xref: /netbsd-src/lib/libc/gen/sysctl.3 (revision 89c5a767f8fc7a4633b2d409966e2becbb98ff92)
1.\"	$NetBSD: sysctl.3,v 1.52 2000/02/27 06:13:35 itojun Exp $
2.\"
3.\" Copyright (c) 1993
4.\"	The Regents of the University of California.  All rights reserved.
5.\"
6.\" Redistribution and use in source and binary forms, with or without
7.\" modification, are permitted provided that the following conditions
8.\" are met:
9.\" 1. Redistributions of source code must retain the above copyright
10.\"    notice, this list of conditions and the following disclaimer.
11.\" 2. Redistributions in binary form must reproduce the above copyright
12.\"    notice, this list of conditions and the following disclaimer in the
13.\"    documentation and/or other materials provided with the distribution.
14.\" 3. All advertising materials mentioning features or use of this software
15.\"    must display the following acknowledgement:
16.\"	This product includes software developed by the University of
17.\"	California, Berkeley and its contributors.
18.\" 4. Neither the name of the University nor the names of its contributors
19.\"    may be used to endorse or promote products derived from this software
20.\"    without specific prior written permission.
21.\"
22.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32.\" SUCH DAMAGE.
33.\"
34.\"	@(#)sysctl.3	8.4 (Berkeley) 5/9/95
35.\"
36.Dd June 24, 1999
37.Dt SYSCTL 3
38.Os
39.Sh NAME
40.Nm sysctl
41.Nd get or set system information
42.Sh LIBRARY
43.Lb libc
44.Sh SYNOPSIS
45.Fd #include <sys/param.h>
46.Fd #include <sys/sysctl.h>
47.Ft int
48.Fn sysctl "int *name" "u_int namelen" "void *oldp" "size_t *oldlenp" "void *newp" "size_t newlen"
49.Sh DESCRIPTION
50The
51.Nm
52function retrieves system information and allows processes with
53appropriate privileges to set system information.
54The information available from
55.Nm
56consists of integers, strings, and tables.
57Information may be retrieved and set from the command interface
58using the
59.Xr sysctl 8
60utility.
61.Pp
62Unless explicitly noted below,
63.Nm
64returns a consistent snapshot of the data requested.
65Consistency is obtained by locking the destination
66buffer into memory so that the data may be copied out without blocking.
67Calls to
68.Nm
69are serialized to avoid deadlock.
70.Pp
71The state is described using a ``Management Information Base'' (MIB)
72style name, listed in
73.Fa name ,
74which is a
75.Fa namelen
76length array of integers.
77.Pp
78The information is copied into the buffer specified by
79.Fa oldp .
80The size of the buffer is given by the location specified by
81.Fa oldlenp
82before the call,
83and that location gives the amount of data copied after a successful call.
84If the amount of data available is greater
85than the size of the buffer supplied,
86the call supplies as much data as fits in the buffer provided
87and returns with the error code ENOMEM.
88If the old value is not desired,
89.Fa oldp
90and
91.Fa oldlenp
92should be set to NULL.
93.Pp
94The size of the available data can be determined by calling
95.Nm
96with a NULL parameter for
97.Fa oldp .
98The size of the available data will be returned in the location pointed to by
99.Fa oldlenp .
100For some operations, the amount of space may change often.
101For these operations,
102the system attempts to round up so that the returned size is
103large enough for a call to return the data shortly thereafter.
104.Pp
105To set a new value,
106.Fa newp
107is set to point to a buffer of length
108.Fa newlen
109from which the requested value is to be taken.
110If a new value is not to be set,
111.Fa newp
112should be set to NULL and
113.Fa newlen
114set to 0.
115.Pp
116The top level names are defined with a CTL_ prefix in
117.Pa <sys/sysctl.h> ,
118and are as follows.
119The next and subsequent levels down are found in the include files
120listed here, and described in separate sections below.
121.Pp
122.Bl -column CTLXMACHDEPXXX "Next level namesXXXXXX" -offset indent
123.It Sy Pa Name	Next level names	Description
124.It CTL\_DEBUG	sys/sysctl.h	Debugging
125.It CTL\_VFS	sys/mount.h	Filesystem
126.It CTL\_HW	sys/sysctl.h	Generic CPU, I/O
127.It CTL\_KERN	sys/sysctl.h	High kernel limits
128.It CTL\_MACHDEP	sys/sysctl.h	Machine dependent
129.It CTL\_NET	sys/socket.h	Networking
130.It CTL\_PROC	sys/sysctl.h	Per-process
131.It CTL\_USER	sys/sysctl.h	User-level
132.It CTL\_VM	vm/vm_param.h	Virtual memory
133.El
134.Pp
135For example, the following retrieves the maximum number of processes allowed
136in the system:
137.Bd -literal -offset indent -compact
138int mib[2], maxproc;
139size_t len;
140.sp
141mib[0] = CTL_KERN;
142mib[1] = KERN_MAXPROC;
143len = sizeof(maxproc);
144sysctl(mib, 2, &maxproc, &len, NULL, 0);
145.Ed
146.sp
147To retrieve the standard search path for the system utilities:
148.Bd -literal -offset indent -compact
149int mib[2];
150size_t len;
151char *p;
152.sp
153mib[0] = CTL_USER;
154mib[1] = USER_CS_PATH;
155sysctl(mib, 2, NULL, &len, NULL, 0);
156p = malloc(len);
157sysctl(mib, 2, p, &len, NULL, 0);
158.Ed
159.Sh CTL_DEBUG
160The debugging variables vary from system to system.
161A debugging variable may be added or deleted without need to recompile
162.Nm
163to know about it.
164Each time it runs,
165.Nm
166gets the list of debugging variables from the kernel and
167displays their current values.
168The system defines twenty
169.Ns ( Va struct ctldebug )
170variables named
171.Dv debug0
172through
173.Dv debug19 .
174They are declared as separate variables so that they can be
175individually initialized at the location of their associated variable.
176The loader prevents multiple use of the same variable by issuing errors
177if a variable is initialized in more than one place.
178For example, to export the variable
179.Dv dospecialcheck
180as a debugging variable, the following declaration would be used:
181.Bd -literal -offset indent -compact
182int dospecialcheck = 1;
183struct ctldebug debug5 = { "dospecialcheck", &dospecialcheck };
184.Ed
185.Sh CTL_VFS
186A distinguished second level name, VFS_GENERIC,
187is used to get general information about all filesystems.
