IP fragmentation attack: Difference between revisions

Revision as of 18:10, 4 September 2013

Latest revision as of 15:47, 27 August 2025

(31 intermediate revisions by 25 users not shown)

Line 1:

{{Use American English|date = April 2019}}

'''[[IP fragmentation]]''' is the process of breaking up a single [[Internet Protocol]] (IP) [[datagram]] into multiple packets of smaller size. Every network link has a characteristic size of [[Data frame|messages]] that may be transmitted, called the [[maximum transmission unit]] (MTU).

{{short description|Cyberattack method based on Internet Protocol fragmentation}}

{{multiple issues|

{{technical|date=April 2014}}

{{refimprove|date=April 2014}}

}}

'''IP fragmentation attacks''' are a kind of [[cyberattack|computer security attack]] based on how the [[Internet Protocol]] (IP) requires data to be transmitted and processed. Specifically, it invokes [[IP fragmentation]], a process used to partition messages (the [[service data unit]] (SDU); typically a [[network packet|packet]]) from one layer of a network into multiple smaller [[payload (computing)|payload]]s that can fit within the lower layer's [[protocol data unit]] (PDU). Every network link has a maximum size of [[data frame|messages]] that may be transmitted, called the [[maximum transmission unit]] (MTU). If the SDU plus metadata added at the [[link layer]] exceeds the MTU, the SDU must be fragmented. IP fragmentation attacks exploit this process as an [[attack vector]].

Part of the TCP/IP suite is the Internet Protocol (IP) which resides at the [[Internet Layer]] of this model. IP is responsible for the transmission of packets between network end points. IP includes some features which provide basic measures of fault-tolerance (time to live, checksum), traffic prioritization (type of service) and support for the fragmentation of larger packets into multiple smaller packets (ID field, fragment offset). The support for fragmentation of larger packets provides a protocol allowing routers to fragment a packet into smaller packets when the original packet is too large for the supporting datalink frames. IP fragmentation exploits (attacks) use the fragmentation protocol within IP as an attack vector.

Part of the [[Internet protocol suite|TCP/IP suite]] is the Internet Protocol (IP) which resides at the [[Internet Layer]] of this model. IP is responsible for the transmission of packets between network end points. IP includes some features which provide basic measures of fault-tolerance (time to live, checksum), traffic prioritization (type of service) and support for the fragmentation of larger packets into multiple smaller packets (ID field, fragment offset). The support for fragmentation of larger packets provides a protocol allowing routers to fragment a packet into smaller packets when the original packet is too large for the supporting datalink frames. IP fragmentation exploits (attacks) use the fragmentation protocol within IP as an attack vector.

== Fragmentation process ==

IP datagrams are encapsulated in datalink frames, and, therefore, the link MTU affects larger IP [[datagram]]s and forces them to be split into pieces equal to or smaller than the MTU size.

According to [Kurose 2013], in one type of IP fragmentation attack "the attacker sends a stream of small fragments to the target host, none of which has an offset of zero. The target can collapse as it attempts to rebuild datagrams out of the degenerate packets."<ref name=":0">{{Cite book|title=Computer Networking: A Top-down Approach|last=Kurose|first=James F.|date=2013|publisher=Pearson|others=Ross, Keith W., 1956-|isbn=9780132856201|edition=6th|___location=Boston|pages=338|oclc=769141382}}</ref> Another attack involves sending overlapping fragments with non-aligned offsets, which can render vulnerable operating systems not knowing what to do, causing some to crash.<ref name=":0" />

== Process ==

[[File:IPv4 Fragmentation Algorithm-en.png|thumb|300px|The fragmentation algorithm in IPv4.]]

IP packets are encapsulated in datalink frames, and, therefore, the link MTU affects larger IP [[network packet|packets]] and forces them to be split into pieces equal to or smaller than the MTU size.

