Network devices must have TCP Keep-Alives enabled for TCP sessions.

From Perimeter L3 Switch Security Technical Implementation Guide - Cisco

Part of TCP Keep-Alives must be enabled.

SV-5615r3_rule Network devices must have TCP Keep-Alives enabled for TCP sessions.

Vulnerability discussion

Idle TCP sessions can be susceptible to unauthorized access and hijacking attacks. By default, routers do not continually test whether a previously connected TCP endpoint is still reachable. If one end of a TCP connection idles out or terminates abnormally, the opposite end of the connection may still believe the session is available. These "orphaned" sessions use up valuable router resources and can also be hijacked by an attacker. To mitigate this risk, routers must be configured to send periodic keepalive messages to check that the remote end of a session is still connected. If the remote device fails to respond to the keepalive message, the sending router will clear the connection and free resources allocated to the session.

Check content

Review the device configuration to verify the "service tcp-keepalives-in" command is configured. If TCP Keep-Alives are not enabled, this is a finding.

Fix text

Configure the device to enable TCP Keep-Alives.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.