1195 Type=
1197 Specifies the type for the route. Takes one of "unicast", "local",
1198 "broadcast", "anycast", "multicast", "blackhole", "unreachable",
1199 "prohibit", "throw", "nat", and "xresolve". If "unicast", a regular
1200 route is defined, i.e. a route indicating the path to take to a
1201 destination network address. If "blackhole", packets to the defined
1202 route are discarded silently. If "unreachable", packets to the
1203 defined route are discarded and the ICMP message "Host Unreachable"
1204 is generated. If "prohibit", packets to the defined route are
1205 discarded and the ICMP message "Communication Administratively
1206 Prohibited" is generated. If "throw", route lookup in the current
1207 routing table will fail and the route selection process will return
1208 to Routing Policy Database (RPDB). Defaults to "unicast".
1209 InitialCongestionWindow=
1211 The TCP initial congestion window is used during the start of a TCP
1212 connection. During the start of a TCP session, when a client
1213 requests a resource, the server's initial congestion window
1214 determines how many packets will be sent during the initial burst
1215 of data without waiting for acknowledgement. Takes a number between
1216 1 and 1023. Note that 100 is considered an extremely large value
1217 for this option. When unset, the kernel's default (typically 10)
1218 will be used.
1219 InitialAdvertisedReceiveWindow=
1221 The TCP initial advertised receive window is the amount of receive
1222 data (in bytes) that can initially be buffered at one time on a
1223 connection. The sending host can send only that amount of data
1224 before waiting for an acknowledgment and window update from the
1225 receiving host. Takes a number between 1 and 1023. Note that 100 is
1226 considered an extremely large value for this option. When unset,
1227 the kernel's default will be used.
1228 QuickAck=
1230 Takes a boolean. When true enables TCP quick ack mode for the
1231 route. When unset, the kernel's default will be used.
1232 FastOpenNoCookie=
1234 Takes a boolean. When true enables TCP fastopen without a cookie on
1235 a per-route basis. When unset, the kernel's default will be used.
1236 TTLPropagate=
1238 Takes a boolean. When true enables TTL propagation at Label
1239 Switched Path (LSP) egress. When unset, the kernel's default will
1240 be used.
1241 MTUBytes=
1243 The maximum transmission unit in bytes to set for the route. The
1244 usual suffixes K, M, G, are supported and are understood to the
1245 base of 1024.
1246 TCPAdvertisedMaximumSegmentSize=
1248 Specifies the Path MSS (in bytes) hints given on TCP layer. The
1249 usual suffixes K, M, G, are supported and are understood to the
1250 base of 1024. An unsigned integer in the range 1...4294967294. When
1251 unset, the kernel's default will be used.
1252 MultiPathRoute=address[@name] [weight]
1254 Configures multipath route. Multipath routing is the technique of
1255 using multiple alternative paths through a network. Takes gateway
1256 address. Optionally, takes a network interface name or index
1257 separated with "@", and a weight in 1..256 for this multipath route
1258 separated with whitespace. This setting can be specified multiple
1259 times. If an empty string is assigned, then the all previous
1260 assignments are cleared.
1261 NextHop=
1263 Specifies the nexthop id. Takes an unsigned integer in the range
1264 1...4294967295. If set, the corresponding [NextHop] section must be
1265 configured. Defaults to unset.
1266
1268 The [DHCPv4] section configures the DHCPv4 client, if it is enabled
1269 with the DHCP= setting described above:
1270 SendHostname=
1272 When true (the default), the machine's hostname (or the value
1273 specified with Hostname=, described below) will be sent to the DHCP
1274 server. Note that the hostname must consist only of 7-bit ASCII
1275 lower-case characters and no spaces or dots, and be formatted as a
1276 valid DNS domain name. Otherwise, the hostname is not sent even if
1277 this option is true.
1278 Hostname=
1280 Use this value for the hostname which is sent to the DHCP server,
1281 instead of machine's hostname. Note that the specified hostname
1282 must consist only of 7-bit ASCII lower-case characters and no
1283 spaces or dots, and be formatted as a valid DNS domain name.
1284 MUDURL=
1286 When configured, the specified Manufacturer Usage Description (MUD)
1287 URL will be sent to the DHCPv4 server. Takes a URL of length up to
1288 255 characters. A superficial verification that the string is a
1289 valid URL will be performed. DHCPv4 clients are intended to have at
1290 most one MUD URL associated with them. See RFC 8520[15].
1291 MUD is an embedded software standard defined by the IETF that
1293 allows IoT device makers to advertise device specifications,
1294 including the intended communication patterns for their device when
1295 it connects to the network. The network can then use this to author
1296 a context-specific access policy, so the device functions only
1297 within those parameters.
1298 ClientIdentifier=
1300 The DHCPv4 client identifier to use. Takes one of mac, duid or
1301 duid-only. If set to mac, the MAC address of the link is used. If
1302 set to duid, an RFC4361-compliant Client ID, which is the
1303 combination of IAID and DUID (see below), is used. If set to
1304 duid-only, only DUID is used, this may not be RFC compliant, but
1305 some setups may require to use this. Defaults to duid.
1306 VendorClassIdentifier=
1308 The vendor class identifier used to identify vendor type and
1309 configuration.
1310 UserClass=
1312 A DHCPv4 client can use UserClass option to identify the type or
1313 category of user or applications it represents. The information
1314 contained in this option is a string that represents the user class
1315 of which the client is a member. Each class sets an identifying
1316 string of information to be used by the DHCP service to classify
1317 clients. Takes a whitespace-separated list of strings.
1318 DUIDType=
1320 Override the global DUIDType= setting for this network. See
1321 networkd.conf(5) for a description of possible values.
1322 DUIDRawData=
1324 Override the global DUIDRawData= setting for this network. See
1325 networkd.conf(5) for a description of possible values.
1326 IAID=
1328 The DHCP Identity Association Identifier (IAID) for the interface,
1329 a 32-bit unsigned integer.
1330 Anonymize=
1332 Takes a boolean. When true, the options sent to the DHCP server
1333 will follow the RFC 7844[16] (Anonymity Profiles for DHCP Clients)
1334 to minimize disclosure of identifying information. Defaults to
1335 false.
1336 This option should only be set to true when MACAddressPolicy= is
1338 set to random (see systemd.link(5)).
1339 When true, SendHostname=, ClientIdentifier=,
1341 VendorClassIdentifier=, UserClass=, RequestOptions=, SendOption=,
1342 SendVendorOption=, and MUDURL= are ignored.
1343 With this option enabled DHCP requests will mimic those generated
1345 by Microsoft Windows, in order to reduce the ability to fingerprint
1346 and recognize installations. This means DHCP request sizes will
1347 grow and lease data will be more comprehensive than normally,
1348 though most of the requested data is not actually used.
1349 RequestOptions=
1351 Sets request options to be sent to the server in the DHCPv4 request
1352 options list. A whitespace-separated list of integers in the range
1353 1...254. Defaults to unset.
1354 SendOption=
1356 Send an arbitrary raw option in the DHCPv4 request. Takes a DHCP
1357 option number, data type and data separated with a colon
1358 ("option:type:value"). The option number must be an integer in the
1359 range 1...254. The type takes one of "uint8", "uint16", "uint32",
1360 "ipv4address", or "string". Special characters in the data string
1361 may be escaped using C-style escapes[17]. This setting can be
1362 specified multiple times. If an empty string is specified, then all
1363 options specified earlier are cleared. Defaults to unset.
1364 SendVendorOption=
1366 Send an arbitrary vendor option in the DHCPv4 request. Takes a DHCP
1367 option number, data type and data separated with a colon
1368 ("option:type:value"). The option number must be an integer in the
1369 range 1...254. The type takes one of "uint8", "uint16", "uint32",
1370 "ipv4address", or "string". Special characters in the data string
1371 may be escaped using C-style escapes[17]. This setting can be
1372 specified multiple times. If an empty string is specified, then all
1373 options specified earlier are cleared. Defaults to unset.
1374 IPServiceType=
1376 Takes one of the special values "none", "CS6", or "CS4". When
1377 "none" no IP service type is set to the packet sent from the DHCPv4
1378 client. When "CS6" (network control) or "CS4" (realtime), the
1379 corresponding service type will be set. Defaults to "CS6".
1380 Label=
1382 Specifies the label for the IPv4 address received from the DHCP
1383 server. The label must be a 7-bit ASCII string with a length of
1384 1...15 characters. Defaults to unset.
1385 UseDNS=
1387 When true (the default), the DNS servers received from the DHCP
1388 server will be used.
1389 This corresponds to the nameserver option in resolv.conf(5).
1391 RoutesToDNS=
1393 When true, the routes to the DNS servers received from the DHCP
1394 server will be configured. When UseDNS= is disabled, this setting
1395 is ignored. Defaults to true.
1396 UseNTP=
1398 When true (the default), the NTP servers received from the DHCP
1399 server will be used by systemd-timesyncd.service.
1400 RoutesToNTP=
1402 When true, the routes to the NTP servers received from the DHCP
1403 server will be configured. When UseNTP= is disabled, this setting
1404 is ignored. Defaults to true.
1405 UseSIP=
1407 When true (the default), the SIP servers received from the DHCP
1408 server will be collected and made available to client programs.
1409 UseMTU=
1411 When true, the interface maximum transmission unit from the DHCP
1412 server will be used on the current link. If MTUBytes= is set, then
1413 this setting is ignored. Defaults to false.
1414 Note, some drivers will reset the interfaces if the MTU is changed.
1416 For such interfaces, please try to use IgnoreCarrierLoss= with a
1417 short timespan, e.g. "3 seconds".
1418 UseHostname=
1420 When true (the default), the hostname received from the DHCP server
1421 will be set as the transient hostname of the system.
1422 UseDomains=
1424 Takes a boolean, or the special value route. When true, the domain
1425 name received from the DHCP server will be used as DNS search
1426 domain over this link, similar to the effect of the Domains=
1427 setting. If set to route, the domain name received from the DHCP
1428 server will be used for routing DNS queries only, but not for
1429 searching, similar to the effect of the Domains= setting when the
1430 argument is prefixed with "~". Defaults to false.
1431 It is recommended to enable this option only on trusted networks,
1433 as setting this affects resolution of all hostnames, in particular
1434 of single-label names. It is generally safer to use the supplied
1435 domain only as routing domain, rather than as search domain, in
1436 order to not have it affect local resolution of single-label names.
1437 When set to true, this setting corresponds to the domain option in
1439 resolv.conf(5).
1440 UseRoutes=
1442 When true (the default), the static routes will be requested from
1443 the DHCP server and added to the routing table with a metric of
1444 1024, and a scope of global, link or host, depending on the route's
1445 destination and gateway. If the destination is on the local host,
1446 e.g., 127.x.x.x, or the same as the link's own address, the scope
1447 will be set to host. Otherwise if the gateway is null (a direct
1448 route), a link scope will be used. For anything else, scope
1449 defaults to global.
1450 RouteMetric=
1452 Set the routing metric for routes specified by the DHCP server
1453 (including the prefix route added for the specified prefix). Takes
1454 an unsigned integer in the range 0...4294967295. Defaults to 1024.
1455 RouteTable=num
1457 The table identifier for DHCP routes (a number between 1 and
1458 4294967295, or 0 to unset). The table can be retrieved using ip
1459 route show table num.
1460 When used in combination with VRF=, the VRF's routing table is used
1462 when this parameter is not specified.
1463 RouteMTUBytes=
1465 Specifies the MTU for the DHCP routes. Please see the [Route]
1466 section for further details.
1467 UseGateway=
1469 When true, the gateway will be requested from the DHCP server and
1470 added to the routing table with a metric of 1024, and a scope of
1471 link. When unset, the value specified with UseRoutes= is used.
1472 UseTimezone=
1474 When true, the timezone received from the DHCP server will be set
1475 as timezone of the local system. Defaults to false.
1476 Use6RD=
1478 When true, subnets of the received IPv6 prefix are assigned to
1479 downstream interfaces which enables DHCPPrefixDelegation=. See also
1480 DHCPPrefixDelegation= in the [Network] section, the
1481 [DHCPPrefixDelegation] section, and RFC 5969[18]. Defaults to
1482 false.
1483 FallbackLeaseLifetimeSec=
1485 Allows one to set DHCPv4 lease lifetime when DHCPv4 server does not
1486 send the lease lifetime. Takes one of "forever" or "infinity". If
1487 specified, the acquired address never expires. Defaults to unset.
1488 RequestBroadcast=
1490 Request the server to use broadcast messages before the IP address
1491 has been configured. This is necessary for devices that cannot
1492 receive RAW packets, or that cannot receive packets at all before
1493 an IP address has been configured. On the other hand, this must not
1494 be enabled on networks where broadcasts are filtered out.
