UCF STIG Viewer Logo

The system must not respond to Internet Control Message Protocol v4 (ICMPv4) echoes sent to a broadcast address.


Overview

Finding ID Version Rule ID IA Controls Severity
V-22410 GEN003603 SV-45722r1_rule Medium
Description
Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks.
STIG Date
SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide 2018-09-19

Details

Check Text ( C-43089r1_chk )
Verify the system does not respond to ICMP ECHO_REQUESTs set to broadcast addresses.

Procedure:
# cat /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

If the result is not 1, this is a finding.
Fix Text (F-39120r1_fix)
Configure the system to not respond to ICMP ECHO_REQUESTs sent to broadcast addresses. Edit /etc/sysctl.conf and add a setting for "net.ipv4.icmp_echo_ignore_broadcasts=1" and reload the sysctls.

Procedure:
# echo "net.ipv4.icmp_echo_ignore_broadcasts=1" >> /etc/sysctl.conf
# sysctl -p