anchor.diff:  #           other interfaces, with the hope we will receive reply for our
   #           request and even sometimes no matter the source IP address we
   #           announce.
  -net.ipv4.conf.eth0.arp_ignore = <%= ((@node['network']['arp']['restricted']) ? "1" : "0") %>
  +net.ipv4.conf.eth0.arp_ignore = <%= ((@node['network']['arp']['restricted']) ? 1 : 0) %>
   
   
   # Define different modes for sending replies in response to received ARP requests that resolve local target IP addresses:
  
positive.code: 
  # This settings controls how the kernel behaves towards module changes at
  # runtime. Setting to 1 will disable module loading at runtime.
  kernel.modules_disabled = <%= ((@node['security']['kernel']['enable_module_loading']) ? "0" : "1") %>
  
  # Magic Sysrq should be disabled, but can also be set to a safe value if so
  # desired for physical machines. It can allow a safe reboot if the system hangs
  
negative.code: #           resolutions for global and link addresses are replied
  # * **4-7** - reserved
  # * **8** - do not reply for all local addresses
  net.ipv4.conf.eth0.arp_announce = <%= ((@node['network']['arp']['restricted']) ? 2 : 0) %>
  
  # RFC 1337 fix F1
  net.ipv4.tcp_rfc1337 = 1
  