Determine the zone that you are currently securing.
# zonename
If the command output is "global", then only the "phys" and "SR-IOV" interfaces assigned to the global zone require inspection. If using a non-Global zone, then all "phys" and "SR-IOV" interfaces assigned to the zone require inspection.
Identify if this system has physical interfaces.
# dladm show-link -Z | grep -v vnic
LINK ZONE CLASS MTU STATE OVER
net0 global phys 1500 unknown --
e1000g0 global phys 1500 up --
e1000g1 global phys 1500 up --
zoneD/net2 zoneD iptun 65515 up --
If "phys" appears in the third column, then the interface is physical.
For each physical interface, determine if the network interface is Ethernet or InfiniBand:
# dladm show-phys [interface name]
LINK MEDIA STATE SPEED DUPLEX DEVICE
[name] Ethernet unknown 0 half dnet0
The second column indicates either "Ethernet" or "Infiniband".
For each physical interface, determine if the host is using ip-forwarding:
# ipadm show-ifprop [interface name] | grep forwarding
[name] forwarding ipv4 rw off -- off on,off
[name] forwarding ipv6 rw off -- off on,off
If "on" appears in the fifth column, then the interface is using ip-forwarding.
For each interface, determine if the host is using SR-IOV’s Virtual Function (VF) driver:
# dladm show-phys [interface name] | grep vf
If the sixth column includes 'vf' in its name, it is using SR-IOV (ex: ixgbevf0).
For each physical and SR-IOV interface, determine if network link protection capabilities are enabled.
# dladm show-linkprop -p protection
LINK PROPERTY PERM VALUE DEFAULT POSSIBLE
net0 protection rw mac-nospoof, -- mac-nospoof,
restricted, restricted,
ip-nospoof, ip-nospoof,
dhcp-nospoof dhcp-nospoof
If the interface uses Infiniband and if restricted, ip-nospoof, and dhcp-nospoof do not appear in the "VALUE" column, this is a finding.
If the interface uses ip-forwarding and if mac-nospoof, restricted, and dhcp-nospoof do not appear in the "VALUE" column, this is a finding.
If the interface uses SR-IOV and if mac-nospoof, restricted, and dhcp-nospoof do not appear in the "VALUE" column, this is a finding.
If the interface uses Ethernet without IP forwarding and if mac-nospoof, restricted, ip-nospoof, and dhcp-nospoof do not appear in the "VALUE" column, this is a finding.