Details

The parameter ip_nfrag provides an additional layer of protection against IP fragmentation attacks. The value the ip_nfrag specifies is the maximum number of fragments of an IP packet that can be kept in the IP reassembly queue at any time. The default value of this network option is 200. This is a reasonable value for most environments and offers protection from IP fragmentation attacks.

Solution

Set the ip_nfrag parameter to 200.

# /usr/sbin/no -p -o ip_nfrag=200

Supportive Information

The following resource is also helpful.

• https://iasecontent.disa.mil/stigs/zip/U_AIX_6-1_V1R14_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Access Control.This control applies to the following type of system Unix.

References

• 800-53|AC-4(8)
• CAT|II
• CCI|CCI-000032
• Group-ID|V-29498
• Rule-ID|SV-38702r1_rule
• STIG-ID|GEN000000-AIX0230
• Vuln-ID|V-29498

Source

• Tenable.com/audits