This can be accomplished by several approaches:

* To set the IP datagram[[network packet|packet]] size equal or smaller than the directly attached medium (in our case 802.3) and delegate all further fragmentation of datagramspackets to routers, meaning that routers decide if the current datagrampacket should be re-fragmented or not. This offloads a lot of work on to routers, and can also result in packets being segmented by several IP routers one after another, resulting in very peculiar fragmentation.

* To preview all links between source and destination and select the smallest MTU in this route, assuming there is a unique route. This way we make sure that the fragmentation is done by the sender, using a packet-size smaller than the selected MTU, and there is no further fragmentation en route. This solution, called [[Path MTU Discovery]], allows a sender to fragment/segment a long [[Internet]] [[packet (information technology)|packet]], rather than relying on routers to perform IP-level fragmentation. This is more efficient and more scalable. It is therefore the recommended method in the current Internet. The problem with this approach is that each packet is routed independently; they may well typically follow the same route, but they may not, and so a probe packet to determine fragmentation may follow a path different from paths taken by later packets.

Three fields in the [[IPv4#Header|IP header]] are used to implement fragmentation and reassembly. The "Identification", "Flags" and "Fragment Offset" fields.

{| class="wikitable" style="margin: 0 auto; text-align: center;"

|+ IPv4 Header Format

<code>

|-

0 1 2 3

! ''Offsets''

0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

! [[Octet (computing)|Octet]]

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

! colspan="8" | 0

|Version| IHL |Type of Service| Total Length |

! colspan="8" | 1

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

! colspan="8" | 2

| Identification |Flags| Fragment Offset |

! colspan="8" | 3

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

|-

| Time to Live | Protocol | Header Checksum |

! | [[Octet (computing)|Octet]]

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

! [[Bit]]

| Source Address |

! style="width:2.6%;"| 0

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

! style="width:2.6%;"| 1

| Destination Address |

! style="width:2.6%;"| 2

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

! style="width:2.6%;"| 3

| Options | Padding |

! style="width:2.6%;"| 4

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

! style="width:2.6%;"| 5

</code>

! style="width:2.6%;"| 6

! style="width:2.6%;"| 7

! style="width:2.6%;"| 8

! style="width:2.6%;"| 9

! style="width:2.6%;"| 10

! style="width:2.6%;"| 11

! style="width:2.6%;"| 12

! style="width:2.6%;"| 13

! style="width:2.6%;"| 14

! style="width:2.6%;"| 15

! style="width:2.6%;"| 16

! style="width:2.6%;"| 17

! style="width:2.6%;"| 18

! style="width:2.6%;"| 19

! style="width:2.6%;"| 20

! style="width:2.6%;"| 21

! style="width:2.6%;"| 22

! style="width:2.6%;"| 23

! style="width:2.6%;"| 24

! style="width:2.6%;"| 25

! style="width:2.6%;"| 26

! style="width:2.6%;"| 27

! style="width:2.6%;"| 28

! style="width:2.6%;"| 29

! style="width:2.6%;"| 30

! style="width:2.6%;"| 31

|-

! 0

! 0

| colspan="4"|[[IPv4#Version|Version]]

| colspan="4"|[[IPv4#IHL|IHL]]

| colspan="6"|[[IPv4#DSCP|DSCP]]

| colspan="2"|[[IPv4#ECN|ECN]]

| colspan="16"|[[IPv4#Total Length|Total Length]]

|-

! 4

! 32

| colspan="16"|[[IPv4#Identification|Identification]]

| colspan="3"|[[IPv4#Flags|Flags]]

| colspan="13"|[[IPv4#Fragment offset|Fragment Offset]]

|-

! 8

! 64

| colspan="8"|[[IPv4#TTL|Time To Live]]

| colspan="8"|[[IPv4#Protocol|Protocol]]

| colspan="16"|[[IPv4#Header checksum|Header Checksum]]

|-

! 12

! 96

| colspan="32"|[[IPv4#Source address|Source IP Address]]

|-

! 16

! 128

| colspan="32"|[[IPv4#Destination address|Destination IP Address]]

|-

! 20

! 160

| colspan="32" rowspan="4" |[[IPv4#Options|Options]] (if IHL > 5)

|-

! 24

! 192

|-

! 28

! 224

|-

! 32

! 256

|}

Flags:

: A 3 [[bit field]] which says if the datagrampacket is a part of a fragmented [[data frame]] or not.

