Detections
Analytics

1.128 SOL-11.1-050110

Information

The system must set maximum number of half-open TCP connections to 4096.

GROUP ID: V-216378
RULE ID: SV-216378r959010

This setting controls how many half-open connections can exist for a TCP port.

It is necessary to control the number of completed connections to the system to provide some protection against denial of service attacks.

Solution

The Network Management profile is required

Configure maximum TCP connections for IPv4 and IPv6.

# pfexec ipadm set-prop -p _conn_req_max_q0=4096 tcp

See Also

https://workbench.cisecurity.org/benchmarks/23765

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-216378r959010_rule, STIG-ID|SOL-11.1-050110, Vuln-ID|V-216378

Plugin: Unix

Control ID: 7f17d44f7f85a812a5b9b2cfe33e2d387b6b4ab87f7659553d59d3e637814af8