188One of its third level identifiers is VFS_MAXTYPENUM
189that gives the highest valid filesystem type number.
190Its other third level identifier is VFS_CONF that
191returns configuration information about the filesystem
192type given as a fourth level identifier (see
193.Xr getvfsbyname 3
194as an example of its use).
195The remaining second level identifiers are the
196filesystem type number returned by a
197.Xr statfs 2
198call or from VFS_CONF.
199The third level identifiers available for each filesystem
200are given in the header file that defines the mount
201argument structure for that filesystem.
202.Sh CTL_HW
203The string and integer information available for the CTL_HW level
204is detailed below.
205The changeable column shows whether a process with appropriate
206privilege may change the value.
207.Bl -column "Second level nameXXXXXX" integerXXX -offset indent
208.It Sy Pa Second level name	Type	Changeable
209.It HW\_MACHINE	string	no
210.It HW\_MODEL	string	no
211.It HW\_NCPU	integer	no
212.It HW\_BYTEORDER	integer	no
213.It HW\_PHYSMEM	integer	no
214.It HW\_USERMEM	integer	no
215.It HW\_PAGESIZE	integer	no
216.\".It HW\_DISKNAMES	struct	no
217.\".It HW\_DISKSTATS	struct	no
218.It HW\_MACHINE\_ARCH	string	no
219.It HW\_ALIGNBYTES	integer	no
220.El
221.Pp
222.Bl -tag -width "123456"
223.It Li HW_MACHINE
224The machine class.
225.It Li HW_MODEL
226The machine model
227.It Li HW_NCPU
228The number of cpus.
229.ne 1i
230.It Li HW_BYTEORDER
231The byteorder (4,321, or 1,234).
232.It Li HW_PHYSMEM
233The bytes of physical memory.
234.It Li HW_USERMEM
235The bytes of non-kernel memory.
236.It Li HW_PAGESIZE
237The software page size.
238.\".It Fa HW_DISKNAMES
239.\".It Fa HW_DISKSTATS
240.It Li HW_MACHINE_ARCH
241The machine cpu class.
242.It Li HW_ALIGNBYTES
243Alignment constraint for all possible data types.
244This shows the value
245.Dv ALIGNBYTES
246in
247.Pa /usr/include/machine/param.h ,
248at the kernel compilation time.
249.El
250.Sh CTL_KERN
251The string and integer information available for the CTL_KERN level
252is detailed below.
253The changeable column shows whether a process with appropriate
254privilege may change the value.
255The types of data currently available are process information,
256system vnodes, the open file entries, routing table entries,
257virtual memory statistics, load average history, and clock rate
258information.
259.Bl -column "KERNXCHOWNXRESTRICTEDXXX" "struct clockrateXXX" -offset indent
260.It Sy Pa Second level name	Type	Changeable
261.It KERN\_ARGMAX	integer	no
262.It KERN\_AUTONICETIME	integer	yes
263.It KERN\_AUTONICEVAL	integer	yes
264.It KERN\_BOOTTIME	struct timeval	no
265.It KERN\_CHOWN\_RESTRICTED	integer	no
266.It KERN\_CLOCKRATE	struct clockinfo	no
267.It KERN\_DEFCORENAME	string	yes
268.It KERN\_DOMAINNAME	string	yes
269.It KERN\_FILE	struct file	no
270.It KERN\_FSYNC	integer	no
271.It KERN\_HOSTID	integer	yes
272.It KERN\_HOSTNAME	string	yes
273.It KERN\_IOV\_MAX	integer	no
274.It KERN\_JOB\_CONTROL	integer	no
275.It KERN\_LINK\_MAX	integer	no
276.It KERN\_LOGIN\_NAME\_MAX	integer	no
277.It KERN\_LOGSIGEXIT	integer	yes
278.It KERN\_MAPPED\_FILES	integer	no
279.It KERN\_MAXFILES	integer	yes
280.It KERN\_MAXPARTITIONS	integer	no
281.It KERN\_MAXPROC	integer	yes
282.It KERN\_MAXVNODES	integer	yes
283.It KERN\_MAX\_CANON	integer	no
284.It KERN\_MAX\_INPUT	integer	no
285.It KERN\_MEMLOCK	integer	no
286.It KERN\_MEMLOCK\_RANGE	integer	no
287.It KERN\_MEMORY\_PROTECTION	integer	no
288.It KERN\_MSGBUFSIZE	integer	no
289.It KERN\_NAME\_MAX	integer	no
290.It KERN\_NGROUPS	integer	no
291.It KERN\_NO\_TRUNC	integer	no
292.It KERN\_OSRELEASE	string	no
293.It KERN\_OSREV	integer	no
294.It KERN\_OSTYPE	string	no
295.It KERN\_PATH\_MAX	integer	no
296.It KERN\_PIPE\_BUF	integer	no
297.It KERN\_POSIX1	integer	no
298.It KERN\_PROC	struct proc	no
299.It KERN\_PROF	node	not applicable
300.It KERN\_RAWPARTITION	integer	no
301.It KERN\_SAVED\_IDS	integer	no
302.It KERN\_SECURELVL	integer	raise only
303.It KERN\_SYNCHRONIZED\_IO	integer	no
304.It KERN\_SYSVMSG	integer	no
305.It KERN\_SYSVSEM	integer	no
306.It KERN\_SYSVSHM	integer	no
307.It KERN\_VDISABLE	integer	no
308.It KERN\_VERSION	string	no
309.It KERN\_VNODE	struct vnode	no
310.El
311.ne 1i
312.Pp
313.Bl -tag -width "123456"
314.It Li KERN_ARGMAX
315The maximum bytes of argument to
316.Xr execve 2 .
317.It Li KERN_AUTONICETIME
318The number of seconds of cpu-time a non-root process may accumulate before
319having its priority lowered from the default to the value of KERN_AUTONICEVAL.
320If set to 0, automatic lowering of priority is not performed, and if set to -1
321all non-root processes are immediately lowered.
322.It Li KERN_AUTONICEVAL
323The priority assigned for automatically niced processes.
324.It Li KERN_BOOTTIME
325A
326.Va struct timeval
327structure is returned.
328This structure contains the time that the system was booted.
329.It Li KERN_CHOWN_RESTRICTED
330Return 1 if appropriate privileges are required for the
331.Xr chown 2
332system call, otherwise 0.
333.It Li KERN_CLOCKRATE
334A
335.Va struct clockinfo
336structure is returned.
337This structure contains the clock, statistics clock and profiling clock
338frequencies, the number of micro-seconds per hz tick, and the clock
339skew rate.
340.It Li KERN_DEFCORENAME
341Default template for the name of core dump files (see also PROC_PID_CORENAME
342in the per-process variables CTL_PROC, and
343.Xr core 5
344for format of this template).  The default value is
345.Nm %n.core
346and can be changed with the kernel configuration option
347.Cd options DEFCORENAME
348(see
349.Xr options 4
350).
351.It Li KERN_DOMAINNAME
352Get or set the YP domain name.
353.It Li KERN_FILE
354Return the entire file table.
355The returned data consists of a single
356.Va struct filehead
357followed by an array of
358.Va struct file ,
359whose size depends on the current number of such objects in the system.
360.It Li KERN_FSYNC
361Return 1 if the POSIX 1003.1b File Synchronization Option is available
362on this system,
363otherwise 0.
364.It Li KERN_HOSTID
365Get or set the host id.
366.It Li KERN_HOSTNAME
367Get or set the hostname.
368.It Li KERN_IOV_MAX
369Return the maximum number of
370.Va iovec
371structures that a process has available for use with
372.Xr preadv 2 ,
373.Xr pwritev 2 ,
374.Xr readv 2 ,
375.Xr recvmsg 2 ,
376.Xr sendmsg 2
377and
378.Xr writev 2 .
379.It Li KERN_JOB_CONTROL
380Return 1 if job control is available on this system, otherwise 0.
381.It Li KERN_LINK_MAX
382The maximum file link count.
383.It Li KERN_LOGIN_NAME_MAX
384The size of the storage required for a login name, in bytes,
385including the terminating NUL.
386.It Li KERN_LOGSIGEXIT
387If this flag is non-zero, the kernel will
388.Xr log 9
389all process exits due to signals which create a
390.Xr core 5
391file, and whether the coredump was created.
392.It Li KERN_MAPPED_FILES
393Returns 1 if the POSIX 1003.1b Memory Mapped Files Option is available
394on this system,
395otherwise 0.
396.It Li KERN_MAXFILES
397The maximum number of open files that may be open in the system.
398.It Li KERN_MAXPARTITIONS
399The maximum number of partitions allowed per disk.
400.It Li KERN_MAXPROC
401The maximum number of simultaneous processes the system will allow.
402.It Li KERN_MAXVNODES
403The maximum number of vnodes available on the system.
404.It Li KERN_MAX_CANON
405The maximum number of bytes in terminal canonical input line.
406.It Li KERN_MAX_INPUT
407The minimum maximum number of bytes for which space is available in
408a terminal input queue.
409.It Li KERN_MEMLOCK
410Returns 1 if the POSIX 1003.1b Process Memory Locking Option is available
411on this system,
412otherwise 0.
413.It Li KERN_MEMLOCK_RANGE
414Returns 1 if the POSIX 1003.1b Range Memory Locking Option is available
415on this system,
416otherwise 0.
417.It Li KERN_MEMORY_PROTECTION
418Returns 1 if the POSIX 1003.1b Memory Protection Option is available
419on this system,
420otherwise 0.
421.It Li KERN_MSGBUFSIZE
422The maximum number of characters that the kernel message buffer can hold.
423.It Li KERN_NAME_MAX
424The maximum number of bytes in a file name.
425.It Li KERN_NGROUPS
426The maximum number of supplemental groups.
427.It Li KERN_NO_TRUNC
428Return 1 if file names longer than KERN_NAME_MAX are truncated.
429.It Li KERN_OSRELEASE
430The system release string.
431.It Li KERN_OSREV
432The system revision string.
433.It Li KERN_OSTYPE
434The system type string.
435.It Li KERN_PATH_MAX
436The maximum number of bytes in a pathname.
437.It Li KERN_PIPE_BUF
438The maximum number of bytes which will be written atomically to a pipe.
439.It Li KERN_POSIX1
440The version of ISO/IEC 9945 (POSIX 1003.1) with which the system
441attempts to comply.
442.It Li KERN_PROC
443Return the entire process table, or a subset of it.
444An array of
445.Va struct kinfo_proc
446structures is returned,
447whose size depends on the current number of such objects in the system.
448The third and fourth level names are as follows:
449.Bl -column "Third level nameXXXXXX" "Fourth level is:XXXXXX" -offset indent
450.It Pa Third level name	Fourth level is:
451.It KERN\_PROC\_ALL	None
452.It KERN\_PROC\_PID	A process ID
453.It KERN\_PROC\_PGRP	A process group
454.It KERN\_PROC\_TTY	A tty device
455.It KERN\_PROC\_UID	A user ID
456.It KERN\_PROC\_RUID	A real user ID
457.El
458.It Li KERN_PROF
459Return profiling information about the kernel.
460If the kernel is not compiled for profiling,
461attempts to retrieve any of the KERN_PROF values will
462fail with EOPNOTSUPP.
463The third level names for the string and integer profiling information
464is detailed below.
465The changeable column shows whether a process with appropriate
466privilege may change the value.
467.Bl -column "GPROFXGMONPARAMXXX" "struct gmonparamXXX" -offset indent
468.It Sy Pa Third level name	Type	Changeable
469.It GPROF\_STATE	integer	yes
470.It GPROF\_COUNT	u_short[\|]	yes
471.It GPROF\_FROMS	u_short[\|]	yes
472.It GPROF\_TOS	struct tostruct	yes
473.It GPROF\_GMONPARAM	struct gmonparam	no
474.El
475.Pp
476The variables are as follows:
477.Bl -tag -width "123456"
478.It Li GPROF_STATE
479Returns GMON_PROF_ON or GMON_PROF_OFF to show that profiling
480is running or stopped.
481.It Li GPROF_COUNT
482Array of statistical program counter counts.
483.It Li GPROF_FROMS
484Array indexed by program counter of call-from points.
485.It Li GPROF_TOS
486Array of
487.Va struct tostruct
488describing destination of calls and their counts.
489.It Li GPROF_GMONPARAM
490Structure giving the sizes of the above arrays.
491.El
492.It Li KERN_RAWPARTITION
493The raw partition of a disk (a == 0).
494.It Li KERN_SAVED_IDS
495Returns 1 if saved set-group and saved set-user ID is available.
496.It Li KERN_SECURELVL
497The system security level.
