Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The system must provide protection against IP fragmentation attacks.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-29498 | GEN000000-AIX0230 | SV-38702r1_rule | ECSC-1 | Medium |
| Description |
|---|
| The parameter ip_nfrag provides an additional layer of protection against IP fragmentation attacks. The value the ip_nfrag specifies is the maximum number of fragments of an IP packet that can be kept in the IP reassembly queue at any time. The default value of this network option is 200. This is a reasonable value for most environments and offers protection from IP fragmentation attacks. |
| STIG | Date |
|---|---|
| AIX 5.3 Security Technical Implementation Guide | 2012-05-25 |
Details
| Check Text ( C-37798r2_chk ) |
|---|
| Check the value of the ip_nfrag parameter. # /usr/sbin/no -o ip_nfrag If the result returned is less than 200, this is a finding. |
| Fix Text (F-33056r1_fix) |
|---|
| Set the ip_nfrag parameter to 200. # /usr/sbin/no -p -o ip_nfrag=200 |