Title

TCP backlog queue sizes must be set appropriately. (Cat II impact)

Discussion

To provide some mitigation to TCP Denial of Service attacks, the TCP backlog queue sizes must be set to at least 1280 or in accordance with product-specific guidelines.

Check Content

# cat /proc/sys/net/ipv4/tcp_max_syn_backlog If the result is not 1280 or greater, this is a finding.

Fix Text

Edit /etc/sysctl.conf and add a setting for "net.ipv4.tcp_max_syn_backlog=1280". Procedure: # echo "net.ipv4.tcp_max_syn_backlog=1280" >> /etc/sysctl.conf # sysctl -p

Additional Identifiers

Rule ID: SV-45720r1_rule

Vulnerability ID: V-23741

Group Title: GEN003601

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.