Configure ARP filtering for All IPv4 Interfaces
An XCCDF Rule
Description
To set the runtime status of the net.ipv4.conf.all.arp_filter kernel parameter, run the following command:
$ sudo sysctl -w net.ipv4.conf.all.arp_filter=To make sure that the setting is persistent, add the following line to a file in the directory
/etc/sysctl.d: net.ipv4.conf.all.arp_filter =
warning alert: Functionality Warning
This behaviour may cause problems to system on a high availability or load balancing configuration.
Rationale
Prevents the Linux Kernel from handling the ARP table globally. By default, the kernel may respond to an ARP request from a certain interface with information from another interface.
- ID
- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_arp_filter
- Severity
- Medium
- References
- Updated