498This level may be raised by processes with appropriate privilege.
499It may only be lowered by process 1.
500.It Li KERN_SYNCHRONIZED_IO
501Returns 1 if the POSIX 1003.1b Synchronized I/O Option is available
502on this system,
503otherwise 0.
504.It Li KERN_SYSVMSG
505Returns 1 if System V style message queue functionality is available
506on this system,
507otherwise 0.
508.It Li KERN_SYSVSEM
509Returns 1 if System V style semaphore functionality is available
510on this system,
511otherwise 0.
512.It Li KERN_SYSVSHM
513Returns 1 if System V style share memory functionality is available
514on this system,
515otherwise 0.
516.It Li KERN_VDISABLE
517Returns the terminal character disabling value.
518.It Li KERN_VERSION
519The system version string.
520.It Li KERN_VNODE
521Return the entire vnode table.
522Note, the vnode table is not necessarily a consistent snapshot of
523the system.
524The returned data consists of an array whose size depends on the
525current number of such objects in the system.
526Each element of the array contains the kernel address of a vnode
527.Va struct vnode *
528followed by the vnode itself
529.Va struct vnode .
530.El
531.Sh CTL_MACHDEP
532The set of variables defined is architecture dependent.
533Most architectures define at least the following variables.
534.Bl -column "CONSOLE_DEVICEXXX" "integerXXX" -offset indent
535.It Sy Pa Second level name	Type	Changeable
536.It Li CPU_CONSDEV	dev_t	no
537.El
538.Sh CTL_NET
539The string and integer information available for the CTL_NET level
540is detailed below.
541The changeable column shows whether a process with appropriate
542privilege may change the value.
543.Bl -column "Second level nameXXXXXX" "routing messagesXXX" -offset indent
544.It Sy Pa Second level name	Type	Changeable
545.It PF\_ROUTE	routing messages	no
546.It PF\_INET	IPv4 values	yes
547.It PF\_INET6	IPv6 values	yes
548.El
549.Pp
550.Bl -tag -width "123456"
551.It Li PF_ROUTE
552Return the entire routing table or a subset of it.
553The data is returned as a sequence of routing messages (see
554.Xr route 4
555for the header file, format and meaning).
556The length of each message is contained in the message header.
557.Pp
558The third level name is a protocol number, which is currently always 0.
559The fourth level name is an address family, which may be set to 0 to
560select all address families.
561The fifth and sixth level names are as follows:
562.Bl -column "Fifth level nameXXXXXX" "Sixth level is:XXX" -offset indent
563.It Pa Fifth level name	Sixth level is:
564.It NET\_RT\_FLAGS	rtflags
565.It NET\_RT\_DUMP	None
566.It NET\_RT\_IFLIST	None
567.El
568.It Li PF_INET
569Get or set various global information about the IPv4
570.Pq Internet Protocol version 4 .
571The third level name is the protocol.
572The fourth level name is the variable name.
573The currently defined protocols and names are:
574.Bl -column "Protocol name" "Variable nameXX" "integer" "yes" -offset indent
575.It Pa Protocol name	Variable name	Type	Changeable
576.It ip	forwarding	integer	yes
577.It ip	redirect	integer	yes
578.It ip	ttl	integer	yes
579.It ip	forwsrcrt	integer	yes
580.It ip	directed-broadcast	integer	yes
581.It ip	allowsrcrt	integer	yes
582.It ip	subnetsarelocal	integer	yes
583.It ip	mtudisc	integer	yes
584.It ip	anonportmin	integer	yes
585.It ip	anonportmax	integer	yes
586.It ip	mtudisctimeout	integer	yes
587.It ip	gifttl	integer	yes
588.It icmp	errratelimit	integer	yes
589.It icmp	maskrepl	integer	yes
590.It tcp	rfc1323	integer	yes
591.It tcp	sendspace	integer	yes
592.It tcp	recvspace	integer	yes
593.It tcp	mssdflt	integer	yes
594.It tcp	syn_cache_limit	integer	yes
595.It tcp	syn_bucket_limit	integer	yes
596.It tcp	syn_cache_interval	integer	yes
597.It tcp	init_win	integer	yes
598.It tcp	mss_ifmtu	integer	yes
599.It tcp	sack	integer	yes
600.It tcp	win_scale	integer	yes
601.It tcp	timestamps	integer	yes
602.It tcp	compat_42	integer	yes
603.It tcp	cwm	integer	yes
604.It tcp	cwm_burstsize	integer	yes
605.It tcp	ack_on_push	integer	yes
606.It tcp	keepidle	integer	yes
607.It tcp	keepintvl	integer	yes
608.It tcp keepcnt	integer	yes
609.It tcp	slowhz	integer	no
610.It tcp	newreno	integer	yes
611.It tcp	log_refused	integer	yes
612.It tcp rstratelimit	integer	yes
613.It udp	checksum	integer	yes
614.It udp	sendspace	integer	yes
615.It udp	recvspace	integer	yes
616.El
617.Pp
618The variables are as follows:
619.Bl -tag -width "123456"
620.It Li ip.forwarding
621Returns 1 when IP forwarding is enabled for the host,
622meaning that the host is acting as a router.
623.It Li ip.redirect
624Returns 1 when ICMP redirects may be sent by the host.
625This option is ignored unless the host is routing IP packets,
626and should normally be enabled on all systems.
627.It Li ip.ttl
628The maximum time-to-live (hop count) value for an IP packet sourced by
629the system.
630This value applies to normal transport protocols, not to ICMP.
631.It Li ip.forwsrcrt
632Returns 1 when forwarding of source-routed packets is enabled for
633the host.  This value may only be changed if the kernel security
634level is less than 1.
635.It Li ip.directed-broadcast
636Returns 1 if directed broadcast behavior is enabled for the host.
637.It Li ip.allowsrcrt
638Returns 1 if the host accepts source routed packets.
639.It Li ip.subnetsarelocal
640Returns 1 if subnets are to be considered local addresses.
641.It Li ip.mtudisc
642Returns 1 if Path MTU Discovery is enabled.
643.It Li ip.anonportmin
644The lowest port number to use for TCP and UDP ephemeral port allocation.
645This cannot be set to less that 1024 or greater than 65535.
646.It Li ip.anonportmax
647The highest port number to use for TCP and UDP ephemeral port allocation.
648This cannot be set to less that 1024 or greater than 65535, and must
649be greater than
650.Li ip.anonportmin .
