This is on the Linux OS.

I see that on some machines the net.bridge.bridge-nf-call-iptables variable doesn't exist until I modprobe the br_netfilter filter. I also see that there are some machines where the bridge module is loaded and that itself brings in this variable.

Is there a way to know which module I should load in order to get a particular variable ?

  • Why the -1 ? Any ways to improve question quality ? Mar 6, 2017 at 7:03

1 Answer 1


There's no automatic database relating sysctl variables to modules. You can search the module binary and hope that the variable name isn't found in other strings (this one isn't). Search for the last part, i.e. bridge-nf-call-iptables — the full string isn't present in the binary, it's constructed dynamically.

grep -rl bridge-nf-call-iptables /lib/modules/`uname -r`

Alternatively, you can check the documentation — but it doesn't always tell you, and in this case it doesn't say. So you're left with the source code. First look for the string (again, only the last part); in recent kernels it's in net/bridge/br_netfilter_hooks.c. Now check the makefile in the same directory to see how this source file is built. The relevant line is

br_netfilter-y := br_netfilter_hooks.o

which means that if the br_netfilter module is built then it contains the code from br_netfilter_hooks.c, thus the br_netfilter module is the one you need.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .