InformationIP source routing is a mechanism that allows the sender to determine the IP route that a datagram should take through the network. It is recommended to configure this setting to Not Defined for enterprise environments and to Highest Protection for high security environments to completely disable source routing.
The recommended state for this setting is: Enabled: Highest protection, source routing is completely disabled.
An attacker could use source routed packets to obscure their identity and location. Source routing allows a computer that sends a packet to specify the route that the packet takes.
SolutionTo establish the recommended configuration via GP, set the following UI path to Enabled: Highest protection, source routing is completely disabled:
Computer Configuration\Policies\Administrative Templates\MSS (Legacy)\MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)
Note: This Group Policy path does not exist by default. An additional Group Policy template (MSS-legacy.admx/adml) is required - it is available from this TechNet blog post: The MSS settings ? Microsoft Security Guidance blog
All incoming source routed packets will be dropped.
Medium, source routed packets ignored when IP forwarding is enabled.