---
title: "HOST-KRN-014 Martian Packets Not Logged"
canonical: https://openvapt.com/checks/HOST-KRN-014.html
html: https://openvapt.com/checks/HOST-KRN-014.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-KRN-014 Martian Packets Not Logged

Checks that packets with impossible source addresses are logged.

- Domain: Server
- Severity: Low
- Control category: Secure Configuration
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N`
- CIS Controls v8: 4.1
- NIST CSF 2.0: PR.PS-01
- CWE: CWE-778
- NIST SP 800-53 Rev. 5: SC-7, CM-6
- Benchmark topic: Kernel parameters: net.ipv4.conf.all.log_martians (topic only, no benchmark text)

## Why It Matters

Logging martian packets helps detect spoofing and misrouting attempts.

## How It Detects

Reads /proc/sys/net/ipv4/conf/*/log_martians directly (all, default for future interfaces, and every interface except loopback; no command is run) and combines the all value with each interface value as the kernel does. The kernel logs martians on an interface when either value is 1, so an interface passes when all or the interface value is 1.

## How to Fix

Create /etc/sysctl.d/60-openvapt-hardening.conf containing:  net.ipv4.conf.all.log_martians = 1  then apply with: sysctl --system

## How to Verify

```
sysctl net.ipv4.conf.all.log_martians  should print 1.
```

## Learn the Theory

- [P1 Linux Server Hardening](https://openvapt.com/academy/p1.md)

## References

- [Linux kernel documentation, IP sysctl](https://docs.kernel.org/networking/ip-sysctl.html)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go

Run it: `openvapt scan --only HOST-KRN-014`. Read it offline: `openvapt explain HOST-KRN-014`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-KRN-014.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.