651.It Li ip.mtudisctimeout
652Returns the number of seconds in which a route added by the Path MTU
653Discovery engine will time out.  When the route times out, the Path
654MTU Discovery engine will attempt to probe a larger path MTU.
655.It Li ip.gifttl
656The maximum time-to-live (hop count) value for an IPv4 packet generated by
657.Xr gif 4
658tunnel interface.
659.It Li icmp.errratelimit
660This variable specifies the minimum interval between ICMP error messages,
661in microseconds.
662.It Li icmp.maskrepl
663Returns 1 if ICMP network mask requests are to be answered.
664.It Li tcp.rfc1323
665Returns 1 if RFC1323 extensions to TCP are enabled.
666.It Li tcp.sendspace
667Returns the default TCP send buffer size.
668.It Li tcp.recvspace
669Returns the default TCP receive buffer size.
670.It Li tcp.mssdflt
671Returns the default maximum segment size both advertsized to the peer
672and to use when the peer does not advertize a maximum segment size to
673us during connection setup.  Do not change this value unless you really
674know what you are doing.
675.It Li tcp.syn_cache_limit
676Returns the maximum number of entries allowed in the TCP compressed state
677engine.
678.It Li tcp.syn_bucket_limit
679Returns the maximum number of entries allowed per hash bucket in the TCP
680compressed state engine.
681.It Li tcp.syn_cache_interval
682Returns the TCP compressed state engine's timer interval.
683.It Li tcp.init_win
684Returns a value indicating the TCP initial congestion window.  If this
685value is 0, an auto-tuning algorithm designed to use an initial window
686of approximately 4K bytes is in use.  Otherwise, this value indicates
687a fixed number of packets.
688.It Li tcp.mss_ifmtu
689Returns 1 if TCP calculates the outgoing maximum segment size based on
690the MTU of the appropriate interface.  Otherwise, it is calculated based on
691the greater of the MTU of the interface, and the largest (non-loopback)
692interface MTU on the system.
693.It Li tcp.sack
694Returns a value which determines the level of Selective Acknowledgement
695supported by TCP.  If 2, we will transmit and receive SACK options.
696If 1, we will transmit SACK options, but ignore any SACK options received.
697If 0, SACK is disabled.
698.It Li tcp.win_scale
699If rfc1323 is enabled, a value of 1 indicates RFC1323 window scale options,
700for increasing the TCP window size, are enabled.
701.It Li tcp.timestamps
702If rfc1323 is enabled, a value of 1 indicates RFC1323 time stamp options,
703used for measuring TCP round trip times, are enabled.
704.It Li tcp.compat_42
705Returns 1 if work-arounds for bugs in the 4.2BSD TCP implementation are
706enabled.  Use of this option is not recommended, although it may be
707required in order to communicate with extremely old TCP implementations.
708.It Li tcp.cwm
709Returns 1 if use of the Hughes/Touch/Heidemann Congestion Window Monitoring
710algorithm is enabled.  This algorithm prevents line-rate bursts of packets
711that could otherwise occur when data begins flowing on an idle TCP
712connection.  These line-rate bursts can contribute to network and router
713congestion.  This can be particularly useful on World Wide Web servers
714which support HTTP/1.1, which has lingering connections.
715.It Li tcp.cwm_burstsize
716Returns the Congestion Window Monitoring allowed burst size, in terms
717of packet count.
718.It Li tcp.ack_on_push
719Returns 1 if TCP is to immediately transmit an ACK upon reception of
720a packet with PUSH set.  This can avoid losing a round trip time in some
721rare situations, but has the caveat of potentially defeating TCP's delayed
722ACK algorithm.  Use of this option is generally not recommended, but
723the variable exists in case your configuration really needs it.
724.It Li tcp.keepidle
725Time a connection must be idle before keepalives are sent (if keepalives
726are enabled for the connection).  See also tcp.slowhz.
727.It Li tcp.keepintvl
728Time after a keepalive probe is sent until, in the absence of any response,
729another probe is sent.  See also tcp.slowhz.
730.It Li tcp.keepcnt
731Number of keepalive probes sent before declaring a connection dead.  If
732set to zero, there is no limit; keepalives will be sent until some kind of
733response is received from the peer.
734.It Li tcp.slowhz
735The units for tcp.keepidle and tcp.keepintvl; those variables are in ticks
736of a clock that ticks tcp.slowhz times per second.  (That is, their values
737must be divided by the tcp.slowhz value to get times in seconds.)
738.It Li tcp.newreno
739Returns 1 if the use of J. Hoe's NewReno congestion control algorithm is
740enabled.  This algorithm improves the start-up behavior of TCP connections.
741.It Li tcp.log_refused
742Returns 1 if refused TCP connections to the host will be logged.
743.It Li tcp.rstratelimit
744This variable specifies minimum interval, in microseconds, between RSTs
745sent in response to an incoming TCP packet with no corresponding listen
746or connected socket.
747.It Li udp.checksum
748Returns 1 when UDP checksums are being computed and checked.
749Disabling UDP checksums is strongly discouraged.
750.It Li udp.sendspace
751Returns the default UDP send buffer size.
752.It Li udp.recvspace
753Returns the default UDP receive buffer size.
754.El
755.Pp
756For variables net.*.ipsec, please refer to
757.Xr ipsec 4 .
758.It Li PF_INET6
759Get or set various global information about the IPv6
760.Pq Internet Protocol version 6 .
761The third level name is the protocol.
762The fourth level name is the variable name.
