Harden ICMP and TCP handling against floods and bogus packets

Description

These kernel settings make the IPv4 stack resist common abuse:

• net.ipv4.icmp_echo_ignore_broadcasts = 1: do not answer pings sent to broadcast or multicast addresses;
• net.ipv4.icmp_ignore_bogus_error_responses = 1: do not log ICMP errors that violate RFC 1122;
• net.ipv4.tcp_syncookies = 1: answer with SYN cookies when the queue of half-open connections is full;
• net.ipv4.tcp_rfc1337 = 1: protect sockets in TIME-WAIT state from being reset by stray packets (RFC 1337);
• net.ipv4.ip_local_port_range = 32768 65535: use the widest range of ephemeral ports, which makes source ports harder to guess.

Debian already ships the first three values. The last two come from ANSSI.

Rationale

Answering broadcast pings turns the host into an amplifier for smurf attacks. Bogus error messages can fill the logs. SYN cookies keep the host reachable during a SYN flood (RFC 4987). RFC 1337 protection and a wide ephemeral port range make connection hijacking and blind spoofing harder.

Impact

None known. The wider port range can collide with a service listening on a port between 61000 and 65535; reserve such ports with net.ipv4.ip_local_reserved_ports.

Setting

Audit

Run sysctl net.ipv4.icmp_echo_ignore_broadcasts net.ipv4.icmp_ignore_bogus_error_responses net.ipv4.tcp_syncookies net.ipv4.tcp_rfc1337 net.ipv4.ip_local_port_range and compare with the recommended values. Check that no sysctl file sets other values.

Automated: every check must pass. Scanners report each check by its id.

echo-ignore-broadcasts

net.ipv4.icmp_echo_ignore_broadcasts.

key: net.ipv4.icmp_echo_ignore_broadcasts
value: 1

ignore-bogus-errors

net.ipv4.icmp_ignore_bogus_error_responses.

key: net.ipv4.icmp_ignore_bogus_error_responses
value: 1

syncookies

net.ipv4.tcp_syncookies.

key: net.ipv4.tcp_syncookies
value: 1

rfc1337

net.ipv4.tcp_rfc1337.

key: net.ipv4.tcp_rfc1337
value: 1

local-port-range

net.ipv4.ip_local_port_range.

key: net.ipv4.ip_local_port_range
value: 32768 65535

Remediation

Add to /etc/sysctl.d/60-cirsec.conf:

net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_rfc1337 = 1
net.ipv4.ip_local_port_range = 32768 65535

remove other assignments, then run sysctl --system.

Rollback

Remove the lines from /etc/sysctl.d/60-cirsec.conf and set the previous values with sysctl -w.

echo-ignore-broadcasts

Generated from check echo-ignore-broadcasts: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ignore-bogus-errors

Generated from check ignore-bogus-errors: the engine writes the fix for every output, it sets the expected value and the check runs again after.

syncookies

Generated from check syncookies: the engine writes the fix for every output, it sets the expected value and the check runs again after.

rfc1337

Generated from check rfc1337: the engine writes the fix for every output, it sets the expected value and the check runs again after.

local-port-range

Generated from check local-port-range: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• Linux kernel documentation - IP Sysctl The Linux Kernel Organization, vendor-doc, accessed 2026-10-18
• RFC 4987 - TCP SYN Flooding Attacks and Common Mitigations IETF, rfc, accessed 2026-10-18
• RFC 1337 - TIME-WAIT Assassination Hazards in TCP IETF, rfc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R12) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle