Other Articles

Servers – Ensure Suspicious Packets Logging is Enabled

Support > Fixing Checks > Server

06 March, 2026

This check ensures that suspicious packets (martians) are logged on the server.

Logging such packets helps detect spoofed or malformed network traffic, improving visibility into potential security threats.

Check Details

  • Resource: Server
  • Check: Ensure suspicious packets (martians) are logged
  • Risk: Without logging, spoofed or invalid packets may go undetected, increasing the risk of network-based attacks.

Remediation Steps

  1. Open a terminal session with root or sudo privileges.

  2. Verify current configuration:

    sysctl net.ipv4.conf.all.log_martians
sysctl net.ipv4.conf.default.log_martians
  3. Ensure both values are set to 1.

  4. Set the active kernel parameters:

    sudo sysctl -w net.ipv4.conf.all.log_martians=1
sudo sysctl -w net.ipv4.conf.default.log_martians=1
sudo sysctl -w net.ipv4.route.flush=1
  5. On systems like Container-Optimized OS, the /etc directory is stateless.
  6. This means the configuration will not persist across reboots and must be reapplied after each system restart.
  7. Re-run the audit commands to confirm configuration.
  8. Perform regular audits to ensure compliance.