: Bit 0: reserved, must be zero (unless datagrampacket is adhering to RFC 3514)

: Bit 1: (AF) 0 = May Fragment, 1 = Don't Fragment.

: Bit 2: (AF) 0 = Last Fragment, 1 = More Fragments.

{| class="wikitable" style="text-align: center;"

<code>

|-

0 1 2 13 bits

! Bit

+---+---+---+ +-----------------------------+

! 0 !! 1 !! 2 !! 3 |!! 4 !! |5 D!! |6 M!! |7 !! 8 !! |9 !! 10 !! 11 Fragment!! Offset12 !! 13 !! 14 !! |15

|-

| 0 | F | F | +-----------------------------+

! Field

+---+---+---+

| 0 || DF || MF || colspan="13" | Fragment Offset

</code>

|}

Fragment Offset specifies the fragment's position within the original Datagrampacket, measured in 8-byte units.

Accordingly, every fragment except the last must contain a multiple of 8 bytes of data. It is obvious that Fragment Offset can hold 8192 (2^13) units but the [[datagramnetwork packet|packet]] can't have 8192 * 8 = 6553665,536 bytes of data because "Total Length" field of [[internet protocolProtocol|IP]] header records the total size including the header and data. An IP header is at least 20 bytes long, so the maximum value for "Fragment Offset" is restricted to 8189, which leaves room for 3 bytes in the last fragment.

Because an IP internet can be connectionless, fragments from one datagram[[network packet|packet]] may be interleaved with those from another at the destination. The "Identification field" uniquely identifies the fragments of a particular [[datagramnetwork packet|packet]].

The source system sets "Identification" field in each datagram[[network packet|packet]] to a unique value for all datagrams[[network packet|packets]] which use the same source IP address, destination IP address, and "Protocol" values, for the lifetime of the datagram[[network packet|packet]] on the internet. This way the destination can distinguish which incoming fragments belong to a unique datagram[[network packet|packet]] and buffer all of them until the last fragment is received. The last fragment sets the "More Fragment" bit to 0 and this tells the receiving station to start reassembling the data if all fragments have been received.

The following is a real-life fragmentation example:

The following was obtained using the [[Wireshark|Ethereal]] protocol analyzer to capture [[Internet Control Message Protocol|ICMP]] [[Ping (networking utility)|echo request]] packets. To simulate this open up a terminal and type ping ip_dest -n 1 -l 65000.

<!-- The terminal command doesn't work for BASH on Darwin. -->

The results are as follows:

<!-- This example is way too long and messy -->

<syntaxhighlight lang="text">

<code>

No. Time Source Destination Protocol Info

1 0.000000 87.247.163.96 66.94.234.13 ICMP Echo (ping) request

Line 132 ⟶ 212:

Internet Protocol, Src: 87.247.163.96 (87.247.163.96), Dst: 66.94.234.13 (66.94.234.13)

Data (1480 bytes)

</syntaxhighlight>

</code>

Note that only the first fragment contains the ICMP header and all remaining fragments are generated without the ICMP header.

Two important points here:

* In some datalink protocols such as Ethernet, only the first fragment contains the full upper layer header, meaning that other fragments look like beheaded datagrams[[network packet|packets]].

* Additional overhead imposed over network because all fragments contains their own IP header. Additional overhead = (number_of_fragments - 1) * (ip_header_len);

==IP fragmentationExploits exploits==

; IP fragment overlapped: The IP fragment overlapped [[exploit (computer security)|exploit]] occurs when two fragments contained within the same IP [[network packet|packet]] have offsets that indicate that they overlap each other in positioning within the [[network packet|packet]]. This could mean that either fragment A is being completely overwritten by fragment B, or that fragment A is partially being overwritten by fragment B. Some operating systems do not properly handle fragments that overlap in this manner and may throw exceptions or behave in other undesirable ways upon receipt of overlapping fragments. This is the basis for the [[teardrop attack]]. Overlapping fragments may also be used in an attempt to bypass Intrusion Detection Systems. In this exploit, part of an attack is sent in fragments along with additional random data; future fragments may overwrite the random data with the remainder of the attack. If the completed [[network packet|packet]] is not properly reassembled at the IDS, the attack will go undetected.

