# Ensure suspicious packets are logged

Necessity: This setting controls the logging of 'Martian packets'—packets with source addresses that are not logically routable from the interface they were received on. Such packets can indicate IP address spoofing, network misconfigurations, or reconnaissance attempts. Logging these packets is crucial for detecting and diagnosing network anomalies and potential security incidents. Failing to log them reduces visibility into suspicious network traffic, hindering an administrator's ability to respond to threats. Auditing and Remediation: The audit script checks the current value of the 'net.ipv4.conf.all.log_martians' kernel parameter. The remediation script modifies this parameter to the desired state (typically '1' to enable logging) both in the running configuration and in a persistent configuration file to ensure the setting survives a reboot. Recommended State Rationale: Basic: ['1'] - Enabling logging is a fundamental security practice. This state provides the necessary visibility for basic network monitoring and security analysis. Moderate: ['1'] - As this is a binary setting (on or off), the moderate recommendation is identical to the basic one. There is no intermediate level of security; logging should be enabled. Strict: ['1'] - In a high-security environment, logging all suspicious network activity is non-negotiable. Enabling this parameter is a mandatory step for comprehensive intrusion detection and forensic analysis. The value of '1' represents the only secure configuration.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['1']` |
| **Moderate** | `['1']` |
| **Strict** | `['1']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the system's 'net.ipv4.conf.all.log_martians' kernel parameter using the 'sysctl -n net.ipv4.conf.all.log_martians' command and returns only the current integer value.

## Remediation Script Working

Bash script that takes a single integer ('0' or '1') as a direct, positional command-line argument. The script must set the 'net.ipv4.conf.all.log_martians' kernel parameter to this value. It must update the setting in a file under '/etc/sysctl.d/' to ensure persistence across reboots, and then apply the change to the running configuration using 'sysctl -w'. The script must return the string 'true' on success and 'false' on failure.

