Detections
Analytics

1.121 SOL-11.1-050040

Information

The system must not respond to ICMP broadcast netmask requests.

GROUP ID: V-216371
RULE ID: SV-216371r959010

By determining the netmasks of various computers in your network, an attacker can better map your subnet structure and infer trust relationships.

Solution

The Network Management profile is required.

Disable responses to address mask broadcast.

# pfexec ipadm set-prop -p _respond_to_address_mask_broadcast=0 ip

See Also

https://workbench.cisecurity.org/benchmarks/23765

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-216371r959010_rule, STIG-ID|SOL-11.1-050040, Vuln-ID|V-216371

Plugin: Unix

Control ID: 3e6407eae7af492d163e0975d5b3f4d368afed3254f019dbcebd5bc630843063