1495 MaxAttempts=
1497 Specifies how many times the DHCPv4 client configuration should be
1498 attempted. Takes a number or "infinity". Defaults to "infinity".
1499 Note that the time between retries is increased exponentially, up
1500 to approximately one per minute, so the network will not be
1501 overloaded even if this number is high. The default is suitable in
1502 most circumstances.
1503 ListenPort=
1505 Set the port from which the DHCP client packets originate.
1506 DenyList=
1508 A whitespace-separated list of IPv4 addresses. Each address can
1509 optionally take a prefix length after "/". DHCP offers from servers
1510 in the list are rejected. Note that if AllowList= is configured
1511 then DenyList= is ignored.
1512 AllowList=
1514 A whitespace-separated list of IPv4 addresses. Each address can
1515 optionally take a prefix length after "/". DHCP offers from servers
1516 in the list are accepted.
1517 SendRelease=
1519 When true, the DHCPv4 client sends a DHCP release packet when it
1520 stops. Defaults to true.
1521 SendDecline=
1523 A boolean. When true, systemd-networkd performs IPv4 Duplicate
1524 Address Detection to the acquired address by the DHCPv4 client. If
1525 duplicate is detected, the DHCPv4 client rejects the address by
1526 sending a DHCPDECLINE packet to the DHCP server, and tries to
1527 obtain an IP address again. See RFC 5227[10]. Defaults to false.
1528
1530 The [DHCPv6] section configures the DHCPv6 client, if it is enabled
1531 with the DHCP= setting described above, or invoked by the IPv6 Router
1532 Advertisement:
1533 MUDURL=, IAID=, DUIDType=, DUIDRawData=, RequestOptions=
1535 As in the [DHCPv4] section.
1536 SendOption=
1538 As in the [DHCPv4] section, however because DHCPv6 uses 16-bit
1539 fields to store option numbers, the option number is an integer in
1540 the range 1...65536.
1541 SendVendorOption=
1543 Send an arbitrary vendor option in the DHCPv6 request. Takes an
1544 enterprise identifier, DHCP option number, data type, and data
1545 separated with a colon ("enterprise identifier:option:type:value").
1546 Enterprise identifier is an unsigned integer in the range
1547 1...4294967294. The option number must be an integer in the range
1548 1...254. Data type takes one of "uint8", "uint16", "uint32",
1549 "ipv4address", "ipv6address", or "string". Special characters in
1550 the data string may be escaped using C-style escapes[17]. This
1551 setting can be specified multiple times. If an empty string is
1552 specified, then all options specified earlier are cleared. Defaults
1553 to unset.
1554 UserClass=
1556 A DHCPv6 client can use User Class option to identify the type or
1557 category of user or applications it represents. The information
1558 contained in this option is a string that represents the user class
1559 of which the client is a member. Each class sets an identifying
1560 string of information to be used by the DHCP service to classify
1561 clients. Special characters in the data string may be escaped using
1562 C-style escapes[17]. This setting can be specified multiple times.
1563 If an empty string is specified, then all options specified earlier
1564 are cleared. Takes a whitespace-separated list of strings. Note
1565 that currently NUL bytes are not allowed.
1566 VendorClass=
1568 A DHCPv6 client can use VendorClass option to identify the vendor
1569 that manufactured the hardware on which the client is running. The
1570 information contained in the data area of this option is contained
1571 in one or more opaque fields that identify details of the hardware
1572 configuration. Takes a whitespace-separated list of strings.
1573 PrefixDelegationHint=
1575 Takes an IPv6 address with prefix length in the same format as the
1576 Address= in the [Network] section. The DHCPv6 client will include a
1577 prefix hint in the DHCPv6 solicitation sent to the server. The
1578 prefix length must be in the range 1...128. Defaults to unset.
1579 UseAddress=
1581 When true (the default), the IP addresses provided by the DHCPv6
1582 server will be assigned.
1583 UseDelegatedPrefix=
1585 When true (the default), the client will request the DHCPv6 server
1586 to delegate prefixes. If the server provides prefixes to be
1587 delegated, then subnets of the prefixes are assigned to the
1588 interfaces that have DHCPPrefixDelegation=yes. See also the
1589 DHCPPrefixDelegation= setting in the [Network] section, settings in
1590 the [DHCPPrefixDelegation] section, and RFC 8415[19].
1591 UseDNS=, UseNTP=, UseHostname=, UseDomains=
1593 As in the [DHCPv4] section.
1594 WithoutRA=
1596 Allows DHCPv6 client to start without router advertisements's
1597 "managed" or "other configuration" flag. Takes one of "no",
1598 "solicit", or "information-request". If this is not specified,
1599 "solicit" is used when DHCPPrefixDelegation= is enabled and
1600 UplinkInterface=:self is specified in the [DHCPPrefixDelegation]
1601 section. Otherwise, defaults to "no", and the DHCPv6 client will be
1602 started when an RA is received. See also the DHCPv6Client= setting
1603 in the [IPv6AcceptRA] section.
1604
1606 The [DHCPPrefixDelegation] section configures subnet prefixes of the
1607 delegated prefixes acquired by a DHCPv6 client, or by a DHCPv4 client
1608 through the 6RD option on another interface. The settings in this
1609 section are used only when the DHCPPrefixDelegation= setting in the
1610 [Network] section is enabled.
1611 UplinkInterface=
1613 Specifies the name or the index of the uplink interface, or one of
1614 the special values ":self" and ":auto". When ":self", the interface
1615 itself is considered the uplink interface, and WithoutRA=solicit is
1616 implied if the setting is not explicitly specified. When ":auto",
1617 the first link which acquired prefixes to be delegated from the
1618 DHCPv6 or DHCPv4 server is selected. Defaults to ":auto".
1619 SubnetId=
1621 Configure a specific subnet ID on the interface from a (previously)
1622 received prefix delegation. You can either set "auto" (the default)
1623 or a specific subnet ID (as defined in RFC 4291[20], section
1624 2.5.4), in which case the allowed value is hexadecimal, from 0 to
1625 0x7fffffffffffffff inclusive.
1626 Announce=
1628 Takes a boolean. When enabled, and IPv6SendRA= in [Network] section
1629 is enabled, the delegated prefixes are distributed through the IPv6
1630 Router Advertisement. This setting will be ignored when the
1631 DHCPPrefixDelegation= setting is enabled on the upstream interface.
1632 Defaults to yes.
1633 Assign=
1635 Takes a boolean. Specifies whether to add an address from the
1636 delegated prefixes which are received from the WAN interface by the
1637 DHCPv6 Prefix Delegation. When true (on LAN interfce), the EUI-64
1638 algorithm will be used by default to form an interface identifier
1639 from the delegated prefixes. See also Token= setting below.
1640 Defaults to yes.
1641 Token=
1643 Specifies an optional address generation mode for assigning an
1644 address in each delegated prefix. This accepts the same syntax as
1645 Token= in the [IPv6AcceptRA] section. If Assign= is set to false,
1646 then this setting will be ignored. Defaults to unset, which means
1647 the EUI-64 algorithm will be used.
1648 ManageTemporaryAddress=
1650 As in the [Address] section, but defaults to true.
1651 RouteMetric=
1653 The metric of the route to the delegated prefix subnet. Takes an
1654 unsigned integer in the range 0...4294967295. When set to 0, the
1655 kernel's default value is used. Defaults to 256.
1656
1658 The [IPv6AcceptRA] section configures the IPv6 Router Advertisement
1659 (RA) client, if it is enabled with the IPv6AcceptRA= setting described
1660 above:
1661 Token=
1663 Specifies an optional address generation mode for the Stateless
1664 Address Autoconfiguration (SLAAC). The following values are
1665 supported:
1666 eui64
1668 The EUI-64 algorithm will be used to generate an address for
1669 that prefix. Only supported by Ethernet or InfiniBand
1670 interfaces.
1671 static:ADDRESS
1673 An IPv6 address must be specified after a colon (":"), and the
1674 lower bits of the supplied address are combined with the upper
1675 bits of a prefix received in a Router Advertisement (RA)
1676 message to form a complete address. Note that if multiple
1677 prefixes are received in an RA message, or in multiple RA
1678 messages, addresses will be formed from each of them using the
1679 supplied address. This mode implements SLAAC but uses a static
1680 interface identifier instead of an identifier generated by
1681 using the EUI-64 algorithm. Because the interface identifier is
1682 static, if Duplicate Address Detection detects that the
1683 computed address is a duplicate (in use by another node on the
1684 link), then this mode will fail to provide an address for that
1685 prefix. If an IPv6 address without mode is specified, then
1686 "static" mode is assumed.
1687 prefixstable[:ADDRESS][,UUID]
1689 The algorithm specified in RFC 7217[21] will be used to
1690 generate interface identifiers. This mode can optionally take
1691 an IPv6 address separated with a colon (":"). If an IPv6
1692 address is specified, then an interface identifier is generated
1693 only when a prefix received in an RA message matches the
1694 supplied address.
1695 This mode can also optionally take a non-null UUID in the
1697 format which sd_id128_from_string() accepts, e.g.
1698 "86b123b969ba4b7eb8b3d8605123525a" or
1699 "86b123b9-69ba-4b7e-b8b3-d8605123525a". If a UUID is specified,
1700 the value is used as the secret key to generate interface
1701 identifiers. If not specified, then an application specific ID
1702 generated with the system's machine-ID will be used as the
1703 secret key. See sd-id128(3), sd_id128_from_string(3), and
1704 sd_id128_get_machine(3).
1705 Note that the "prefixstable" algorithm uses both the interface
1707 name and MAC address as input to the hash to compute the
1708 interface identifier, so if either of those are changed the
1709 resulting interface identifier (and address) will be changed,
1710 even if the prefix received in the RA message has not been
1711 changed.
1712 If no address generation mode is specified (which is the default),
1714 or a received prefix does not match any of the addresses provided
1715 in "prefixstable" mode, then the EUI-64 algorithm will be used for
1716 Ethernet or InfiniBand interfaces, otherwise "prefixstable" will be
1717 used to form an interface identifier for that prefix.
1718 This setting can be specified multiple times. If an empty string is
1720 assigned, then the all previous assignments are cleared.
1721 Examples:
1723 Token=eui64
1725 Token=::1a:2b:3c:4d
1726 Token=static:::1a:2b:3c:4d
1727 Token=prefixstable
1728 Token=prefixstable:2002:da8:1::
1729 UseDNS=
1731 When true (the default), the DNS servers received in the Router
1732 Advertisement will be used.
1733 This corresponds to the nameserver option in resolv.conf(5).
1735 UseDomains=
1737 Takes a boolean, or the special value "route". When true, the
1738 domain name received via IPv6 Router Advertisement (RA) will be
1739 used as DNS search domain over this link, similar to the effect of
1740 the Domains= setting. If set to "route", the domain name received
1741 via IPv6 RA will be used for routing DNS queries only, but not for
1742 searching, similar to the effect of the Domains= setting when the
1743 argument is prefixed with "~". Defaults to false.
1744 It is recommended to enable this option only on trusted networks,
1746 as setting this affects resolution of all hostnames, in particular
1747 of single-label names. It is generally safer to use the supplied
1748 domain only as routing domain, rather than as search domain, in
1749 order to not have it affect local resolution of single-label names.
1750 When set to true, this setting corresponds to the domain option in
1752 resolv.conf(5).
1753 RouteTable=num
1755 The table identifier for the routes received in the Router
1756 Advertisement (a number between 1 and 4294967295, or 0 to unset).
1757 The table can be retrieved using ip route show table num.
1758 RouteMetric=
1760 Set the routing metric for the routes received in the Router
1761 Advertisement. Takes an unsigned integer in the range
1762 0...4294967295. Defaults to 1024.
1763 UseMTU=
1765 Takes a boolean. When true, the MTU received in the Router
1766 Advertisement will be used. Defaults to true.
1767 UseGateway=
1769 When true (the default), the router address will be configured as
1770 the default gateway.
1771 UseRoutePrefix=
1773 When true (the default), the routes corresponding to the route
1774 prefixes received in the Router Advertisement will be configured.
1775 UseAutonomousPrefix=
1777 When true (the default), the autonomous prefix received in the
1778 Router Advertisement will be used and take precedence over any
1779 statically configured ones.
1780 UseOnLinkPrefix=
1782 When true (the default), the onlink prefix received in the Router
1783 Advertisement will be used and takes precedence over any statically
1784 configured ones.
1785 RouterDenyList=
1787 A whitespace-separated list of IPv6 router addresses. Each address
1788 can optionally take a prefix length after "/". Any information
1789 advertised by the listed router is ignored.
