anchor.diff:  net.ipv4.conf.default.shared_media = 1
   
   # Accepting source route can lead to malicious networking behavior, so disable it if not needed.
  -net.ipv4.conf.all.accept_source_route = 0 
  +net.ipv4.conf.all.accept_source_route = 0
   net.ipv4.conf.default.accept_source_route = 0
   
   # Accepting redirects can lead to malicious networking behavior, so disable it if not needed.
  
positive.code: 
  
  # Define different modes for sending replies in response to received ARP requests that resolve local target IP addresses:
  # 
  # * **0** - (default): reply for any local target IP address, configured on any interface
  # * **1** - reply only if the target IP address is local address configured on the incoming interface
  # * **2** - reply only if the target IP address is local address configured on the incoming interface and both with the sender's IP address are part from same subnet on this interface
  
negative.code: net.ipv4.icmp_ratelimit = 100
  
  # Adjust the ICMP ratelimit to include: ping, dst unreachable, source quench, time exceed, param problem, timestamp reply, information reply
  net.ipv4.icmp_ratemask = 88089
  
  # Disable or Enable IPv6 as it is needed.
  net.ipv6.conf.all.disable_ipv6 = <%= ((@node['network']['ipv6']['enable']) ? "0" : "1") %>
  
  