Detections
Analytics

1.119 SOL-11.1-050040

Information

The system must not respond to ICMP broadcast netmask requests.

GROUP ID: V-216134RULE ID: SV-216134r959010

By determining the netmasks of various computers in your network, an attacker can better map your subnet structure and infer trust relationships.

Solution

The Network Management profile is required.

Disable responses to address mask broadcast.

pfexec ipadm set-prop -p _respond_to_address_mask_broadcast=0 ip

See Also

https://workbench.cisecurity.org/benchmarks/23873

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-216134r959010_rule, STIG-ID|SOL-11.1-050040, Vuln-ID|V-216134

Plugin: Unix

Control ID: 0b9ddc524c8ee7eb1b68f4d321ce9f311af8bfbff60ad77d35181eea7505d473