1790 RouterAllowList=
1792 A whitespace-separated list of IPv6 router addresses. Each address
1793 can optionally take a prefix length after "/". Only information
1794 advertised by the listed router is accepted. Note that if
1795 RouterAllowList= is configured then RouterDenyList= is ignored.
1796 PrefixDenyList=
1798 A whitespace-separated list of IPv6 prefixes. Each prefix can
1799 optionally take its prefix length after "/". IPv6 prefixes supplied
1800 via router advertisements in the list are ignored.
1801 PrefixAllowList=
1803 A whitespace-separated list of IPv6 prefixes. Each prefix can
1804 optionally take its prefix length after "/". IPv6 prefixes supplied
1805 via router advertisements in the list are allowed. Note that if
1806 PrefixAllowList= is configured then PrefixDenyList= is ignored.
1807 RouteDenyList=
1809 A whitespace-separated list of IPv6 route prefixes. Each prefix can
1810 optionally take its prefix length after "/". IPv6 route prefixes
1811 supplied via router advertisements in the list are ignored.
1812 RouteAllowList=
1814 A whitespace-separated list of IPv6 route prefixes. Each prefix can
1815 optionally take its prefix length after "/". IPv6 route prefixes
1816 supplied via router advertisements in the list are allowed. Note
1817 that if RouteAllowList= is configured then RouteDenyList= is
1818 ignored.
1819 DHCPv6Client=
1821 Takes a boolean, or the special value "always". When true, the
1822 DHCPv6 client will be started in "solicit" mode if the RA has the
1823 "managed" flag or "information-request" mode if the RA lacks the
1824 "managed" flag but has the "other configuration" flag. If set to
1825 "always", the DHCPv6 client will be started in "solicit" mode when
1826 an RA is received, even if neither the "managed" nor the "other
1827 configuration" flag is set in the RA. This will be ignored when
1828 WithoutRA= in the [DHCPv6] section is enabled, or
1829 UplinkInterface=:self in the [DHCPPrefixDelegation] section is
1830 specified. Defaults to true.
1831
1833 The [DHCPServer] section contains settings for the DHCP server, if
1834 enabled via the DHCPServer= option described above:
1835 ServerAddress=
1837 Specifies server address for the DHCP server. Takes an IPv4 address
1838 with prefix length, for example 192.168.0.1/24. This setting may be
1839 useful when the link on which the DHCP server is running has
1840 multiple static addresses. When unset, one of static addresses in
1841 the link will be automatically selected. Defaults to unset.
1842 PoolOffset=, PoolSize=
1844 Configures the pool of addresses to hand out. The pool is a
1845 contiguous sequence of IP addresses in the subnet configured for
1846 the server address, which does not include the subnet nor the
1847 broadcast address. PoolOffset= takes the offset of the pool from
1848 the start of subnet, or zero to use the default value. PoolSize=
1849 takes the number of IP addresses in the pool or zero to use the
1850 default value. By default, the pool starts at the first address
1851 after the subnet address and takes up the rest of the subnet,
1852 excluding the broadcast address. If the pool includes the server
1853 address (the default), this is reserved and not handed out to
1854 clients.
1855 DefaultLeaseTimeSec=, MaxLeaseTimeSec=
1857 Control the default and maximum DHCP lease time to pass to clients.
1858 These settings take time values in seconds or another common time
1859 unit, depending on the suffix. The default lease time is used for
1860 clients that did not ask for a specific lease time. If a client
1861 asks for a lease time longer than the maximum lease time, it is
1862 automatically shortened to the specified time. The default lease
1863 time defaults to 1h, the maximum lease time to 12h. Shorter lease
1864 times are beneficial if the configuration data in DHCP leases
1865 changes frequently and clients shall learn the new settings with
1866 shorter latencies. Longer lease times reduce the generated DHCP
1867 network traffic.
1868 UplinkInterface=
1870 Specifies the name or the index of the uplink interface, or one of
1871 the special values ":none" and ":auto". When emitting DNS, NTP, or
1872 SIP servers is enabled but no servers are specified, the servers
1873 configured in the uplink interface will be emitted. When ":auto",
1874 the link which has a default gateway with the highest priority will
1875 be automatically selected. When ":none", no uplink interface will
1876 be selected. Defaults to ":auto".
1877 EmitDNS=, DNS=
1879 EmitDNS= takes a boolean. Configures whether the DHCP leases handed
1880 out to clients shall contain DNS server information. Defaults to
1881 "yes". The DNS servers to pass to clients may be configured with
1882 the DNS= option, which takes a list of IPv4 addresses, or special
1883 value "_server_address" which will be converted to the address used
1884 by the DHCP server.
1885 If the EmitDNS= option is enabled but no servers configured, the
1887 servers are automatically propagated from an "uplink" interface
1888 that has appropriate servers set. The "uplink" interface is
1889 determined by the default route of the system with the highest
1890 priority. Note that this information is acquired at the time the
1891 lease is handed out, and does not take uplink interfaces into
1892 account that acquire DNS server information at a later point. If no
1893 suitable uplink interface is found the DNS server data from
1894 /etc/resolv.conf is used. Also, note that the leases are not
1895 refreshed if the uplink network configuration changes. To ensure
1896 clients regularly acquire the most current uplink DNS server
1897 information, it is thus advisable to shorten the DHCP lease time
1898 via MaxLeaseTimeSec= described above.
1899 This setting can be specified multiple times. If an empty string is
1901 specified, then all DNS servers specified earlier are cleared.
1902 EmitNTP=, NTP=, EmitSIP=, SIP=, EmitPOP3=, POP3=, EmitSMTP=, SMTP=,
1904 EmitLPR=, LPR=
1905 Similar to the EmitDNS= and DNS= settings described above, these
1906 settings configure whether and what server information for the
1907 indicate protocol shall be emitted as part of the DHCP lease. The
1908 same syntax, propagation semantics and defaults apply as for
1909 EmitDNS= and DNS=.
1910 EmitRouter=, Router=
1912 The EmitRouter= setting takes a boolean value, and configures
1913 whether the DHCP lease should contain the router option. The
1914 Router= setting takes an IPv4 address, and configures the router
1915 address to be emitted. When the Router= setting is not specified,
1916 then the server address will be used for the router option. When
1917 the EmitRouter= setting is disabled, the Router= setting will be
1918 ignored. The EmitRouter= setting defaults to true, and the Router=
1919 setting defaults to unset.
1920 EmitTimezone=, Timezone=
1922 Takes a boolean. Configures whether the DHCP leases handed out to
1923 clients shall contain timezone information. Defaults to "yes". The
1924 Timezone= setting takes a timezone string (such as "Europe/Berlin"
1925 or "UTC") to pass to clients. If no explicit timezone is set, the
1926 system timezone of the local host is propagated, as determined by
1927 the /etc/localtime symlink.
1928 BootServerAddress=
1930 Takes an IPv4 address of the boot server used by e.g. PXE boot
1931 systems. When specified, this address is sent in the siaddr field
1932 of the DHCP message header. See RFC 2131[22] for more details.
1933 Defaults to unset.
1934 BootServerName=
1936 Takes a name of the boot server used by e.g. PXE boot systems. When
1937 specified, this name is sent in the DHCP option 66 ("TFTP server
1938 name"). See RFC 2132[23] for more details. Defaults to unset.
1939 Note that typically setting one of BootServerName= or
1941 BootServerAddress= is sufficient, but both can be set too, if
1942 desired.
1943 BootFilename=
1945 Takes a path or URL to a file loaded by e.g. a PXE boot loader.
1946 When specified, this path is sent in the DHCP option 67 ("Bootfile
1947 name"). See RFC 2132[23] for more details. Defaults to unset.
1948 SendOption=
1950 Send a raw option with value via DHCPv4 server. Takes a DHCP option
1951 number, data type and data ("option:type:value"). The option number
1952 is an integer in the range 1...254. The type takes one of "uint8",
1953 "uint16", "uint32", "ipv4address", "ipv6address", or "string".
1954 Special characters in the data string may be escaped using C-style
1955 escapes[17]. This setting can be specified multiple times. If an
1956 empty string is specified, then all options specified earlier are
1957 cleared. Defaults to unset.
1958 SendVendorOption=
1960 Send a vendor option with value via DHCPv4 server. Takes a DHCP
1961 option number, data type and data ("option:type:value"). The option
1962 number is an integer in the range 1...254. The type takes one of
1963 "uint8", "uint16", "uint32", "ipv4address", or "string". Special
1964 characters in the data string may be escaped using C-style
1965 escapes[17]. This setting can be specified multiple times. If an
1966 empty string is specified, then all options specified earlier are
1967 cleared. Defaults to unset.
1968 BindToInterface=
1970 Takes a boolean value. When "yes", DHCP server socket will be bound
1971 to its network interface and all socket communication will be
1972 restricted to this interface. Defaults to "yes", except if
1973 RelayTarget= is used (see below), in which case it defaults to
1974 "no".
1975 RelayTarget=
1977 Takes an IPv4 address, which must be in the format described in
1978 inet_pton(3). Turns this DHCP server into a DHCP relay agent. See
1979 RFC 1542[24]. The address is the address of DHCP server or another
1980 relay agent to forward DHCP messages to and from.
1981 RelayAgentCircuitId=
1983 Specifies value for Agent Circuit ID suboption of Relay Agent
1984 Information option. Takes a string, which must be in the format
1985 "string:value", where "value" should be replaced with the value of
1986 the suboption. Defaults to unset (means no Agent Circuit ID
1987 suboption is generated). Ignored if RelayTarget= is not specified.
1988 RelayAgentRemoteId=
1990 Specifies value for Agent Remote ID suboption of Relay Agent
1991 Information option. Takes a string, which must be in the format
1992 "string:value", where "value" should be replaced with the value of
1993 the suboption. Defaults to unset (means no Agent Remote ID
1994 suboption is generated). Ignored if RelayTarget= is not specified.
1995
1997 The "[DHCPServerStaticLease]" section configures a static DHCP lease to
1998 assign a fixed IPv4 address to a specific device based on its MAC
1999 address. This section can be specified multiple times.
2000 MACAddress=
2002 The hardware address of a device to match. This key is mandatory.
2003 Address=
2005 The IPv4 address that should be assigned to the device that was
2006 matched with MACAddress=. This key is mandatory.
2007
2009 The [IPv6SendRA] section contains settings for sending IPv6 Router
2010 Advertisements and whether to act as a router, if enabled via the
2011 IPv6SendRA= option described above. IPv6 network prefixes or routes are
2012 defined with one or more [IPv6Prefix] or [IPv6RoutePrefix] sections.
2013 Managed=, OtherInformation=
2015 Takes a boolean. Controls whether a DHCPv6 server is used to
2016 acquire IPv6 addresses on the network link when Managed= is set to
2017 "true" or if only additional network information can be obtained
2018 via DHCPv6 for the network link when OtherInformation= is set to
2019 "true". Both settings default to "false", which means that a DHCPv6
2020 server is not being used.
2021 RouterLifetimeSec=
2023 Takes a timespan. Configures the IPv6 router lifetime in seconds.
2024 The value must be 0 seconds, or between 4 seconds and 9000 seconds.
2025 When set to 0, the host is not acting as a router. Defaults to 1800
2026 seconds (30 minutes).
2027 RouterPreference=
2029 Configures IPv6 router preference if RouterLifetimeSec= is
2030 non-zero. Valid values are "high", "medium" and "low", with
2031 "normal" and "default" added as synonyms for "medium" just to make
2032 configuration easier. See RFC 4191[14] for details. Defaults to
2033 "medium".
2034 UplinkInterface=
2036 Specifies the name or the index of the uplink interface, or one of
2037 the special values ":none" and ":auto". When emitting DNS servers
2038 or search domains is enabled but no servers are specified, the
2039 servers configured in the uplink interface will be emitted. When
2040 ":auto", the value specified to the same setting in the
2041 [DHCPPrefixDelegation] section will be used if
2042 DHCPPrefixDelegation= is enabled, otherwise the link which has a
2043 default gateway with the highest priority will be automatically
2044 selected. When ":none", no uplink interface will be selected.
2045 Defaults to ":auto".
2046 EmitDNS=, DNS=
2048 DNS= specifies a list of recursive DNS server IPv6 addresses that
2049 are distributed via Router Advertisement messages when EmitDNS= is
2050 true. DNS= also takes special value "_link_local"; in that case
2051 the IPv6 link-local address is distributed. If DNS= is empty, DNS
2052 servers are read from the [Network] section. If the [Network]
2053 section does not contain any DNS servers either, DNS servers from
2054 the uplink interface specified in UplinkInterface= will be used.
2055 When EmitDNS= is false, no DNS server information is sent in Router
2056 Advertisement messages. EmitDNS= defaults to true.
2057 EmitDomains=, Domains=
2059 A list of DNS search domains distributed via Router Advertisement
2060 messages when EmitDomains= is true. If Domains= is empty, DNS
2061 search domains are read from the [Network] section. If the
2062 [Network] section does not contain any DNS search domains either,
2063 DNS search domains from the uplink interface specified in
2064 UplinkInterface= will be used. When EmitDomains= is false, no DNS
2065 search domain information is sent in Router Advertisement messages.
