3.2 Disable Response to ICMP Broadcast Netmask Requests

Information

This setting controls whether Solaris will respond to ICMP broadcast netmask requests.

Rationale:

Reduce attack surface by restricting this vector used for host and network discovery and to prevent denial of service attacks.

Solution

To enforce this setting, run the following command:

# ipadm set-prop -p _respond_to_address_mask_broadcast=0 ip

See Also

https://workbench.cisecurity.org/benchmarks/4777

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: c62a771cd692f5a615dc5caa855c915bab94028ef071d62c8c171c4c20b6a463