Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
Makes the kernel ignore ICMP echo requests sent to broadcast/multicast addresses by setting net.ipv4.icmp_echo_ignore_broadcasts to 1.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks (e.g. Smurf), where spoofed broadcast pings turn the subnet into a traffic multiplier against a victim. Ignoring ICMP echo requests sent to broadcast or multicast addresses makes the system harder to enumerate and removes it from such amplification.
What Pavois checks
Pavois reads the live value via kernel_parameter('net.ipv4.icmp_echo_ignore_broadcasts'), reflecting the running kernel after sysctl.conf, /etc/sysctl.d/ drop-ins and runtime overrides are merged. A scan of /etc/sysctl.conf alone could report a value that a later drop-in or sysctl -w has overridden.
describe kernel_parameter('net.ipv4.icmp_echo_ignore_broadcasts') do
its('value') { should cmp 1 }
end
describe command("grep -hsE '^[[:space:]]*net.ipv4.icmp_echo_ignore_broadcasts[[:space:]]*=[[:space:]]*1([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl net.ipv4.icmp_echo_ignore_broadcasts and expect net.ipv4.icmp_echo_ignore_broadcasts = 1.
Inspect & investigate
Confirm with sysctl net.ipv4.icmp_echo_ignore_broadcasts. To prove the behavior, send ping -b <broadcast-addr> from another host and verify the target does not reply; observe traffic with tcpdump -ni any icmp.
Remediation
Pavois's harden plan sets net.ipv4.icmp_echo_ignore_broadcasts = 1 via the sysctl resource, persisting it in a Pavois-owned drop-in and applying it live (no reboot). Run it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | net.ipv4.icmp_echo_ignore_broadcasts |
|---|---|
| resource | sysctl |
| value | 1 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
No practical downside on servers or workstations, only directed-broadcast pings are dropped, while normal unicast ping still works. Precaution: rare network-diagnostic tooling that relies on broadcast ping sweeps to discover hosts will no longer see this machine, which is the intended hardening effect.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.4.2, 3.3.4, 3.3.1.7 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.20, CM-7(a), CM-7(b), SC-5 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 1.4.2 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.