2066 EmitDomains= defaults to true.
2067 DNSLifetimeSec=
2069 Lifetime in seconds for the DNS server addresses listed in DNS= and
2070 search domains listed in Domains=. Defaults to 3600 seconds (one
2071 hour).
2072
2074 One or more [IPv6Prefix] sections contain the IPv6 prefixes that are
2075 announced via Router Advertisements. See RFC 4861[25] for further
2076 details.
2077 AddressAutoconfiguration=, OnLink=
2079 Takes a boolean to specify whether IPv6 addresses can be
2080 autoconfigured with this prefix and whether the prefix can be used
2081 for onlink determination. Both settings default to "true" in order
2082 to ease configuration.
2083 Prefix=
2085 The IPv6 prefix that is to be distributed to hosts. Similarly to
2086 configuring static IPv6 addresses, the setting is configured as an
2087 IPv6 prefix and its prefix length, separated by a "/" character.
2088 Use multiple [IPv6Prefix] sections to configure multiple IPv6
2089 prefixes since prefix lifetimes, address autoconfiguration and
2090 onlink status may differ from one prefix to another.
2091 PreferredLifetimeSec=, ValidLifetimeSec=
2093 Preferred and valid lifetimes for the prefix measured in seconds.
2094 PreferredLifetimeSec= defaults to 1800 seconds (30 minutes) and
2095 ValidLifetimeSec= defaults to 3600 seconds (one hour).
2096 Assign=
2098 Takes a boolean. When true, adds an address from the prefix.
2099 Default to false.
2100 Token=
2102 Specifies an optional address generation mode for assigning an
2103 address in each prefix. This accepts the same syntax as Token= in
2104 the [IPv6AcceptRA] section. If Assign= is set to false, then this
2105 setting will be ignored. Defaults to unset, which means the EUI-64
2106 algorithm will be used.
2107 RouteMetric=
2109 The metric of the prefix route. Takes an unsigned integer in the
2110 range 0...4294967295. When unset or set to 0, the kernel's default
2111 value is used. This setting is ignored when Assign= is false.
2112
2114 One or more [IPv6RoutePrefix] sections contain the IPv6 prefix routes
2115 that are announced via Router Advertisements. See RFC 4191[14] for
2116 further details.
2117 Route=
2119 The IPv6 route that is to be distributed to hosts. Similarly to
2120 configuring static IPv6 routes, the setting is configured as an
2121 IPv6 prefix routes and its prefix route length, separated by a "/"
2122 character. Use multiple [IPv6RoutePrefix] sections to configure
2123 multiple IPv6 prefix routes.
2124 LifetimeSec=
2126 Lifetime for the route prefix measured in seconds. LifetimeSec=
2127 defaults to 3600 seconds (one hour).
2128
2130 The [Bridge] section accepts the following keys:
2131 UnicastFlood=
2133 Takes a boolean. Controls whether the bridge should flood traffic
2134 for which an FDB entry is missing and the destination is unknown
2135 through this port. When unset, the kernel's default will be used.
2136 MulticastFlood=
2138 Takes a boolean. Controls whether the bridge should flood traffic
2139 for which an MDB entry is missing and the destination is unknown
2140 through this port. When unset, the kernel's default will be used.
2141 MulticastToUnicast=
2143 Takes a boolean. Multicast to unicast works on top of the multicast
2144 snooping feature of the bridge. Which means unicast copies are only
2145 delivered to hosts which are interested in it. When unset, the
2146 kernel's default will be used.
2147 NeighborSuppression=
2149 Takes a boolean. Configures whether ARP and ND neighbor suppression
2150 is enabled for this port. When unset, the kernel's default will be
2151 used.
2152 Learning=
2154 Takes a boolean. Configures whether MAC address learning is enabled
2155 for this port. When unset, the kernel's default will be used.
2156 HairPin=
2158 Takes a boolean. Configures whether traffic may be sent back out of
2159 the port on which it was received. When this flag is false, then
2160 the bridge will not forward traffic back out of the receiving port.
2161 When unset, the kernel's default will be used.
2162 Isolated=
2164 Takes a boolean. Configures whether this port is isolated or not.
2165 Within a bridge, isolated ports can only communicate with
2166 non-isolated ports. When set to true, this port can only
2167 communicate with other ports whose Isolated setting is false. When
2168 set to false, this port can communicate with any other ports. When
2169 unset, the kernel's default will be used.
2170 UseBPDU=
2172 Takes a boolean. Configures whether STP Bridge Protocol Data Units
2173 will be processed by the bridge port. When unset, the kernel's
2174 default will be used.
2175 FastLeave=
2177 Takes a boolean. This flag allows the bridge to immediately stop
2178 multicast traffic on a port that receives an IGMP Leave message. It
2179 is only used with IGMP snooping if enabled on the bridge. When
2180 unset, the kernel's default will be used.
2181 AllowPortToBeRoot=
2183 Takes a boolean. Configures whether a given port is allowed to
2184 become a root port. Only used when STP is enabled on the bridge.
2185 When unset, the kernel's default will be used.
2186 ProxyARP=
2188 Takes a boolean. Configures whether proxy ARP to be enabled on this
2189 port. When unset, the kernel's default will be used.
2190 ProxyARPWiFi=
2192 Takes a boolean. Configures whether proxy ARP to be enabled on this
2193 port which meets extended requirements by IEEE 802.11 and Hotspot
2194 2.0 specifications. When unset, the kernel's default will be used.
2195 MulticastRouter=
2197 Configures this port for having multicast routers attached. A port
2198 with a multicast router will receive all multicast traffic. Takes
2199 one of "no" to disable multicast routers on this port, "query" to
2200 let the system detect the presence of routers, "permanent" to
2201 permanently enable multicast traffic forwarding on this port, or
2202 "temporary" to enable multicast routers temporarily on this port,
2203 not depending on incoming queries. When unset, the kernel's default
2204 will be used.
2205 Cost=
2207 Sets the "cost" of sending packets of this interface. Each port in
2208 a bridge may have a different speed and the cost is used to decide
2209 which link to use. Faster interfaces should have lower costs. It is
2210 an integer value between 1 and 65535.
2211 Priority=
2213 Sets the "priority" of sending packets on this interface. Each port
2214 in a bridge may have a different priority which is used to decide
2215 which link to use. Lower value means higher priority. It is an
2216 integer value between 0 to 63. Networkd does not set any default,
2217 meaning the kernel default value of 32 is used.
2218
2220 The [BridgeFDB] section manages the forwarding database table of a port
2221 and accepts the following keys. Specify several [BridgeFDB] sections to
2222 configure several static MAC table entries.
2223 MACAddress=
2225 As in the [Network] section. This key is mandatory.
2226 Destination=
2228 Takes an IP address of the destination VXLAN tunnel endpoint.
2229 VLANId=
2231 The VLAN ID for the new static MAC table entry. If omitted, no VLAN
2232 ID information is appended to the new static MAC table entry.
2233 VNI=
2235 The VXLAN Network Identifier (or VXLAN Segment ID) to use to
2236 connect to the remote VXLAN tunnel endpoint. Takes a number in the
2237 range 1...16777215. Defaults to unset.
2238 AssociatedWith=
2240 Specifies where the address is associated with. Takes one of "use",
2241 "self", "master" or "router". "use" means the address is in use.
2242 User space can use this option to indicate to the kernel that the
2243 fdb entry is in use. "self" means the address is associated with
2244 the port drivers fdb. Usually hardware. "master" means the address
2245 is associated with master devices fdb. "router" means the
2246 destination address is associated with a router. Note that it's
2247 valid if the referenced device is a VXLAN type device and has route
2248 shortcircuit enabled. Defaults to "self".
2249 OutgoingInterface=
2251 Specifies the name or index of the outgoing interface for the VXLAN
2252 device driver to reach the remote VXLAN tunnel endpoint. Defaults
2253 to unset.
2254
2256 The [BridgeMDB] section manages the multicast membership entries
2257 forwarding database table of a port and accepts the following keys.
2258 Specify several [BridgeMDB] sections to configure several permanent
2259 multicast membership entries.
2260 MulticastGroupAddress=
2262 Specifies the IPv4 or IPv6 multicast group address to add. This
2263 setting is mandatory.
2264 VLANId=
2266 The VLAN ID for the new entry. Valid ranges are 0 (no VLAN) to
2267 4094. Optional, defaults to 0.
2268
2270 The [LLDP] section manages the Link Layer Discovery Protocol (LLDP) and
2271 accepts the following keys:
2272 MUDURL=
2274 When configured, the specified Manufacturer Usage Descriptions
2275 (MUD) URL will be sent in LLDP packets. The syntax and semantics
2276 are the same as for MUDURL= in the [DHCPv4] section described
2277 above.
2278 The MUD URLs received via LLDP packets are saved and can be read
2280 using the sd_lldp_neighbor_get_mud_url() function.
2281
2283 The [CAN] section manages the Controller Area Network (CAN bus) and
2284 accepts the following keys:
2285 BitRate=
2287 The bitrate of CAN device in bits per second. The usual SI prefixes
2288 (K, M) with the base of 1000 can be used here. Takes a number in
2289 the range 1...4294967295.
2290 SamplePoint=
2292 Optional sample point in percent with one decimal (e.g. "75%",
2293 "87.5%") or permille (e.g. "875‰"). This will be ignored when
2294 BitRate= is unspecified.
2295 TimeQuantaNSec=, PropagationSegment=, PhaseBufferSegment1=,
2297 PhaseBufferSegment2=, SyncJumpWidth=
2298 Specifies the time quanta, propagation segment, phase buffer
2299 segment 1 and 2, and the synchronization jump width, which allow
2300 one to define the CAN bit-timing in a hardware independent format
2301 as proposed by the Bosch CAN 2.0 Specification. TimeQuantaNSec=
2302 takes a timespan in nanoseconds. PropagationSegment=,
2303 PhaseBufferSegment1=, PhaseBufferSegment2=, and SyncJumpWidth= take
2304 number of time quantum specified in TimeQuantaNSec= and must be an
2305 unsigned integer in the range 0...4294967295. These settings except
2306 for SyncJumpWidth= will be ignored when BitRate= is specified.
2307 DataBitRate=, DataSamplePoint=
2309 The bitrate and sample point for the data phase, if CAN-FD is used.
2310 These settings are analogous to the BitRate= and SamplePoint= keys.
2311 DataTimeQuantaNSec=, DataPropagationSegment=, DataPhaseBufferSegment1=,
2313 DataPhaseBufferSegment2=, DataSyncJumpWidth=
2314 Specifies the time quanta, propagation segment, phase buffer
2315 segment 1 and 2, and the synchronization jump width for the data
2316 phase, if CAN-FD is used. These settings are analogous to the
2317 TimeQuantaNSec= or related settings.
2318 FDMode=
2320 Takes a boolean. When "yes", CAN-FD mode is enabled for the
2321 interface. Note, that a bitrate and optional sample point should
2322 also be set for the CAN-FD data phase using the DataBitRate= and
2323 DataSamplePoint= keys, or DataTimeQuanta= and related settings.
2324 FDNonISO=
2326 Takes a boolean. When "yes", non-ISO CAN-FD mode is enabled for the
2327 interface. When unset, the kernel's default will be used.
2328 RestartSec=
2330 Automatic restart delay time. If set to a non-zero value, a restart
2331 of the CAN controller will be triggered automatically in case of a
2332 bus-off condition after the specified delay time. Subsecond delays
2333 can be specified using decimals (e.g. "0.1s") or a "ms" or "us"
2334 postfix. Using "infinity" or "0" will turn the automatic restart
2335 off. By default automatic restart is disabled.
2336 Termination=
2338 Takes a boolean or a termination resistor value in ohm in the range
2339 0...65535. When "yes", the termination resistor is set to 120 ohm.
2340 When "no" or "0" is set, the termination resistor is disabled. When
2341 unset, the kernel's default will be used.
2342 TripleSampling=
2344 Takes a boolean. When "yes", three samples (instead of one) are
2345 used to determine the value of a received bit by majority rule.
2346 When unset, the kernel's default will be used.
2347 BusErrorReporting=
2349 Takes a boolean. When "yes", reporting of CAN bus errors is
2350 activated (those include single bit, frame format, and bit stuffing
2351 errors, unable to send dominant bit, unable to send recessive bit,
2352 bus overload, active error announcement, error occurred on
2353 transmission). When unset, the kernel's default will be used. Note:
2354 in case of a CAN bus with a single CAN device, sending a CAN frame
2355 may result in a huge number of CAN bus errors.
