Detections
Analytics

PHTN-40-000228 - The Photon operating system must log IPv4 packets with impossible addresses.

Information

The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected.

Solution

Navigate to and open:

/etc/sysctl.d/zz-stig-hardening.conf

Add or update the following lines:

net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

At the command line, run the following command to load the new configuration:

# /sbin/sysctl --load /etc/sysctl.d/zz-stig-hardening.conf

Note: If the file zz-stig-hardening.conf does not exist, it must be created.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_8-0_Y24M08_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-258891r991589_rule, STIG-ID|PHTN-40-000228, Vuln-ID|V-258891

Plugin: Unix

Control ID: f1953d45c72c1a9afdcb00e87244feda229255110af530aec9993bb5cc180c5b