ipv6: drop fragmented ndisc packets by default (RFC 6980)

[karo-tx-linux.git] / Documentation / networking / ip-sysctl.txt

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index debfe857d8f9c8694f2483c9e41826973d24dac0..a2be556032c9e6b5f4009709cdc8563df6a699a3 100644 (file)
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1349,6 +1349,12 @@ mldv2_unsolicited_report_interval - INTEGER
        MLDv2 report retransmit will take place.
        Default: 1000 (1 second)
 
+suppress_frag_ndisc - INTEGER
+       Control RFC 6980 (Security Implications of IPv6 Fragmentation
+       with IPv6 Neighbor Discovery) behavior:
+       1 - (default) discard fragmented neighbor discovery packets
+       0 - allow fragmented neighbor discovery packets
+
 icmp/*:
 ratelimit - INTEGER
        Limit the maximal rates for sending ICMPv6 packets.