Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

On my Ubuntu machine, in /etc/sysctl.conf file, I've got reverse path filtering options commented out by default like this:

#net.ipv4.conf.default.rp_filter=1
#net.ipv4.conf.all.rp_filter=1

but in /etc/sysctl.d/10-network-security.conf they are (again, by default) not commented out:

net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.all.rp_filter=1

So is reverse path filtering enabled or not? Which of the configuration locations takes priority? How do I check the current values of these and other kernel options?

share|improve this question
add comment

2 Answers 2

up vote 3 down vote accepted

Checking the value of a sysctl variable is as easy as

sysctl <variable name>

and, by the way, setting a sysctl variable is as straightforward as

sudo sysctl -w <variable name>=<value>

but changes made this way will probably hold only till the next reboot.

As to which of the config locations, /etc/sysctl.conf or /etc/sysctl.d/, takes precedence, here is what /etc/sysctl.d/README file says:

End-users can use 60-*.conf and above, or use /etc/sysctl.conf directly, which overrides anything in this directory.

After editing the config in any of the two locations, the changes can be applied with

sudo sysctl -p
share|improve this answer
    
Is this not sysctl -e for edit and sysctl -f for executing the config? –  Nils Dec 8 '12 at 21:01
    
@Nils linux.die.net/man/8/sysctl –  Desmond Hume Dec 8 '12 at 21:34
    
Right - strangely both options work. –  Nils Dec 11 '12 at 22:15
add comment

This kind of stuff is usually in the /proc and/or /sys kernel interfaces (first, keep in mind nothing in those directories is a regular disk file, they are all direct lines to the kernel).

So, eg:

»for x in /proc/sys/net/ipv4/conf/*/rp_filter; do echo -ne "$x "`cat $x`"\n"; done
/proc/sys/net/ipv4/conf/all/rp_filter 0
/proc/sys/net/ipv4/conf/default/rp_filter 1
/proc/sys/net/ipv4/conf/em1/rp_filter 1
/proc/sys/net/ipv4/conf/lo/rp_filter 0
/proc/sys/net/ipv4/conf/wlan0/rp_filter 1

Looks like I have rp_filter set for em1, wlan0, and "default". You can set or unset them by just writing to the file handle:

»cd /proc/sys/net/ipv4/conf/lo
»echo 1 > rp_filter
»cat rp_filter
1
»echo 0 > rp_filter
»cat rp_filter
0

As mentioned, this is direct communication with the kernel, so that takes effect immediately. These are not configuration files. If you try and do something wrong:

»echo whatever > rp_filter
bash: echo: write error: Invalid argument

Which is not to say you can't screw things up this way, of course. And be sure to read the comments below.

share|improve this answer
    
I'd rather stick to configuration files because this way I can keep dozens of lines of my preferred configuration in a plain text file and reuse (some of) them when needed. Writing a script for this purpose feels like an unnecessary complication. But thanks for the info on a method to check current values. –  Desmond Hume Dec 7 '12 at 15:40
    
Definitely using config files is much better. I was not suggesting you write a script, just illustrating that those are not "read only" values and can be used to make manual tweaks. ;) –  goldilocks Dec 7 '12 at 15:48
1  
That shell script is a rather interesting way to re-write sysctl -a ... –  derobert Dec 7 '12 at 16:21
    
True, but (depending on the nature of your file browser) perusing proc/sys might be considered more convenient, which is one reason it is worth knowing about. Another is that WRT to getting information programmatically, that interface is more efficient than piped "system(sysctl)" type stuff, and works regardless of language, available libs, etc. –  goldilocks Dec 9 '12 at 13:24
    
Not quite. There are already some cases where a write with echo may fail, while using sysctl -w works. You might also encounter systems, where /proc is not mounted. –  Nils Dec 11 '12 at 22:17
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.