OpenControls Logo

STIG Viewer

STIGViewer Support

The Nokia multicast Designated Router (DR) must be configured to limit the number of mroute states resulting from Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Host Membership Reports.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-283857NOKI-RT-000390SV-283857r1203820_ruleCCI-002385medium
Description
The current multicast paradigm can let any host join any multicast group at any time by sending an IGMP or MLD membership report to the DR. In a Protocol Independent Multicast (PIM) Sparse Mode network, the DR will send a PIM Join message for the group to the Rendezvous Point (RP). Without any form of admission control, this can pose a security risk to the entire multicast domain, specifically the multicast routers along the shared tree from the DR to the RP that must maintain the mroute state information for each group join request. Hence, it is imperative that the DR is configured to limit the number of mroute states that must be maintained to mitigate the risk of IGMP or MLD flooding.
STIGDate
Nokia Service Router OS 25.x Router Security Technical Implementation Guide2026-06-15

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (13) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-01Continuous Monitoring
1.00
MON-01.1Intrusion Detection & Prevention Systems (IDS & IPS)
1.00
MON-01.3Inbound & Outbound Communications Traffic
1.00
MON-01.4System Generated Alerts
1.00
MON-01.8Security Event Monitoring
1.00
NET-01Network Security Controls (NSC)
1.00
NET-02Layered Network Defenses
1.00
SEA-01Secure Engineering Principles
1.00
SEA-02Alignment With Enterprise Architecture
1.00
CAP-01Capacity & Performance Management
0.50

+3 more (top 10 by confidence shown)

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (36) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-17(9)Disconnect or Disable Access
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-4Information Flow Enforcement
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-12Audit Record Generation
1.00
AU-3Content of Audit Records
1.00
AU-5Response to Audit Logging Process Failures
1.00
CM-11(2)Software Installation with Privileged Status
1.00

+26 more (top 10 by confidence shown)

CCI1 mapping
CCI-002385
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

DE.CM-01
1.00
PR.IR-01
1.00
PR.IR-04
0.50

Who does this work

12 NICE work roles and 9 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-283857r1203820_chk)

Review the DR configuration to verify it is limiting the number of mroute states via IGMP or MLD. Verify the maximum number of IGMP or MLD groups and maximum group sources is configured using the command below: - show router igmp interface "TO-CE" detail | match "Max Groups Allowed" Max Groups Allowed : 200 Max Groups Till Now: 0 - show router mld interface "TO-CE" detail | match "Max Groups Allowed" Max Groups Allowed : 200 Max Groups Till Now: 0 Note: If both global and per-interface state limiters are configured, the limits configured for per-interface state limiters are still enforced but are constrained by the global limit. If the DR is not limiting multicast join requests via IGMP or MLD on a global or interface basis, this is a finding.

Fix Text (F-88327r1203819_fix)

Configure the DR on a global or interface basis to limit the number of mroute states resulting from IGMP or MLD membership reports, as shown in the example below: - configure router igmp interface "TO-CE" max-groups 200 - configure router mld interface "TO-CE" max-groups 200