Title

TCP backlog queue sizes must be set appropriately. (Cat II impact)

Discussion

To provide some mitigation to TCP DoS attacks, the TCP backlog queue sizes must be set to at least 1280 or in accordance with product-specific guidelines.

Check Content

Determine the type of zone that you are currently securing. # zonename If the zone is not the global zone, determine if any interfaces are exclusive to the zone: # dladm show-link If the output indicates "insufficient privileges" then this requirement is not applicable. If the zone is the global zone or the non-global zone has exclusive interfaces determine the network settings. Procedure: # ndd /dev/tcp tcp_conn_req_max_q0 If the returned value is not 1280 or greater, this is a finding. Procedure: # ndd /dev/tcp tcp_conn_req_max_q If the returned value is not 1024, this is a finding.

Fix Text

Procedure: # ndd -set /dev/tcp tcp_conn_req_max_q0 1280 # ndd -set /dev/tcp tcp_conn_req_max_q 1024 Ensure these commands are also present in system startup scripts.

Additional Identifiers

Rule ID: SV-226889r603265_rule

Vulnerability ID: V-226889

Group Title: SRG-OS-000480

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.