2356 ListenOnly=
2358 Takes a boolean. When "yes", listen-only mode is enabled. When the
2359 interface is in listen-only mode, the interface neither transmit
2360 CAN frames nor send ACK bit. Listen-only mode is important to debug
2361 CAN networks without interfering with the communication or
2362 acknowledge the CAN frame. When unset, the kernel's default will be
2363 used.
2364 Loopback=
2366 Takes a boolean. When "yes", loopback mode is enabled. When the
2367 loopback mode is enabled, the interface treats messages transmitted
2368 by itself as received messages. The loopback mode is important to
2369 debug CAN networks. When unset, the kernel's default will be used.
2370 OneShot=
2372 Takes a boolean. When "yes", one-shot mode is enabled. When unset,
2373 the kernel's default will be used.
2374 PresumeAck=
2376 Takes a boolean. When "yes", the interface will ignore missing CAN
2377 ACKs. When unset, the kernel's default will be used.
2378 ClassicDataLengthCode=
2380 Takes a boolean. When "yes", the interface will handle the 4bit
2381 data length code (DLC). When unset, the kernel's default will be
2382 used.
2383
2385 The [IPoIB] section manages the IP over Infiniband and accepts the
2386 following keys:
2387 Mode=
2389 Takes one of the special values "datagram" or "connected". Defaults
2390 to unset, and the kernel's default is used.
2391 When "datagram", the Infiniband unreliable datagram (UD) transport
2393 is used, and so the interface MTU is equal to the IB L2 MTU minus
2394 the IPoIB encapsulation header (4 bytes). For example, in a typical
2395 IB fabric with a 2K MTU, the IPoIB MTU will be 2048 - 4 = 2044
2396 bytes.
2397 When "connected", the Infiniband reliable connected (RC) transport
2399 is used. Connected mode takes advantage of the connected nature of
2400 the IB transport and allows an MTU up to the maximal IP packet size
2401 of 64K, which reduces the number of IP packets needed for handling
2402 large UDP datagrams, TCP segments, etc and increases the
2403 performance for large messages.
2404 IgnoreUserspaceMulticastGroup=
2406 Takes an boolean value. When true, the kernel ignores multicast
2407 groups handled by userspace. Defaults to unset, and the kernel's
2408 default is used.
2409
2411 The [QDisc] section manages the traffic control queueing discipline
2412 (qdisc).
2413 Parent=
2415 Specifies the parent Queueing Discipline (qdisc). Takes one of
2416 "clsact" or "ingress". This is mandatory.
2417 Handle=
2419 Configures the major number of unique identifier of the qdisc,
2420 known as the handle. Takes a hexadecimal number in the range
2421 0x1–0xffff. Defaults to unset.
2422
2424 The [NetworkEmulator] section manages the queueing discipline (qdisc)
2425 of the network emulator. It can be used to configure the kernel packet
2426 scheduler and simulate packet delay and loss for UDP or TCP
2427 applications, or limit the bandwidth usage of a particular service to
2428 simulate internet connections.
2429 Parent=
2431 Configures the parent Queueing Discipline (qdisc). Takes one of
2432 "root", "clsact", "ingress" or a class identifier. The class
2433 identifier is specified as the major and minor numbers in
2434 hexadecimal in the range 0x1–Oxffff separated with a colon
2435 ("major:minor"). Defaults to "root".
2436 Handle=
2438 Configures the major number of unique identifier of the qdisc,
2439 known as the handle. Takes a hexadecimal number in the range
2440 0x1–0xffff. Defaults to unset.
2441 DelaySec=
2443 Specifies the fixed amount of delay to be added to all packets
2444 going out of the interface. Defaults to unset.
2445 DelayJitterSec=
2447 Specifies the chosen delay to be added to the packets outgoing to
2448 the network interface. Defaults to unset.
2449 PacketLimit=
2451 Specifies the maximum number of packets the qdisc may hold queued
2452 at a time. An unsigned integer in the range 0...4294967294.
2453 Defaults to 1000.
2454 LossRate=
2456 Specifies an independent loss probability to be added to the
2457 packets outgoing from the network interface. Takes a percentage
2458 value, suffixed with "%". Defaults to unset.
2459 DuplicateRate=
2461 Specifies that the chosen percent of packets is duplicated before
2462 queuing them. Takes a percentage value, suffixed with "%". Defaults
2463 to unset.
2464
2466 The [TokenBucketFilter] section manages the queueing discipline (qdisc)
2467 of token bucket filter (tbf).
2468 Parent=
2470 Configures the parent Queueing Discipline (qdisc). Takes one of
2471 "root", "clsact", "ingress" or a class identifier. The class
2472 identifier is specified as the major and minor numbers in
2473 hexadecimal in the range 0x1–Oxffff separated with a colon
2474 ("major:minor"). Defaults to "root".
2475 Handle=
2477 Configures the major number of unique identifier of the qdisc,
2478 known as the handle. Takes a hexadecimal number in the range
2479 0x1–0xffff. Defaults to unset.
2480 LatencySec=
2482 Specifies the latency parameter, which specifies the maximum amount
2483 of time a packet can sit in the Token Bucket Filter (TBF). Defaults
2484 to unset.
2485 LimitBytes=
2487 Takes the number of bytes that can be queued waiting for tokens to
2488 become available. When the size is suffixed with K, M, or G, it is
2489 parsed as Kilobytes, Megabytes, or Gigabytes, respectively, to the
2490 base of 1024. Defaults to unset.
2491 BurstBytes=
2493 Specifies the size of the bucket. This is the maximum amount of
2494 bytes that tokens can be available for instantaneous transfer. When
2495 the size is suffixed with K, M, or G, it is parsed as Kilobytes,
2496 Megabytes, or Gigabytes, respectively, to the base of 1024.
2497 Defaults to unset.
2498 Rate=
2500 Specifies the device specific bandwidth. When suffixed with K, M,
2501 or G, the specified bandwidth is parsed as Kilobits, Megabits, or
2502 Gigabits, respectively, to the base of 1000. Defaults to unset.
2503 MPUBytes=
2505 The Minimum Packet Unit (MPU) determines the minimal token usage
2506 (specified in bytes) for a packet. When suffixed with K, M, or G,
2507 the specified size is parsed as Kilobytes, Megabytes, or Gigabytes,
2508 respectively, to the base of 1024. Defaults to zero.
2509 PeakRate=
2511 Takes the maximum depletion rate of the bucket. When suffixed with
2512 K, M, or G, the specified size is parsed as Kilobits, Megabits, or
2513 Gigabits, respectively, to the base of 1000. Defaults to unset.
2514 MTUBytes=
2516 Specifies the size of the peakrate bucket. When suffixed with K, M,
2517 or G, the specified size is parsed as Kilobytes, Megabytes, or
2518 Gigabytes, respectively, to the base of 1024. Defaults to unset.
2519
2521 The [PIE] section manages the queueing discipline (qdisc) of
2522 Proportional Integral controller-Enhanced (PIE).
2523 Parent=
2525 Configures the parent Queueing Discipline (qdisc). Takes one of
2526 "root", "clsact", "ingress" or a class identifier. The class
2527 identifier is specified as the major and minor numbers in
2528 hexadecimal in the range 0x1–Oxffff separated with a colon
2529 ("major:minor"). Defaults to "root".
2530 Handle=
2532 Configures the major number of unique identifier of the qdisc,
2533 known as the handle. Takes a hexadecimal number in the range
2534 0x1–0xffff. Defaults to unset.
2535 PacketLimit=
2537 Specifies the hard limit on the queue size in number of packets.
2538 When this limit is reached, incoming packets are dropped. An
2539 unsigned integer in the range 1...4294967294. Defaults to unset and
2540 kernel's default is used.
2541
2543 The "[FlowQueuePIE]" section manages the queueing discipline (qdisc) of
2544 Flow Queue Proportional Integral controller-Enhanced (fq_pie).
2545 Parent=
2547 Configures the parent Queueing Discipline (qdisc). Takes one of
2548 "root", "clsact", "ingress" or a class identifier. The class
2549 identifier is specified as the major and minor numbers in
2550 hexadecimal in the range 0x1–Oxffff separated with a colon
2551 ("major:minor"). Defaults to "root".
2552 Handle=
2554 Configures the major number of unique identifier of the qdisc,
2555 known as the handle. Takes a hexadecimal number in the range
2556 0x1–0xffff. Defaults to unset.
2557 PacketLimit=
2559 Specifies the hard limit on the queue size in number of packets.
2560 When this limit is reached, incoming packets are dropped. An
2561 unsigned integer ranges 1 to 4294967294. Defaults to unset and
2562 kernel's default is used.
2563
2565 The [StochasticFairBlue] section manages the queueing discipline
2566 (qdisc) of stochastic fair blue (sfb).
2567 Parent=
2569 Configures the parent Queueing Discipline (qdisc). Takes one of
2570 "root", "clsact", "ingress" or a class identifier. The class
2571 identifier is specified as the major and minor numbers in
2572 hexadecimal in the range 0x1–Oxffff separated with a colon
2573 ("major:minor"). Defaults to "root".
2574 Handle=
2576 Configures the major number of unique identifier of the qdisc,
2577 known as the handle. Takes a hexadecimal number in the range
2578 0x1–0xffff. Defaults to unset.
2579 PacketLimit=
2581 Specifies the hard limit on the queue size in number of packets.
2582 When this limit is reached, incoming packets are dropped. An
2583 unsigned integer in the range 0...4294967294. Defaults to unset and
2584 kernel's default is used.
2585
2587 The [StochasticFairnessQueueing] section manages the queueing
2588 discipline (qdisc) of stochastic fairness queueing (sfq).
2589 Parent=
2591 Configures the parent Queueing Discipline (qdisc). Takes one of
2592 "root", "clsact", "ingress" or a class identifier. The class
2593 identifier is specified as the major and minor numbers in
2594 hexadecimal in the range 0x1–Oxffff separated with a colon
2595 ("major:minor"). Defaults to "root".
2596 Handle=
2598 Configures the major number of unique identifier of the qdisc,
2599 known as the handle. Takes a hexadecimal number in the range
2600 0x1–0xffff. Defaults to unset.
2601 PerturbPeriodSec=
2603 Specifies the interval in seconds for queue algorithm perturbation.
2604 Defaults to unset.
2605
2607 The [BFIFO] section manages the queueing discipline (qdisc) of Byte
2608 limited Packet First In First Out (bfifo).
2609 Parent=
2611 Configures the parent Queueing Discipline (qdisc). Takes one of
2612 "root", "clsact", "ingress" or a class identifier. The class
2613 identifier is specified as the major and minor numbers in
2614 hexadecimal in the range 0x1–Oxffff separated with a colon
2615 ("major:minor"). Defaults to "root".
2616 Handle=
2618 Configures the major number of unique identifier of the qdisc,
2619 known as the handle. Takes a hexadecimal number in the range
2620 0x1–0xffff. Defaults to unset.
2621 LimitBytes=
2623 Specifies the hard limit in bytes on the FIFO buffer size. The size
2624 limit prevents overflow in case the kernel is unable to dequeue
2625 packets as quickly as it receives them. When this limit is reached,
2626 incoming packets are dropped. When suffixed with K, M, or G, the
2627 specified size is parsed as Kilobytes, Megabytes, or Gigabytes,
2628 respectively, to the base of 1024. Defaults to unset and kernel
2629 default is used.
2630
2632 The [PFIFO] section manages the queueing discipline (qdisc) of Packet
2633 First In First Out (pfifo).
2634 Parent=
2636 Configures the parent Queueing Discipline (qdisc). Takes one of
2637 "root", "clsact", "ingress" or a class identifier. The class
2638 identifier is specified as the major and minor numbers in
2639 hexadecimal in the range 0x1–Oxffff separated with a colon
2640 ("major:minor"). Defaults to "root".
2641 Handle=
2643 Configures the major number of unique identifier of the qdisc,
2644 known as the handle. Takes a hexadecimal number in the range
2645 0x1–0xffff. Defaults to unset.
2646 PacketLimit=
2648 Specifies the hard limit on the number of packets in the FIFO
2649 queue. The size limit prevents overflow in case the kernel is
2650 unable to dequeue packets as quickly as it receives them. When this
2651 limit is reached, incoming packets are dropped. An unsigned integer
2652 in the range 0...4294967294. Defaults to unset and kernel's default
2653 is used.
2654
2656 The [PFIFOHeadDrop] section manages the queueing discipline (qdisc) of
2657 Packet First In First Out Head Drop (pfifo_head_drop).
2658 Parent=
2660 Configures the parent Queueing Discipline (qdisc). Takes one of
2661 "root", "clsact", "ingress" or a class identifier. The class
2662 identifier is specified as the major and minor numbers in
2663 hexadecimal in the range 0x1–Oxffff separated with a colon
2664 ("major:minor"). Defaults to "root".