763The currently defined protocols and names are:
764.Bl -column "Protocol name" "Variable nameXX" "integer" "yes" -offset indent
765.It Pa Protocol name	Variable name	Type	Changeable
766.It ip6	forwarding	integer	yes
767.It ip6	redirect	integer	yes
768.It ip6	hlim	integer	yes
769.It ip6	maxfragpackets	integer	yes
770.It ip6	accept_rtadv	integer	yes
771.It ip6	keepfaith	integer	yes
772.It ip6	log_interval	integer	yes
773.It ip6	hdrnestlimit	integer	yes
774.It ip6	dad_count	integer	yes
775.It ip6	auto_flowlabel	integer	yes
776.It ip6	defmcasthlim	integer	yes
777.It ip6	gif_hlim	integer	yes
778.It ip6	kame_version	string	no
779.It ip6	use_deprecated	integer	yes
780.It ip6	rr_prune	integer	yes
781.It ip6	bindv6only	integer	yes
782.It icmp6	rediraccept	integer	yes
783.It icmp6	redirtimeout	integer	yes
784.It icmp6	errratelimit	integer	yes
785.It icmp6	nd6_prune	integer	yes
786.It icmp6	nd6_delay	integer	yes
787.It icmp6	nd6_umaxtries	integer	yes
788.It icmp6	nd6_mmaxtries	integer	yes
789.It icmp6	nd6_useloopback	integer	yes
790.It icmp6	nodeinfo	integer	yes
791.It tcp6	mssdflt	integer	yes
792.It tcp6	do_rfc1323	integer	yes
793.It tcp6	keepidle	integer	yes
794.It tcp6	keepinterval	integer	yes
795.It tcp6	keepcount	integer	yes
796.It tcp6	maxpersistidle	integer	yes
797.It tcp6	sendspace	integer	yes
798.It tcp6	recvspace	integer	yes
799.It tcp6	conntimeo	integer	yes
800.It tcp6	pmtu	integer	yes
801.It tcp6	pmtu_expire	integer	yes
802.It tcp6	pmtu_probe	integer	yes
803.It tcp6	43maxseg	integer	yes
804.It tcp6	syn_cache_limit	integer	yes
805.It tcp6	syn_bucket_limit	integer	yes
806.It tcp6	syn_cache_interval	integer	yes
807.It udp6	sendmax	integer	yes
808.It udp6	recvspace	integer	yes
809.El
810.Pp
811The variables are as follows:
812.Bl -tag -width "123456"
813.It Li ip6.forwarding
814Returns 1 when IPv6 forwarding is enabled for the node,
815meaning that the node is acting as a router.
816Returns 0 when IPv6 forwarding is disabled for the node,
817meaning that the node is acting as a host.
818IPv6 specification defines node behavior for
819.Dq router
820case and
821.Dq host
822case quite differently, and changing this variable during operation
823may cause serious trouble.
824It is recommended to configure the variable at bootstrap time,
825and bootstrap time only.
826.It Li ip6.redirect
827Returns 1 when ICMPv6 redirects may be sent by the node.
828This option is ignored unless the node is routing IP packets,
829and should normally be enabled on all systems.
830.It Li ip6.hlim
831The default hop limit value for an IPv6 unicast packet sourced by the node.
832This value applies to all the transport protocols on top of IPv6.
833There are APIs to override the value, as documented in
834.Xr ip6 4 .
835.It Li ip6.maxfragpackets
836The maximum number of fragmented packets the node will accept.
8370 means that the node will not accept any fragmented packets.
838-1 means that the node will accept as many fragmented packets as it receives.
839The flag is provided basically for avoiding possible DoS attacks.
840.It Li ip6.accept_rtadv
841If set to non-zero, the node will accept ICMPv6 router advertisement packets
842and autoconfigures address prefixes and default routers.
843The node must be a host
844.Pq not a router
845for the option to be meaningful.
846.It Li ip6.keepfaith
847If set to non-zero, it enables
848.Dq FAITH
849TCP relay IPv6-to-IPv4 translator code in the kernel.
850Refer
851.Xr faith 4
852and
853.Xr faithd 8
854for detail.
855.It Li ip6.log_interval
856The variable controls amount of logs generated by IPv6 packet
857forwarding engine, by seting interval between log output
858.Pq in seconds .
859.It Li ip6.hdrnestlimit
860The number of IPv6 extension headers permitted on incoming IPv6 packets.
861If set to 0, the node will accept as many extension headers as possible.
862.It Li ip6.dad_count
863The variable cofigures number of IPv6 DAD
864.Pq duplicated address detection
865probe packets.
866The packets will be generated when IPv6 interface addresses are configured.
867.It Li ip6.auto_flowlabel
868On connected transport protocol packets,
869fill IPv6 flowlabel field to help intermediate routers to identify packet flows.
870.It Li ip6.defmcasthlim
871The default hop limit value for an IPv6 multicast packet sourced by the node.
872This value applies to all the transport protocols on top of IPv6.
873There are APIs to override the value, as documented in
874.Xr ip6 4 .
875.It Li ip6.gif_hlim
876The maximum hop limit value for an IPv6 packet generated by
877.Xr gif 4
878tunnel interface.
879.It Li ip6.kame_version
880The string identifies the version of KAME IPv6 stack implemented in the kernel.
881.It Li ip6.use_deprecated
882The variable controls use of deprecated address, specified in RFC2462 5.5.4.
883.It Li ip6.rr_prune
884The variable specifies interval between IPv6 router renumbering prefix
885babysitting, in seconds.
886.It Li ip6.bindv6only
887The variable specifies initial value for
888.Dv IPV6_BINDV6ONLY
889socket option for
890.Dv AF_INET6
891socket.
892Please refer to
893.Xr ip6 4
894for detail.
895.It Li icmp6.rediraccept
896If set to non-zero, the host will accept ICMPv6 redirect packets.
897Note that IPv6 routers will never accept ICMPv6 redirect packets,
898and the variable is meaningful on IPv6 hosts
899.Pq non-router
900only.
901.It Li icmp6.redirtimeout
902The variable specifies lifetime of routing entries generated by incoming
903ICMPv6 redirect.
904.It Li icmp6.errratelimit
905The variable specifies minimum interval between ICMPv6 error messages,
906in microseconds.
907.It Li icmp6.nd6_prune
908The variable specifies interval between IPv6 neighbor cache babysitting,
909in seconds.
910.It Li icmp6.nd6_delay
911The variable specifies
912.Dv DELAY_FIRST_PROBE_TIME
913timing constant in IPv6 neighbor discovery specification
914.Pq RFC2461 ,
915in seconds.
916.It Li icmp6.nd6_umaxtries
917The variable specifies
918.Dv MAX_UNICAST_SOLICIT
919constant in IPv6 neighbor discovery specification
920.Pq RFC2461 .
921.It Li icmp6.nd6_mmaxtries
922The variable specifies
923.Dv MAX_MULTICAST_SOLICIT
924constant in IPv6 neighbor discovery specification
925.Pq RFC2461 .
926.It Li icmp6.nd6_useloopback
927If set to non-zero, kernel IPv6 stack will use loopback interface for
928local traffic.
929.It Li icmp6.nodeinfo
930The variable enables, or disables, kernel support for
931ICMPv6 node information query/reply.
