Servers – Ensure Broadcast ICMP Requests are Ignored

Support > Fixing Checks > Server

06 March, 2026

This check ensures that broadcast ICMP requests are ignored on the server.

Allowing broadcast ICMP requests can expose the system to amplification attacks such as Smurf attacks, leading to network congestion and denial of service.

Check Details

Resource: Server
Check: Ensure Broadcast ICMP Requests are ignored.
Risk: Systems responding to broadcast ICMP requests can be exploited in Smurf attacks, causing traffic amplification and potential service disruption.

Remediation Steps

Open a terminal session with root or sudo privileges.
Set the required parameter in sysctl configuration file:
```
sudo nano /etc/sysctl.conf
```

Add or update the following line:

net.ipv4.icmp_echo_ignore_broadcasts = 1

Alternatively, create or edit a file under /etc/sysctl.d/:
```
sudo nano /etc/sysctl.d/99-custom.conf
```
Add the same configuration line in the file.

Apply the configuration immediately:

sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1

Flush routing table to apply changes:
```
sudo sysctl -w net.ipv4.route.flush=1
```
On Container-Optimized OS, /etc is stateless. These changes need to be re-applied after every reboot.
Re-run audit commands to verify the configuration is correctly applied.

Other Articles

Servers – Ensure Broadcast ICMP Requests are Ignored

Check Details

Remediation Steps