2665 Handle=
2667 Configures the major number of unique identifier of the qdisc,
2668 known as the handle. Takes a hexadecimal number in the range
2669 0x1–0xffff. Defaults to unset.
2670 PacketLimit=
2672 As in [PFIFO] section.
2673
2675 The [PFIFOFast] section manages the queueing discipline (qdisc) of
2676 Packet First In First Out Fast (pfifo_fast).
2677 Parent=
2679 Configures the parent Queueing Discipline (qdisc). Takes one of
2680 "root", "clsact", "ingress" or a class identifier. The class
2681 identifier is specified as the major and minor numbers in
2682 hexadecimal in the range 0x1–Oxffff separated with a colon
2683 ("major:minor"). Defaults to "root".
2684 Handle=
2686 Configures the major number of unique identifier of the qdisc,
2687 known as the handle. Takes a hexadecimal number in the range
2688 0x1–0xffff. Defaults to unset.
2689
2691 The [CAKE] section manages the queueing discipline (qdisc) of Common
2692 Applications Kept Enhanced (CAKE).
2693 Parent=
2695 Configures the parent Queueing Discipline (qdisc). Takes one of
2696 "root", "clsact", "ingress" or a class identifier. The class
2697 identifier is specified as the major and minor numbers in
2698 hexadecimal in the range 0x1–Oxffff separated with a colon
2699 ("major:minor"). Defaults to "root".
2700 Handle=
2702 Configures the major number of unique identifier of the qdisc,
2703 known as the handle. Takes a hexadecimal number in the range
2704 0x1–0xffff. Defaults to unset.
2705 Bandwidth=
2707 Specifies the shaper bandwidth. When suffixed with K, M, or G, the
2708 specified size is parsed as Kilobits, Megabits, or Gigabits,
2709 respectively, to the base of 1000. Defaults to unset and kernel's
2710 default is used.
2711 AutoRateIngress=
2713 Takes a boolean value. Enables automatic capacity estimation based
2714 on traffic arriving at this qdisc. This is most likely to be useful
2715 with cellular links, which tend to change quality randomly. If this
2716 setting is enabled, the Bandwidth= setting is used as an initial
2717 estimate. Defaults to unset, and the kernel's default is used.
2718 OverheadBytes=
2720 Specifies that bytes to be addeded to the size of each packet.
2721 Bytes may be negative. Takes an integer in the range -64...256.
2722 Defaults to unset and kernel's default is used.
2723 MPUBytes=
2725 Rounds each packet (including overhead) up to the specified bytes.
2726 Takes an integer in the range 1...256. Defaults to unset and
2727 kernel's default is used.
2728 CompensationMode=
2730 Takes one of "none", "atm", or "ptm". Specifies the compensation
2731 mode for overhead calculation. When "none", no compensation is
2732 taken into account. When "atm", enables the compensation for ATM
2733 cell framing, which is normally found on ADSL links. When "ptm",
2734 enables the compensation for PTM encoding, which is normally found
2735 on VDSL2 links and uses a 64b/65b encoding scheme. Defaults to
2736 unset and the kernel's default is used.
2737 UseRawPacketSize=
2739 Takes a boolean value. When true, the packet size reported by the
2740 Linux kernel will be used, instead of the underlying IP packet
2741 size. Defaults to unset, and the kernel's default is used.
2742 FlowIsolationMode=
2744 CAKE places packets from different flows into different queues,
2745 then packets from each queue are delivered fairly. This specifies
2746 whether the fairness is based on source address, destination
2747 address, individual flows, or any combination of those. The
2748 available values are:
2749 none
2751 The flow isolation is disabled, and all traffic passes through
2752 a single queue.
2753 src-host
2755 Flows are defined only by source address. Equivalent to the
2756 "srchost" option for tc qdisc command. See also tc-cake(8).
2757 dst-host
2759 Flows are defined only by destination address. Equivalent to
2760 the "dsthost" option for tc qdisc command. See also tc-cake(8).
2761 hosts
2763 Flows are defined by source-destination host pairs. Equivalent
2764 to the same option for tc qdisc command. See also tc-cake(8).
2765 flows
2767 Flows are defined by the entire 5-tuple of source address,
2768 destination address, transport protocol, source port and
2769 destination port. Equivalent to the same option for tc qdisc
2770 command. See also tc-cake(8).
2771 dual-src-host
2773 Flows are defined by the 5-tuple (see "flows" in the above),
2774 and fairness is applied first over source addresses, then over
2775 individual flows. Equivalent to the "dual-srchost" option for
2776 tc qdisc command. See also tc-cake(8).
2777 dual-dst-host
2779 Flows are defined by the 5-tuple (see "flows" in the above),
2780 and fairness is applied first over destination addresses, then
2781 over individual flows. Equivalent to the "dual-dsthost" option
2782 for tc qdisc command. See also tc-cake(8).
2783 triple
2785 Flows are defined by the 5-tuple (see "flows"), and fairness is
2786 applied over source and destination addresses, and also over
2787 individual flows. Equivalent to the "triple-isolate" option for
2788 tc qdisc command. See also tc-cake(8).
2789 Defaults to unset and the kernel's default is used.
2791 NAT=
2793 Takes a boolean value. When true, CAKE performs a NAT lookup before
2794 applying flow-isolation rules, to determine the true addresses and
2795 port numbers of the packet, to improve fairness between hosts
2796 inside the NAT. This has no practical effect when
2797 FlowIsolationMode= is "none" or "flows", or if NAT is performed on
2798 a different host. Defaults to unset, and the kernel's default is
2799 used.
2800 PriorityQueueingPreset=
2802 CAKE divides traffic into "tins", and each tin has its own
2803 independent set of flow-isolation queues, bandwidth threshold, and
2804 priority. This specifies the preset of tin profiles. The available
2805 values are:
2806 besteffort
2808 Disables priority queueing by placing all traffic in one tin.
2809 precedence
2811 Enables priority queueing based on the legacy interpretation of
2812 TOS "Precedence" field. Use of this preset on the modern
2813 Internet is firmly discouraged.
2814 diffserv8
2816 Enables priority queueing based on the Differentiated Service
2817 ("DiffServ") field with eight tins: Background Traffic, High
2818 Throughput, Best Effort, Video Streaming, Low Latency
2819 Transactions, Interactive Shell, Minimum Latency, and Network
2820 Control.
2821 diffserv4
2823 Enables priority queueing based on the Differentiated Service
2824 ("DiffServ") field with four tins: Background Traffic, Best
2825 Effort, Streaming Media, and Latency Sensitive.
2826 diffserv3
2828 Enables priority queueing based on the Differentiated Service
2829 ("DiffServ") field with three tins: Background Traffic, Best
2830 Effort, and Latency Sensitive.
2831 Defaults to unset, and the kernel's default is used.
2833 FirewallMark=
2835 Takes an integer in the range 1...4294967295. When specified,
2836 firewall-mark-based overriding of CAKE's tin selection is enabled.
2837 Defaults to unset, and the kernel's default is used.
2838 Wash=
2840 Takes a boolean value. When true, CAKE clears the DSCP fields,
2841 except for ECN bits, of any packet passing through CAKE. Defaults
2842 to unset, and the kernel's default is used.
2843 SplitGSO=
2845 Takes a boolean value. When true, CAKE will split General
2846 Segmentation Offload (GSO) super-packets into their on-the-wire
2847 components and dequeue them individually. Defaults to unset, and
2848 the kernel's default is used.
2849
2851 The [ControlledDelay] section manages the queueing discipline (qdisc)
2852 of controlled delay (CoDel).
2853 Parent=
2855 Configures the parent Queueing Discipline (qdisc). Takes one of
2856 "root", "clsact", "ingress" or a class identifier. The class
2857 identifier is specified as the major and minor numbers in
2858 hexadecimal in the range 0x1–Oxffff separated with a colon
2859 ("major:minor"). Defaults to "root".
2860 Handle=
2862 Configures the major number of unique identifier of the qdisc,
2863 known as the handle. Takes a hexadecimal number in the range
2864 0x1–0xffff. Defaults to unset.
2865 PacketLimit=
2867 Specifies the hard limit on the queue size in number of packets.
2868 When this limit is reached, incoming packets are dropped. An
2869 unsigned integer in the range 0...4294967294. Defaults to unset and
2870 kernel's default is used.
2871 TargetSec=
2873 Takes a timespan. Specifies the acceptable minimum
2874 standing/persistent queue delay. Defaults to unset and kernel's
2875 default is used.
2876 IntervalSec=
2878 Takes a timespan. This is used to ensure that the measured minimum
2879 delay does not become too stale. Defaults to unset and kernel's
2880 default is used.
2881 ECN=
2883 Takes a boolean. This can be used to mark packets instead of
2884 dropping them. Defaults to unset and kernel's default is used.
2885 CEThresholdSec=
2887 Takes a timespan. This sets a threshold above which all packets are
2888 marked with ECN Congestion Experienced (CE). Defaults to unset and
2889 kernel's default is used.
2890
2892 The [DeficitRoundRobinScheduler] section manages the queueing
2893 discipline (qdisc) of Deficit Round Robin Scheduler (DRR).
2894 Parent=
2896 Configures the parent Queueing Discipline (qdisc). Takes one of
2897 "root", "clsact", "ingress" or a class identifier. The class
2898 identifier is specified as the major and minor numbers in
2899 hexadecimal in the range 0x1–Oxffff separated with a colon
2900 ("major:minor"). Defaults to "root".
2901 Handle=
2903 Configures the major number of unique identifier of the qdisc,
2904 known as the handle. Takes a hexadecimal number in the range
2905 0x1–0xffff. Defaults to unset.
2906
2908 The [DeficitRoundRobinSchedulerClass] section manages the traffic
2909 control class of Deficit Round Robin Scheduler (DRR).
2910 Parent=
2912 Configures the parent Queueing Discipline (qdisc). Takes one of
2913 "root", or a qdisc identifier. The qdisc identifier is specified as
2914 the major and minor numbers in hexadecimal in the range 0x1–Oxffff
2915 separated with a colon ("major:minor"). Defaults to "root".
2916 ClassId=
2918 Configures the unique identifier of the class. It is specified as
2919 the major and minor numbers in hexadecimal in the range 0x1–Oxffff
2920 separated with a colon ("major:minor"). Defaults to unset.
2921 QuantumBytes=
2923 Specifies the amount of bytes a flow is allowed to dequeue before
2924 the scheduler moves to the next class. When suffixed with K, M, or
2925 G, the specified size is parsed as Kilobytes, Megabytes, or
2926 Gigabytes, respectively, to the base of 1024. Defaults to the MTU
2927 of the interface.
2928
2930 The [EnhancedTransmissionSelection] section manages the queueing
2931 discipline (qdisc) of Enhanced Transmission Selection (ETS).
2932 Parent=
2934 Configures the parent Queueing Discipline (qdisc). Takes one of
2935 "root", "clsact", "ingress" or a class identifier. The class
2936 identifier is specified as the major and minor numbers in
2937 hexadecimal in the range 0x1–Oxffff separated with a colon
2938 ("major:minor"). Defaults to "root".
2939 Handle=
2941 Configures the major number of unique identifier of the qdisc,
2942 known as the handle. Takes a hexadecimal number in the range
2943 0x1–0xffff. Defaults to unset.
2944 Bands=
2946 Specifies the number of bands. An unsigned integer in the range
2947 1...16. This value has to be at least large enough to cover the
2948 strict bands specified through the StrictBands= and
2949 bandwidth-sharing bands specified in QuantumBytes=.
2950 StrictBands=
2952 Specifies the number of bands that should be created in strict
2953 mode. An unsigned integer in the range 1...16.
2954 QuantumBytes=
2956 Specifies the white-space separated list of quantum used in
2957 band-sharing bands. When suffixed with K, M, or G, the specified
2958 size is parsed as Kilobytes, Megabytes, or Gigabytes, respectively,
2959 to the base of 1024. This setting can be specified multiple times.
2960 If an empty string is assigned, then the all previous assignments
2961 are cleared.
2962 PriorityMap=
2964 The priority map maps the priority of a packet to a band. The
2965 argument is a whitespace separated list of numbers. The first
2966 number indicates which band the packets with priority 0 should be
2967 put to, the second is for priority 1, and so on. There can be up to
2968 16 numbers in the list. If there are fewer, the default band that
2969 traffic with one of the unmentioned priorities goes to is the last
2970 one. Each band number must be in the range 0...255. This setting
2971 can be specified multiple times. If an empty string is assigned,
2972 then the all previous assignments are cleared.
2973
2975 The [GenericRandomEarlyDetection] section manages the queueing
2976 discipline (qdisc) of Generic Random Early Detection (GRED).