932.El
933.Pp
934Variables net.*.tcp6 and net.*.udp6 are identical to
935net.*.tcp and net.*.udp.
936Please refer to
937.Li PF_INET
938section above.
939For variables net.*.ipsec6, please refer to
940.Xr ipsec 4 .
941.El
942.Sh CTL_PROC
943The string and integer information available for the CTL_PROC
944is detailed below.
945The changeable column shows whether a process with appropriate
946privilege may change the value.
947These values are per-process, and as such may change from one process
948to another. When a process is created, the default values are inherited from
949its parent. When a set-user-ID or set-group-ID binary is executed, the
950value of PROC_PID_CORENAME is reset to the system default value.
951The second level name is either the magic value PROC_CURPROC, which
952points to the current process, or the PID of the target process.
953.Bl -column "USER_COLL_WEIGHTS_MAXXXX" "integerXXX" "yes" -offset indent
954.It Sy Pa Third level name	Type	Changeable
955.It PROC\_PID\_CORENAME	string	yes
956.It PROC\_PID\_LIMIT	node	not applicable
957.El
958.Bl -tag -width "123456"
959.Pp
960.It Li PROC_PID_CORENAME
961The template used for the core dump file name (see
962.Xr core 5
963for details). The base name must either be
964.Nm core
965or end with the suffix ``.core'' (the super-user may set arbitrary names). By
966default it points to KERN_DEFCORENAME.
967.It Li PROC_PID_LIMIT
968Return resources limits, as defined for the
969.Xr getrlimit 2
970and
971.Xr setrlimit 2
972system calls.
973The fourth level name is one of:
974.Bl -tag -width PROC_PID_LIMIT_MEMLOCKAA
975.It Li PROC_PID_LIMIT_CPU
976The maximum amount of cpu time (in seconds) to be used by each process.
977.It Li PROC_PID_LIMIT_FSIZE
978The largest size (in bytes) file that may be created.
979.It Li PROC_PID_LIMIT_DATA
980The maximum size (in bytes) of the data segment for a process;
981this defines how far a program may extend its break with the
982.Xr sbrk 2
983system call.
984.It Li PROC_PID_LIMIT_STACK
985The maximum size (in bytes) of the stack segment for a process;
986this defines how far a program's stack segment may be extended.
987Stack extension is performed automatically by the system.
988.It Li PROC_PID_LIMIT_CORE
989The largest size (in bytes)
990.Pa core
991file that may be created.
992.It Li PROC_PID_LIMIT_RSS
993The maximum size (in bytes) to which a process's resident set size may
994grow.
995This imposes a limit on the amount of physical memory to be given to
996a process; if memory is tight, the system will prefer to take memory
997from processes that are exceeding their declared resident set size.
998.It Li PROC_PID_LIMIT_MEMLOCK
999The maximum size (in bytes) which a process may lock into memory
1000using the
1001.Xr mlock 2
1002function.
1003.It Li PROC_PID_LIMIT_NPROC
1004The maximum number of simultaneous processes for this user id.
1005.It Li PROC_PID_LIMIT_NOFILE
1006The maximum number of open files for this process.
1007.El
1008.Pp
1009The fifth level name is one of PROC_PID_LIMIT_TYPE_SOFT or
1010PROC_PID_LIMIT_TYPE_HARD, to select respectively the soft or hard limit.
1011Both are of type integer.
1012.El
1013.Pp
1014
1015.Sh CTL_USER
1016The string and integer information available for the CTL_USER level
1017is detailed below.
1018The changeable column shows whether a process with appropriate
1019privilege may change the value.
1020.Bl -column "USER_COLL_WEIGHTS_MAXXXX" "integerXXX" -offset indent
1021.It Sy Pa Second level name	Type	Changeable
1022.It USER\_BC\_BASE\_MAX	integer	no
1023.It USER\_BC\_DIM\_MAX	integer	no
1024.It USER\_BC\_SCALE\_MAX	integer	no
1025.It USER\_BC\_STRING\_MAX	integer	no
1026.It USER\_COLL\_WEIGHTS\_MAX	integer	no
1027.It USER\_CS\_PATH	string	no
1028.It USER\_EXPR\_NEST\_MAX	integer	no
1029.It USER\_LINE\_MAX	integer	no
1030.It USER\_POSIX2\_CHAR\_TERM	integer	no
1031.It USER\_POSIX2\_C\_BIND	integer	no
1032.It USER\_POSIX2\_C\_DEV	integer	no
1033.It USER\_POSIX2\_FORT\_DEV	integer	no
1034.It USER\_POSIX2\_FORT\_RUN	integer	no
1035.It USER\_POSIX2\_LOCALEDEF	integer	no
1036.It USER\_POSIX2\_SW\_DEV	integer	no
1037.It USER\_POSIX2\_UPE	integer	no
1038.It USER\_POSIX2\_VERSION	integer	no
1039.It USER\_RE\_DUP\_MAX	integer	no
1040.It USER\_STREAM\_MAX	integer	no
1041.It USER\_TZNAME\_MAX	integer	no
1042.El
1043.Bl -tag -width "123456"
1044.Pp
1045.It Li USER_BC_BASE_MAX
1046The maximum ibase/obase values in the
1047.Xr bc 1
1048utility.
1049.It Li USER_BC_DIM_MAX
1050The maximum array size in the
1051.Xr bc 1
1052utility.
1053.It Li USER_BC_SCALE_MAX
1054The maximum scale value in the
1055.Xr bc 1
1056utility.
1057.It Li USER_BC_STRING_MAX
1058The maximum string length in the
1059.Xr bc 1
1060utility.
1061.It Li USER_COLL_WEIGHTS_MAX
1062The maximum number of weights that can be assigned to any entry of
1063the LC_COLLATE order keyword in the locale definition file.
1064.It Li USER_CS_PATH
1065Return a value for the
1066.Ev PATH
1067environment variable that finds all the standard utilities.
1068.It Li USER_EXPR_NEST_MAX
1069The maximum number of expressions that can be nested within
1070parenthesis by the
1071.Xr expr 1
1072utility.
1073.It Li USER_LINE_MAX
1074The maximum length in bytes of a text-processing utility's input
1075line.
1076.It Li USER_POSIX2_CHAR_TERM
1077Return 1 if the system supports at least one terminal type capable of
1078all operations described in POSIX 1003.2, otherwise 0.
1079.It Li USER_POSIX2_C_BIND
1080Return 1 if the system's C-language development facilities support the
1081C-Language Bindings Option, otherwise 0.
