# Ensure suspicious packets are logged

Necessity: This setting is crucial for network security monitoring. 'Martian packets' are packets received on an interface that have a source address that is not routable through that same interface. These can be indicative of IP address spoofing, denial-of-service attacks, or significant network misconfigurations. By enabling logging for these suspicious packets, administrators create an audit trail that can be used to detect and diagnose network anomalies and potential security incidents. Failing to log these packets results in a loss of visibility into potentially malicious network activity.

Auditing and Remediation: The audit script directly queries the live value of the 'net.ipv4.conf.all.log_martians' kernel parameter to determine the system's current configuration. The remediation script modifies this live parameter using 'sysctl -w' for immediate effect and writes the setting to a file in '/etc/sysctl.d/' to ensure the configuration is persistent across system reboots.

Recommended State Rationale: 
- Basic: A value of ['1'] is the baseline recommendation. This enables the logging feature, which is the primary security goal.
- Moderate: This state also recommends ['1']. There is no intermediate configuration; the setting is either on or off. Enabling it is the standard practice for a moderately hardened system.
- Strict: The strict recommendation remains ['1']. For any security-conscious environment, logging suspicious network packets is a non-negotiable requirement. There is no more secure state for this specific parameter.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['1']` |
| **Moderate** | `['1']` |
| **Strict** | `['1']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the system's 'net.ipv4.conf.all.log_martians' kernel parameter using the 'sysctl -n net.ipv4.conf.all.log_martians' command. The script must output only the numerical value of this setting and nothing else.

## Remediation Script Working

Develop a Bash script that accepts a single numerical argument (e.g., '1'). The script should use 'sysctl -w net.ipv4.conf.all.log_martians=$1' to set the kernel parameter for the current session and also write 'net.ipv4.conf.all.log_martians = $1' to a configuration file such as '/etc/sysctl.d/99-security-settings.conf' to ensure the setting persists across reboots. The script must return 'true' on success and 'false' on failure.

