STIGQter: STIG Summary: Riverbed NetIM OS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

Ubuntu OS must be configured to use TCP syncookies.

DISA Rule

SV-275616r1147898_rule

Vulnerability Number

V-275616

Group Title

SRG-OS-000142-GPOS-00071

Rule Version

RIIM-OS-253010

Severity

CAT II

CCI(s)

• CCI-001095 - Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.

Weight

10

Fix Recommendation

Configure Ubuntu OS to use TCP syncookies by using the following command:

$ sudo sysctl -w net.ipv4.tcp_syncookies=1

If "1" is not the system's default value, add or update the following line in "/etc/sysctl.conf":

net.ipv4.tcp_syncookies = 1

Check Contents

Verify Ubuntu OS is configured to use TCP syncookies by using the following command:

$ sysctl net.ipv4.tcp_syncookies
net.ipv4.tcp_syncookies = 1

If the value is not "1", this is a finding.

Check the saved value of TCP syncookies by using the following command:

$ sudo grep -ir net.ipv4.tcp_syncookies /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf /etc/sysctl.conf 2> /dev/null

If the "net.ipv4.tcp_syncookies" option is not set to "1", is commented out, or is missing, this is a finding.

If conflicting results are returned, this is a finding.

Vulnerability Number

V-275616

Documentable

False

Rule Version

RIIM-OS-253010

Severity Override Guidance

Verify Ubuntu OS is configured to use TCP syncookies by using the following command:

$ sysctl net.ipv4.tcp_syncookies
net.ipv4.tcp_syncookies = 1

If the value is not "1", this is a finding.

Check the saved value of TCP syncookies by using the following command:

$ sudo grep -ir net.ipv4.tcp_syncookies /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf /etc/sysctl.conf 2> /dev/null

If the "net.ipv4.tcp_syncookies" option is not set to "1", is commented out, or is missing, this is a finding.

If conflicting results are returned, this is a finding.

Check Content Reference

M

Target Key

5706