1082.It Li USER_POSIX2_C_DEV
1083Return 1 if the system supports the C-Language Development Utilities Option,
1084otherwise 0.
1085.It Li USER_POSIX2_FORT_DEV
1086Return 1 if the system supports the FORTRAN Development Utilities Option,
1087otherwise 0.
1088.It Li USER_POSIX2_FORT_RUN
1089Return 1 if the system supports the FORTRAN Runtime Utilities Option,
1090otherwise 0.
1091.It Li USER_POSIX2_LOCALEDEF
1092Return 1 if the system supports the creation of locales, otherwise 0.
1093.It Li USER_POSIX2_SW_DEV
1094Return 1 if the system supports the Software Development Utilities Option,
1095otherwise 0.
1096.It Li USER_POSIX2_UPE
1097Return 1 if the system supports the User Portability Utilities Option,
1098otherwise 0.
1099.It Li USER_POSIX2_VERSION
1100The version of POSIX 1003.2 with which the system attempts to comply.
1101.It Li USER_RE_DUP_MAX
1102The maximum number of repeated occurrences of a regular expression
1103permitted when using interval notation.
1104.ne 1i
1105.It Li USER_STREAM_MAX
1106The minimum maximum number of streams that a process may have open
1107at any one time.
1108.It Li USER_TZNAME_MAX
1109The minimum maximum number of types supported for the name of a
1110timezone.
1111.El
1112.Sh CTL_VM
1113The string and integer information available for the CTL_VM level
1114is detailed below.
1115The changeable column shows whether a process with appropriate
1116privilege may change the value.
1117.Bl -column "Second level nameXXXXXX" "struct loadavgXXX" -offset indent
1118.It Sy Pa Second level name	Type	Changeable
1119.It VM\_LOADAVG	struct loadavg	no
1120.It VM\_METER	struct vmtotal	no
1121.El
1122.Pp
1123.Bl -tag -width "123456"
1124.It Li VM_LOADAVG
1125Return the load average history.
1126The returned data consists of a
1127.Va struct loadavg .
1128.It Li VM_METER
1129Return the system wide virtual memory statistics.
1130The returned data consists of a
1131.Va struct vmtotal .
1132.El
1133.Sh CTL_DDB
1134The integer information available for the CTL_DDB level is detailed below.
1135The changeable column shows whether a process with appropriate
1136privilege may change the value.
1137.Bl -column "DBCTL_TABSTOPSXXX" "integerXXX" -offset indent
1138.It Sy Pa Second level name	Type	Changeable
1139.It DBCTL\_RADIX	integer	yes
1140.It DBCTL\_MAXOFF	integer	yes
1141.It DBCTL\_LINES	integer	yes
1142.It DBCTL\_TABSTOPS	integer	yes
1143.It DBCTL\_ONPANIC	integer	yes
1144.It DBCTL\_FROMCONSOLE	integer	yes
1145.El
1146.Pp
1147.Bl -tag -width "123456"
1148.It Li DBCTL_RADIX
1149The input and output radix.
1150.It Li DBCTL_MAXOFF
1151The maximum symbol offset.
1152.It Li DBCTL_LINES
1153Number of display lines.
1154.It Li DBCTL_TABSTOPS
1155Tab width.
1156.It Li DBCTL_ONPANIC
1157If non-zero, DDB will be entered when the kernel panics.
1158.It Li DBCTL_FROMCONSOLE
1159If not zero, DDB may be entered by sending a break on a serial
1160console or by a special key sequence on a graphics console.
1161.El
1162.Pp
1163These MIB nodes are also available as variables from within the
1164DDB.  See
1165.Xr ddb 4
1166for more details.
1167.Sh RETURN VALUES
1168If the call to
1169.Nm
1170is successful, the number of bytes copied out is returned.
1171Otherwise \-1 is returned and
1172.Va errno
1173is set appropriately.
1174.Sh ERRORS
1175The following errors may be reported:
1176.Bl -tag -width Er
1177.It Bq Er EFAULT
1178The buffer
1179.Fa name ,
1180.Fa oldp ,
1181.Fa newp ,
1182or length pointer
1183.Fa oldlenp
1184contains an invalid address.
1185.It Bq Er EINVAL
1186The
1187.Fa name
1188array is less than two or greater than CTL_MAXNAME.
1189.It Bq Er EINVAL
1190A non-null
1191.Fa newp
1192is given and its specified length in
1193.Fa newlen
1194is too large or too small.
1195.It Bq Er ENOMEM
1196The length pointed to by
1197.Fa oldlenp
1198is too short to hold the requested value.
1199.It Bq Er ENOTDIR
1200The
1201.Fa name
1202array specifies an intermediate rather than terminal name.
1203.It Bq Er EOPNOTSUPP
1204The
1205.Fa name
1206array specifies a value that is unknown.
1207.It Bq Er EPERM
1208An attempt is made to set a read-only value.
1209.It Bq Er EPERM
1210A process without appropriate privilege attempts to set a value.
1211.It Bq Er EPERM
1212An attempt to change a value protected by the current kernel security
1213level is made.
1214.El
1215.Sh FILES
1216.Bl -tag -width <netinet/icmpXvar.h> -compact
1217.It Pa <sys/sysctl.h>
1218definitions for top level identifiers, second level kernel and hardware
1219identifiers, and user level identifiers
1220.It Pa <sys/socket.h>
1221definitions for second level network identifiers
1222.It Pa <sys/gmon.h>
1223definitions for third level profiling identifiers
1224.It Pa <vm/vm_param.h>
1225definitions for second level virtual memory identifiers
1226.It Pa <netinet/in.h>
1227definitions for third level IPv4/v6 identifiers and
1228fourth level IPv4/v6 identifiers
1229.It Pa <netinet/icmp_var.h>
1230definitions for fourth level ICMP identifiers
1231.It Pa <netinet/icmp6.h>
1232definitions for fourth level ICMPv6 identifiers
1233.It Pa <netinet/tcp_var.h>
1234definitions for fourth level TCP identifiers
1235.It Pa <netinet/udp_var.h>
1236definitions for fourth level UDP identifiers
1237.El
1238.Sh SEE ALSO
1239.Xr sysctl 8 ,
1240.Xr ipsec 4
1241.Sh HISTORY
1242The
1243.Nm
1244function first appeared in
1245.Bx 4.4 .
1246