Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces by Default
Forces net.ipv4.conf.default.log_martians to 1 so newly created IPv4 interfaces log packets with impossible or spoofed source addresses by default.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
A "martian" packet has a source address that cannot legitimately appear on the interface where it arrived, impossible, spoofed, or source-routed addresses. Logging them (log_martians=1) creates a forensic trail of spoofing attempts, misconfigured neighbours, and reconnaissance, turning silent drops (e.g. from rp_filter) into actionable events. The default template should be 1 so every new interface inherits this visibility.
What Pavois checks
Pavois reads the live runtime value of net.ipv4.conf.default.log_martians from the kernel (InSpec kernel_parameter, equivalent to sysctl), not a /etc/sysctl.d/ file. The default key only affects interfaces created after it is set, so the running value is what determines whether future interfaces log martians. A config file might say 1 while a later override left it at 0; only the effective parameter is reliable.
describe kernel_parameter('net.ipv4.conf.default.log_martians') do
its('value') { should cmp 1 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv4.conf.default.log_martians[[:space:]]*=[[:space:]]*1([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv4.conf.default.log_martians. Expected output:
net.ipv4.conf.default.log_martians = 1
Inspect & investigate
Once enabled, martian-packet entries appear in the kernel log: dmesg | grep -i martian and journalctl -k | grep -i martian. Lines look like IPv4: martian source <ip> from <ip>, on dev <iface>. Inspect the tunable state with sysctl net.ipv4.conf.default.log_martians.
Remediation
Pavois's harden plan uses the sysctl resource to set net.ipv4.conf.default.log_martians to 1, applying it to the running kernel and persisting it in a Pavois-managed drop-in under /etc/sysctl.d/ so it survives reboot. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv4.conf.default.log_martians |
|---|---|
| resource | sysctl |
| value | 1 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Safe to enable; it only adds logging and changes no packet-handling behaviour, so it cannot break connectivity or remote access. The only consideration is log volume: on a noisy or hostile network martian logging can be chatty and may flood dmesg/the journal, so ensure log rotation and rate limiting are sane. Pair with the all.log_martians and rp_filter rules so dropped spoofed traffic is actually recorded.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 3.3.9, 3.3.1.17 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.20, CM-7(a), CM-7(b), SC-5(3)(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.