2977 Parent=
2979 Configures the parent Queueing Discipline (qdisc). Takes one of
2980 "root", "clsact", "ingress" or a class identifier. The class
2981 identifier is specified as the major and minor numbers in
2982 hexadecimal in the range 0x1–Oxffff separated with a colon
2983 ("major:minor"). Defaults to "root".
2984 Handle=
2986 Configures the major number of unique identifier of the qdisc,
2987 known as the handle. Takes a hexadecimal number in the range
2988 0x1–0xffff. Defaults to unset.
2989 VirtualQueues=
2991 Specifies the number of virtual queues. Takes an integer in the
2992 range 1...16. Defaults to unset and kernel's default is used.
2993 DefaultVirtualQueue=
2995 Specifies the number of default virtual queue. This must be less
2996 than VirtualQueue=. Defaults to unset and kernel's default is used.
2997 GenericRIO=
2999 Takes a boolean. It turns on the RIO-like buffering scheme.
3000 Defaults to unset and kernel's default is used.
3001
3003 The [FairQueueingControlledDelay] section manages the queueing
3004 discipline (qdisc) of fair queuing controlled delay (FQ-CoDel).
3005 Parent=
3007 Configures the parent Queueing Discipline (qdisc). Takes one of
3008 "root", "clsact", "ingress" or a class identifier. The class
3009 identifier is specified as the major and minor numbers in
3010 hexadecimal in the range 0x1–Oxffff separated with a colon
3011 ("major:minor"). Defaults to "root".
3012 Handle=
3014 Configures the major number of unique identifier of the qdisc,
3015 known as the handle. Takes a hexadecimal number in the range
3016 0x1–0xffff. Defaults to unset.
3017 PacketLimit=
3019 Specifies the hard limit on the real queue size. When this limit is
3020 reached, incoming packets are dropped. Defaults to unset and
3021 kernel's default is used.
3022 MemoryLimitBytes=
3024 Specifies the limit on the total number of bytes that can be queued
3025 in this FQ-CoDel instance. When suffixed with K, M, or G, the
3026 specified size is parsed as Kilobytes, Megabytes, or Gigabytes,
3027 respectively, to the base of 1024. Defaults to unset and kernel's
3028 default is used.
3029 Flows=
3031 Specifies the number of flows into which the incoming packets are
3032 classified. Defaults to unset and kernel's default is used.
3033 TargetSec=
3035 Takes a timespan. Specifies the acceptable minimum
3036 standing/persistent queue delay. Defaults to unset and kernel's
3037 default is used.
3038 IntervalSec=
3040 Takes a timespan. This is used to ensure that the measured minimum
3041 delay does not become too stale. Defaults to unset and kernel's
3042 default is used.
3043 QuantumBytes=
3045 Specifies the number of bytes used as the "deficit" in the fair
3046 queuing algorithm timespan. When suffixed with K, M, or G, the
3047 specified size is parsed as Kilobytes, Megabytes, or Gigabytes,
3048 respectively, to the base of 1024. Defaults to unset and kernel's
3049 default is used.
3050 ECN=
3052 Takes a boolean. This can be used to mark packets instead of
3053 dropping them. Defaults to unset and kernel's default is used.
3054 CEThresholdSec=
3056 Takes a timespan. This sets a threshold above which all packets are
3057 marked with ECN Congestion Experienced (CE). Defaults to unset and
3058 kernel's default is used.
3059
3061 The [FairQueueing] section manages the queueing discipline (qdisc) of
3062 fair queue traffic policing (FQ).
3063 Parent=
3065 Configures the parent Queueing Discipline (qdisc). Takes one of
3066 "root", "clsact", "ingress" or a class identifier. The class
3067 identifier is specified as the major and minor numbers in
3068 hexadecimal in the range 0x1–Oxffff separated with a colon
3069 ("major:minor"). Defaults to "root".
3070 Handle=
3072 Configures the major number of unique identifier of the qdisc,
3073 known as the handle. Takes a hexadecimal number in the range
3074 0x1–0xffff. Defaults to unset.
3075 PacketLimit=
3077 Specifies the hard limit on the real queue size. When this limit is
3078 reached, incoming packets are dropped. Defaults to unset and
3079 kernel's default is used.
3080 FlowLimit=
3082 Specifies the hard limit on the maximum number of packets queued
3083 per flow. Defaults to unset and kernel's default is used.
3084 QuantumBytes=
3086 Specifies the credit per dequeue RR round, i.e. the amount of bytes
3087 a flow is allowed to dequeue at once. When suffixed with K, M, or
3088 G, the specified size is parsed as Kilobytes, Megabytes, or
3089 Gigabytes, respectively, to the base of 1024. Defaults to unset and
3090 kernel's default is used.
3091 InitialQuantumBytes=
3093 Specifies the initial sending rate credit, i.e. the amount of bytes
3094 a new flow is allowed to dequeue initially. When suffixed with K,
3095 M, or G, the specified size is parsed as Kilobytes, Megabytes, or
3096 Gigabytes, respectively, to the base of 1024. Defaults to unset and
3097 kernel's default is used.
3098 MaximumRate=
3100 Specifies the maximum sending rate of a flow. When suffixed with K,
3101 M, or G, the specified size is parsed as Kilobits, Megabits, or
3102 Gigabits, respectively, to the base of 1000. Defaults to unset and
3103 kernel's default is used.
3104 Buckets=
3106 Specifies the size of the hash table used for flow lookups.
3107 Defaults to unset and kernel's default is used.
3108 OrphanMask=
3110 Takes an unsigned integer. For packets not owned by a socket, fq is
3111 able to mask a part of hash and reduce number of buckets associated
3112 with the traffic. Defaults to unset and kernel's default is used.
3113 Pacing=
3115 Takes a boolean, and enables or disables flow pacing. Defaults to
3116 unset and kernel's default is used.
3117 CEThresholdSec=
3119 Takes a timespan. This sets a threshold above which all packets are
3120 marked with ECN Congestion Experienced (CE). Defaults to unset and
3121 kernel's default is used.
3122
3124 The [TrivialLinkEqualizer] section manages the queueing discipline
3125 (qdisc) of trivial link equalizer (teql).
3126 Parent=
3128 Configures the parent Queueing Discipline (qdisc). Takes one of
3129 "root", "clsact", "ingress" or a class identifier. The class
3130 identifier is specified as the major and minor numbers in
3131 hexadecimal in the range 0x1–Oxffff separated with a colon
3132 ("major:minor"). Defaults to "root".
3133 Handle=
3135 Configures the major number of unique identifier of the qdisc,
3136 known as the handle. Takes a hexadecimal number in the range
3137 0x1–0xffff. Defaults to unset.
3138 Id=
3140 Specifies the interface ID "N" of teql. Defaults to "0". Note that
3141 when teql is used, currently, the module sch_teql with
3142 max_equalizers=N+1 option must be loaded before systemd-networkd is
3143 started.
3144
3146 The [HierarchyTokenBucket] section manages the queueing discipline
3147 (qdisc) of hierarchy token bucket (htb).
3148 Parent=
3150 Configures the parent Queueing Discipline (qdisc). Takes one of
3151 "root", "clsact", "ingress" or a class identifier. The class
3152 identifier is specified as the major and minor numbers in
3153 hexadecimal in the range 0x1–Oxffff separated with a colon
3154 ("major:minor"). Defaults to "root".
3155 Handle=
3157 Configures the major number of unique identifier of the qdisc,
3158 known as the handle. Takes a hexadecimal number in the range
3159 0x1–0xffff. Defaults to unset.
3160 DefaultClass=
3162 Takes the minor id in hexadecimal of the default class.
3163 Unclassified traffic gets sent to the class. Defaults to unset.
3164 RateToQuantum=
3166 Takes an unsigned integer. The DRR quantums are calculated by
3167 dividing the value configured in Rate= by RateToQuantum=.
3168
3170 The [HierarchyTokenBucketClass] section manages the traffic control
3171 class of hierarchy token bucket (htb).
3172 Parent=
3174 Configures the parent Queueing Discipline (qdisc). Takes one of
3175 "root", or a qdisc identifier. The qdisc identifier is specified as
3176 the major and minor numbers in hexadecimal in the range 0x1–Oxffff
3177 separated with a colon ("major:minor"). Defaults to "root".
3178 ClassId=
3180 Configures the unique identifier of the class. It is specified as
3181 the major and minor numbers in hexadecimal in the range 0x1–Oxffff
3182 separated with a colon ("major:minor"). Defaults to unset.
3183 Priority=
3185 Specifies the priority of the class. In the round-robin process,
3186 classes with the lowest priority field are tried for packets first.
3187 QuantumBytes=
3189 Specifies how many bytes to serve from leaf at once. When suffixed
3190 with K, M, or G, the specified size is parsed as Kilobytes,
3191 Megabytes, or Gigabytes, respectively, to the base of 1024.
3192 MTUBytes=
3194 Specifies the maximum packet size we create. When suffixed with K,
3195 M, or G, the specified size is parsed as Kilobytes, Megabytes, or
3196 Gigabytes, respectively, to the base of 1024.
3197 OverheadBytes=
3199 Takes an unsigned integer which specifies per-packet size overhead
3200 used in rate computations. When suffixed with K, M, or G, the
3201 specified size is parsed as Kilobytes, Megabytes, or Gigabytes,
3202 respectively, to the base of 1024.
3203 Rate=
3205 Specifies the maximum rate this class and all its children are
3206 guaranteed. When suffixed with K, M, or G, the specified size is
3207 parsed as Kilobits, Megabits, or Gigabits, respectively, to the
3208 base of 1000. This setting is mandatory.
3209 CeilRate=
3211 Specifies the maximum rate at which a class can send, if its parent
3212 has bandwidth to spare. When suffixed with K, M, or G, the
3213 specified size is parsed as Kilobits, Megabits, or Gigabits,
3214 respectively, to the base of 1000. When unset, the value specified
3215 with Rate= is used.
3216 BufferBytes=
3218 Specifies the maximum bytes burst which can be accumulated during
3219 idle period. When suffixed with K, M, or G, the specified size is
3220 parsed as Kilobytes, Megabytes, or Gigabytes, respectively, to the
3221 base of 1024.
3222 CeilBufferBytes=
3224 Specifies the maximum bytes burst for ceil which can be accumulated
3225 during idle period. When suffixed with K, M, or G, the specified
3226 size is parsed as Kilobytes, Megabytes, or Gigabytes, respectively,
3227 to the base of 1024.
3228
3230 The [HeavyHitterFilter] section manages the queueing discipline (qdisc)
3231 of Heavy Hitter Filter (hhf).
3232 Parent=
3234 Configures the parent Queueing Discipline (qdisc). Takes one of
3235 "root", "clsact", "ingress" or a class identifier. The class
3236 identifier is specified as the major and minor numbers in
3237 hexadecimal in the range 0x1–Oxffff separated with a colon
3238 ("major:minor"). Defaults to "root".
3239 Handle=
3241 Configures the major number of unique identifier of the qdisc,
3242 known as the handle. Takes a hexadecimal number in the range
3243 0x1–0xffff. Defaults to unset.
3244 PacketLimit=
3246 Specifies the hard limit on the queue size in number of packets.
3247 When this limit is reached, incoming packets are dropped. An
3248 unsigned integer in the range 0...4294967294. Defaults to unset and
3249 kernel's default is used.
3250
3252 The [QuickFairQueueing] section manages the queueing discipline (qdisc)
3253 of Quick Fair Queueing (QFQ).
3254 Parent=
3256 Configures the parent Queueing Discipline (qdisc). Takes one of
3257 "root", "clsact", "ingress" or a class identifier. The class
3258 identifier is specified as the major and minor numbers in
3259 hexadecimal in the range 0x1–Oxffff separated with a colon
3260 ("major:minor"). Defaults to "root".
3261 Handle=
3263 Configures the major number of unique identifier of the qdisc,
3264 known as the handle. Takes a hexadecimal number in the range
3265 0x1–0xffff. Defaults to unset.
3266
3268 The [QuickFairQueueingClass] section manages the traffic control class
3269 of Quick Fair Queueing (qfq).
3270 Parent=
3272 Configures the parent Queueing Discipline (qdisc). Takes one of
3273 "root", or a qdisc identifier. The qdisc identifier is specified as
3274 the major and minor numbers in hexadecimal in the range 0x1–Oxffff
3275 separated with a colon ("major:minor"). Defaults to "root".
3276 ClassId=
3278 Configures the unique identifier of the class. It is specified as
3279 the major and minor numbers in hexadecimal in the range 0x1–Oxffff
3280 separated with a colon ("major:minor"). Defaults to unset.
3281 Weight=
3283 Specifies the weight of the class. Takes an integer in the range
3284 1...1023. Defaults to unset in which case the kernel default is
3285 used.
