Versions Compared


  • This line was added.
  • This line was removed.
  • Formatting was changed.


Note that getdns 1.0 .9 supports TFO on Linux and OS X.


  • The server must simply set the TCP_FASTOPEN flag using setsockopt() on the listening socket (note . On linux/FreeBSD the qlen value passed in to the function limits the number of outstanding TFO requests as a simple defense against IP spoofing attacks (see RFC7413).
    • Note on OS X the socket MUST be listening already for this flag to be set, and the qlen MUST be 1
    • (the actual value is set via the net.inet.tcp.fastopen_backlog kernel parameter.
    • On linux this call can be done after bind() is called.

Kernel Parameters


  •  The kernel parameter net.ipv4.tcp_fastopen controls TFO and since 4.1 has been set to 1 by default. This enables client mode but not server mode. To act in pure server mode set the integer value to 2. To enable both client and server mode, set it to 3, for example:

    Code Block
    sysctl -w net.ipv4.tcp_fastopen=2


  • The current Linux client implementation (4.4 at the time of writing) does not currently support receiving data in the SYN-ACK (although it should to be compliant with the spec).  But a patch for this has been submitted. This can cause interop problems because the server must re-transmit the data. OS X does support this (no FreeBSD client implemented yet).
  • The back-off algorithms also appear different. For example, the OS X implementation will fallback to normal TCP for a long period of time if it detects problems during cookie or TFO data exchange.
  • Prior to 4.1 Linux used the experimental option code (254) and format for TFO, in 4.1 the default is to use the official option code (34) and format but fallback to the experimental code is still supported.