How to drop source routed packets?

[Jorge Fabregas]

Hello everyone,

This question if for all network gurus out there! How can I drop source routed packets? In Linux there are some files under the /proc virtual filesystem that allow me to change this.

I've been given a Nessus report regarding this issue on all my servers. I really have no idea how to turn it off on HP-UX.

Thanks in advance,
Jorge

[Sundar_7]

If you are running 11.x then you can use ndd. I am not 100% sure if the parameter ip_forward_src_routed can be used to drop the source routed packets.

Check out the ndd documentation and the explanation of ip_forward_src_routed parameter.

[Steven E. Protter]

ndd is the command. You actually know more about the subject than I, and the ndd manual should lay things out pretty nicely for you.

SEP

[Ron Kinner · Accepted solution]

http://www.blacksheepnetworks.com/security/resources/bastion11.html

is the best source for that sort of info but it assumes you know a lot about ndd. The parameter in ndd is ip_forward_src_routed which is a member of /dev/ip. The default value is 1 but you want it to be 0. There is a file /etc/rc.config.d/nddconf which you have to edit so that it stays after a boot but just to prove the concept you can change it on the fly with:

ndd -set /dev/ip ip_forward_src_routed 0

In the nddconf file you add three lines:

TRANSPORT_NAME[0]=ip
NDD_NAME[0]=ip_forward_src_routed
NDD_VALUE[0]=0

If you already have values in nddconf then use the next higher integer in the brackets.

Ron

[Jorge Fabregas]

Thanks Sundar, Steven and Ron! Many thanks!

Hey Ron! You made it too easy for me :) Thanks!