3286 MaxPacketBytes=
3288 Specifies the maximum packet size in bytes for the class. When
3289 suffixed with K, M, or G, the specified size is parsed as
3290 Kilobytes, Megabytes, or Gigabytes, respectively, to the base of
3291 1024. When unset, the kernel default is used.
3292
3294 The [BridgeVLAN] section manages the VLAN ID configuration of a bridge
3295 port and accepts the following keys. Specify several [BridgeVLAN]
3296 sections to configure several VLAN entries. The VLANFiltering= option
3297 has to be enabled, see the [Bridge] section in systemd.netdev(5).
3298 VLAN=
3300 The VLAN ID allowed on the port. This can be either a single ID or
3301 a range M-N. Takes an integer in the range 1...4094.
3302 EgressUntagged=
3304 The VLAN ID specified here will be used to untag frames on egress.
3305 Configuring EgressUntagged= implicates the use of VLAN= above and
3306 will enable the VLAN ID for ingress as well. This can be either a
3307 single ID or a range M-N.
3308 PVID=
3310 The Port VLAN ID specified here is assigned to all untagged frames
3311 at ingress. PVID= can be used only once. Configuring PVID=
3312 implicates the use of VLAN= above and will enable the VLAN ID for
3313 ingress as well.
3314
3316 Example 1. Static network configuration
3317 # /etc/systemd/network/50-static.network
3319 [Match]
3320 Name=enp2s0
3321 [Network]
3323 Address=192.168.0.15/24
3324 Gateway=192.168.0.1
3325 This brings interface "enp2s0" up with a static address. The specified
3327 gateway will be used for a default route.
3328 Example 2. DHCP on ethernet links
3330 # /etc/systemd/network/80-dhcp.network
3332 [Match]
3333 Name=en*
3334 [Network]
3336 DHCP=yes
3337 This will enable DHCPv4 and DHCPv6 on all interfaces with names
3339 starting with "en" (i.e. ethernet interfaces).
3340 Example 3. IPv6 Prefix Delegation (DHCPv6 PD)
3342 # /etc/systemd/network/55-dhcpv6-pd-upstream.network
3344 [Match]
3345 Name=enp1s0
3346 [Network]
3348 DHCP=ipv6
3349 # The below setting is optional, to also assign an address in the delegated prefix
3351 # to the upstream interface. If not necessary, then comment out the line below and
3352 # the [DHCPPrefixDelegation] section.
3353 DHCPPrefixDelegation=yes
3354 # If the upstream network provides Router Advertisement with Managed bit set,
3356 # then comment out the line below and WithoutRA= setting in the [DHCPv6] section.
3357 IPv6AcceptRA=no
3358 [DHCPv6]
3360 WithoutRA=solicit
3361 [DHCPPrefixDelegation]
3363 UplinkInterface=:self
3364 SubnetId=0
3365 Announce=no
3366 # /etc/systemd/network/55-dhcpv6-pd-downstream.network
3368 [Match]
3369 Name=enp2s0
3370 [Network]
3372 DHCPPrefixDelegation=yes
3373 IPv6SendRA=yes
3374 # It is expected that the host is acting as a router. So, usually it is not
3376 # necessary to receive Router Advertisement from other hosts in the downstream network.
3377 IPv6AcceptRA=no
3378 [DHCPPrefixDelegation]
3380 UplinkInterface=enp1s0
3381 SubnetId=1
3382 Announce=yes
3383 This will enable DHCPv6-PD on the interface enp1s0 as an upstream
3385 interface where the DHCPv6 client is running and enp2s0 as a downstream
3386 interface where the prefix is delegated to. The delegated prefixes are
3387 distributed by IPv6 Router Advertisement on the downstream network.
3388 Example 4. IPv6 Prefix Delegation (DHCPv4 6RD)
3390 # /etc/systemd/network/55-dhcpv4-6rd-upstream.network
3392 [Match]
3393 Name=enp1s0
3394 [Network]
3396 DHCP=ipv4
3397 # When DHCPv4-6RD is used, the upstream network does not support IPv6.
3399 # Hence, it is not necessary to wait for Router Advertisement, which is enabled by default.
3400 IPv6AcceptRA=no
3401 [DHCPv4]
3403 Use6RD=yes
3404 # /etc/systemd/network/55-dhcpv4-6rd-downstream.network
3406 [Match]
3407 Name=enp2s0
3408 [Network]
3410 DHCPPrefixDelegation=yes
3411 IPv6SendRA=yes
3412 # It is expected that the host is acting as a router. So, usually it is not
3414 # necessary to receive Router Advertisement from other hosts in the downstream network.
3415 IPv6AcceptRA=no
3416 [DHCPPrefixDelegation]
3418 UplinkInterface=enp1s0
3419 SubnetId=1
3420 Announce=yes
3421 This will enable DHCPv4-6RD on the interface enp1s0 as an upstream
3423 interface where the DHCPv4 client is running and enp2s0 as a downstream
3424 interface where the prefix is delegated to. The delegated prefixes are
3425 distributed by IPv6 Router Advertisement on the downstream network.
3426 Example 5. A bridge with two enslaved links
3428 # /etc/systemd/network/25-bridge-static.netdev
3430 [NetDev]
3431 Name=bridge0
3432 Kind=bridge
3433 # /etc/systemd/network/25-bridge-static.network
3435 [Match]
3436 Name=bridge0
3437 [Network]
3439 Address=192.168.0.15/24
3440 Gateway=192.168.0.1
3441 DNS=192.168.0.1
3442 # /etc/systemd/network/25-bridge-slave-interface-1.network
3444 [Match]
3445 Name=enp2s0
3446 [Network]
3448 Bridge=bridge0
3449 # /etc/systemd/network/25-bridge-slave-interface-2.network
3451 [Match]
3452 Name=wlp3s0
3453 [Network]
3455 Bridge=bridge0
3456 This creates a bridge and attaches devices "enp2s0" and "wlp3s0" to it.
3458 The bridge will have the specified static address and network assigned,
3459 and a default route via the specified gateway will be added. The
3460 specified DNS server will be added to the global list of DNS resolvers.
3461 Example 6. Bridge port with VLAN forwarding
3463 # /etc/systemd/network/25-bridge-slave-interface-1.network
3465 [Match]
3466 Name=enp2s0
3467 [Network]
3469 Bridge=bridge0
3470 [BridgeVLAN]
3472 VLAN=1-32
3473 PVID=42
3474 EgressUntagged=42
3475 [BridgeVLAN]
3477 VLAN=100-200
3478 [BridgeVLAN]
3480 EgressUntagged=300-400
3481 This overrides the configuration specified in the previous example for
3483 the interface "enp2s0", and enables VLAN on that bridge port. VLAN IDs
3484 1-32, 42, 100-400 will be allowed. Packets tagged with VLAN IDs 42,
3485 300-400 will be untagged when they leave on this interface. Untagged
3486 packets which arrive on this interface will be assigned VLAN ID 42.
3487 Example 7. Various tunnels
3489 /etc/systemd/network/25-tunnels.network
3491 [Match]
3492 Name=ens1
3493 [Network]
3495 Tunnel=ipip-tun
3496 Tunnel=sit-tun
3497 Tunnel=gre-tun
3498 Tunnel=vti-tun
3499 /etc/systemd/network/25-tunnel-ipip.netdev
3502 [NetDev]
3503 Name=ipip-tun
3504 Kind=ipip
3505 /etc/systemd/network/25-tunnel-sit.netdev
3508 [NetDev]
3509 Name=sit-tun
3510 Kind=sit
3511 /etc/systemd/network/25-tunnel-gre.netdev
3514 [NetDev]
3515 Name=gre-tun
3516 Kind=gre
3517 /etc/systemd/network/25-tunnel-vti.netdev
3520 [NetDev]
3521 Name=vti-tun
3522 Kind=vti
3523 This will bring interface "ens1" up and create an IPIP tunnel, a SIT
3526 tunnel, a GRE tunnel, and a VTI tunnel using it.
3527 Example 8. A bond device
3529 # /etc/systemd/network/30-bond1.network
3531 [Match]
3532 Name=bond1
3533 [Network]
3535 DHCP=ipv6
3536 # /etc/systemd/network/30-bond1.netdev
3538 [NetDev]
3539 Name=bond1
3540 Kind=bond
3541 # /etc/systemd/network/30-bond1-dev1.network
3543 [Match]
3544 MACAddress=52:54:00:e9:64:41
3545 [Network]
3547 Bond=bond1
3548 # /etc/systemd/network/30-bond1-dev2.network
3550 [Match]
3551 MACAddress=52:54:00:e9:64:42
3552 [Network]
3554 Bond=bond1
3555 This will create a bond device "bond1" and enslave the two devices with
3557 MAC addresses 52:54:00:e9:64:41 and 52:54:00:e9:64:42 to it. IPv6 DHCP
3558 will be used to acquire an address.
3559 Example 9. Virtual Routing and Forwarding (VRF)
3561 Add the "bond1" interface to the VRF master interface "vrf1". This will
3563 redirect routes generated on this interface to be within the routing
3564 table defined during VRF creation. For kernels before 4.8 traffic won't
3565 be redirected towards the VRFs routing table unless specific ip-rules
3566 are added.
3567 # /etc/systemd/network/25-vrf.network
3569 [Match]
3570 Name=bond1
3571 [Network]
3573 VRF=vrf1
3574 Example 10. MacVTap
3576 This brings up a network interface "macvtap-test" and attaches it to
3578 "enp0s25".
3579 # /usr/lib/systemd/network/25-macvtap.network
3581 [Match]
3582 Name=enp0s25
3583 [Network]
3585 MACVTAP=macvtap-test
3586 Example 11. A Xfrm interface with physical underlying device.
3588 # /etc/systemd/network/27-xfrm.netdev
3590 [NetDev]
3591 Name=xfrm0
3592 Kind=xfrm
3593 [Xfrm]
3595 InterfaceId=7
3596 # /etc/systemd/network/27-eth0.network
3598 [Match]
3599 Name=eth0
3600 [Network]
3602 Xfrm=xfrm0
3603 This creates a "xfrm0" interface and binds it to the "eth0" device.
3605 This allows hardware based ipsec offloading to the "eth0" nic. If
3606 offloading is not needed, xfrm interfaces can be assigned to the "lo"
3607 device.
3608
3610 systemd(1), systemd-networkd.service(8), systemd.link(5),
3611 systemd.netdev(5), systemd-network-generator.service(8), systemd-
3612 resolved.service(8)
3613
3615 1. Link-Local Multicast Name Resolution
3616 https://tools.ietf.org/html/rfc4795
3617 2. Multicast DNS
3619 https://tools.ietf.org/html/rfc6762
3620 3. DNS-over-TLS
3622 https://tools.ietf.org/html/rfc7858
3623 4. DNSSEC
3625 https://tools.ietf.org/html/rfc4033
3626 5. IEEE 802.1AB-2016
3628 https://standards.ieee.org/findstds/standard/802.1AB-2016.html
3629 6. ip-sysctl.txt
3631 https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt
3632 7. RFC 4941
3634 https://tools.ietf.org/html/rfc4941
3635 8. RFC 1027
3637 https://tools.ietf.org/html/rfc1027
3638 9. RFC 6275
3640 https://tools.ietf.org/html/rfc6275
3641 10. RFC 5227
3643 https://tools.ietf.org/html/rfc5227
3644 11. RFC 4862
3646 https://tools.ietf.org/html/rfc4862
3647 12. RFC 3041
3649 https://tools.ietf.org/html/rfc3041
3650 13. RFC 3484
3652 https://tools.ietf.org/html/rfc3484
3653 14. RFC 4191
3655 https://tools.ietf.org/html/rfc4191
3656 15. RFC 8520
3658 https://tools.ietf.org/html/rfc8520
3659 16. RFC 7844
3661 https://tools.ietf.org/html/rfc7844
3662 17. C-style escapes
3664 https://en.wikipedia.org/wiki/Escape_sequences_in_C#Table_of_escape_sequences
3665 18. RFC 5969
3667 https://tools.ietf.org/html/rfc5969
3668 19. RFC 8415
3670 https://www.rfc-editor.org/rfc/rfc8415.html#section-6.3
3671 20. RFC 4291
3673 https://tools.ietf.org/html/rfc4291#section-2.5.4
3674 21. RFC 7217
3676 https://tools.ietf.org/html/rfc7217
3677 22. RFC 2131
3679 https://www.rfc-editor.org/rfc/rfc2131.html
3680 23. RFC 2132
3682 https://www.rfc-editor.org/rfc/rfc2132.html
3683 24. RFC 1542
3685 https://tools.ietf.org/html/rfc1542
3686 25. RFC 4861
3688 https://tools.ietf.org/html/rfc4861
3689systemd 251 SYSTEMD.NETWORK(5)