# Ensure broadcast icmp requests are ignored

Necessity: Ignoring broadcast ICMP echo requests is a critical security measure to prevent the system from being used as an amplifier in Smurf-style Denial-of-Service (DoS) attacks. In a Smurf attack, an attacker sends ICMP echo requests to a network broadcast address while spoofing the source address to be that of the victim. All hosts on the network that respond will flood the victim with ICMP replies, overwhelming its network resources. By ignoring these broadcast requests, the system refuses to participate in such an attack.

Auditing and Remediation: The audit script checks the current runtime value of the 'net.ipv4.icmp_echo_ignore_broadcasts' kernel parameter. A value of '1' indicates it is correctly configured, while '0' indicates it is vulnerable. The remediation script sets this value to '1' in both the live kernel configuration for immediate effect and in a persistent configuration file (e.g., '/etc/sysctl.d/99-security.conf') to ensure the setting survives a reboot.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is '1' (enabled). There are no legitimate operational reasons for a modern server or workstation to respond to broadcast pings. The risk of being exploited in a DoS attack far outweighs any esoteric diagnostic benefit. Therefore, this setting should be enabled unconditionally across all security postures as a fundamental hardening practice.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['1']` |
| **Moderate** | `['1']` |
| **Strict** | `['1']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the system for the current value of the 'net.ipv4.icmp_echo_ignore_broadcasts' kernel parameter. The script must use 'sysctl' or read from '/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts' and output only the numerical value (e.g., '1') without any additional text or labels.

## Remediation Script Working

Bash script that sets the 'net.ipv4.icmp_echo_ignore_broadcasts' kernel parameter. The script must accept the desired state (e.g., '1') as a single, positional command-line argument. It must apply the setting to the live kernel using 'sysctl -w' and also ensure it persists across reboots by adding or modifying the entry in a file within '/etc/sysctl.d/'. The script must return 'true' upon successful application of the setting, and 'false' otherwise.

