Detections
Analytics

1.126 SOL-11.1-050110

Information

The system must set maximum number of half-open TCP connections to 4096.

GROUP ID: V-216141RULE ID: SV-216141r959010

This setting controls how many half-open connections can exist for a TCP port.

It is necessary to control the number of completed connections to the system to provide some protection against denial of service attacks.

Solution

The Network Management profile is required

Configure maximum TCP connections for IPv4 and IPv6.

pfexec ipadm set-prop -p _conn_req_max_q0=4096 tcp

See Also

https://workbench.cisecurity.org/benchmarks/23873

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-216141r959010_rule, STIG-ID|SOL-11.1-050110, Vuln-ID|V-216141

Plugin: Unix

Control ID: 323288783de4032bb88572e4471ec5d1f3cae9a63191059f28394227724c70e0