Title

TCP backlog queue sizes must be set appropriately. (Cat II impact)

Discussion

To provide some mitigation to TCP DoS attacks, the TCP backlog queue sizes must be set to at least 1280 or in accordance with product-specific guidelines.

Check Content

Procedure: # ndd /dev/tcp tcp_conn_req_max_q0 If the returned value is not 1280 or greater, this is a finding. Procedure: # ndd /dev/tcp tcp_conn_req_max_q If the returned value is not 1024, this is a finding.

Fix Text

Procedure: # ndd -set /dev/tcp tcp_conn_req_max_q0 1280 # ndd -set /dev/tcp tcp_conn_req_max_q 1024 Ensure these commands are also present in system startup scripts.

Additional Identifiers

Rule ID: SV-28639r1_rule

Vulnerability ID: V-23741

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.