anchor.diff:  net.ipv4.conf.default.shared_media = 1
   
   # Accepting source route can lead to malicious networking behavior, so disable it if not needed.
  -net.ipv4.conf.all.accept_source_route = 0 
  +net.ipv4.conf.all.accept_source_route = 0
   net.ipv4.conf.default.accept_source_route = 0
   
   # Accepting redirects can lead to malicious networking behavior, so disable it if not needed.
  
positive.code: net.ipv4.conf.all.rp_filter = 1
  net.ipv4.conf.default.rp_filter = 1
  
  # Reduce the surface on SMURF attacks. Make sure to ignore ECHO broadcasts, which are only required in broad network analysis. 
  net.ipv4.icmp_echo_ignore_broadcasts = 1
  
  # There is no reason to accept bogus error responses from ICMP, so ignore them instead.
  
negative.code: net.ipv4.icmp_ratelimit = 100
  
  # Adjust the ICMP ratelimit to include: ping, dst unreachable, source quench, time exceed, param problem, timestamp reply, information reply
  net.ipv4.icmp_ratemask = 88089
  
  # Disable or Enable IPv6 as it is needed.
  net.ipv6.conf.all.disable_ipv6 = <%= ((@node['network']['ipv6']['enable']) ? "0" : "1") %>
  
  