===IP fragment overlapped===

; IP fragmentation buffer full: The IP fragmentation buffer full exploit occurs when there is an excessive amount of incomplete fragmented traffic detected on the protected network. This could be due to an excessive number of incomplete fragmented [[network packet|packets]], a large number of fragments for individual [[network packet|packets]] or a combination of quantity of incomplete [[network packet|packets]] and size/number of fragments in each [[network packet|packet]]. This type of traffic is most likely an attempt to bypass security measures or [[Intrusion Detection Systems]] by intentional fragmentation of attack activity.

The IP fragment overlapped [[exploit (computer security)|exploit]] occurs when two fragments contained within the same IP datagram have offsets that indicate that they overlap each other in positioning within the datagram. This could mean that either fragment A is being completely overwritten by fragment B, or that fragment A is partially being overwritten by fragment B. Some operating systems do not properly handle fragments that overlap in this manner and may throw exceptions or behave in other undesirable ways upon receipt of overlapping fragments. This is the basis for the [[Teardrop attack|teardrop]] [[Denial of service]] attacks.

; IP fragment overrun: The IP Fragment Overrun exploit is when a reassembled fragmented [[network packet|packet]] exceeds the declared IP data length or the maximum [[network packet|packet]] length. By definition, no IP packet should be larger than 65,535 bytes. Systems that try to process these large [[network packet|packets]] can crash, and can be indicative of a denial of service attempt.

; IP fragment too many packets:The "Too Many Packets" exploit is identified by an excessive number of incomplete fragmented [[network packet|packet]] detected on the network. This is usually either a denial of service attack or an attempt to bypass security measures. An example of "Too Many Packets", "Incomplete Packet" and "Fragment Too Small" is the Rose Attack.<ref>{{Cite web|url=http://www.digital.net/~gandalf/Rose_Frag_Attack_Explained.htm|title=The Rose Fragmentation Attack Explained|last=Hollis|first=Ken|archive-url=https://web.archive.org/web/20120224113108/http://www.digital.net/~gandalf/Rose_Frag_Attack_Explained.htm|archive-date=2012-02-24|url-status=|access-date=2013-11-25}}</ref>

; IP fragment incomplete packet: This exploit occurs when a [[network packet|packet]] can not be fully reassembled due to missing data. This can indicate a denial of service attack or an attempt to defeat packet filter security policies.

; IP Fragment Too Small: If an IP fragment is too small it indicates that the fragment is likely intentionally crafted. Any fragment other than the final fragment that is less than 400 bytes could be considered too small. Small fragments may be used in denial of service attacks or in an attempt to bypass security measures or detection.

== Fragmentation for evasion ==

=== IP fragmentation buffer full ===

The IP fragmentation buffer full exploit occurs when there is an excessive amount of incomplete fragmented traffic detected on the protected network. This could be due to an excessive number of incomplete fragmented datagrams, a large number of fragments for individual datagrams or a combination of quantity of incomplete datagrams and size/number of fragments in each datagram. This type of traffic is most likely an attempt to bypass security measures or [[Intrusion Detection Systems]] by intentional fragmentation of attack activity.

Network infrastructure equipment such as [[Router (computing)|routers]], [[Load balancing (computing)|load-balancers]], [[Firewall (computing)|firewalls]] and [[Intrusion detection system|IDS]] have inconsistent visibility into fragmented packets. For example, a device may subject the initial fragment to rigorous inspection and auditing, but might allow all additional fragments to pass unchecked. Some attacks may use this fact to evade detection by placing incriminating payload data in fragments. Devices operating in [[Proxy server|"full" proxy mode]] are generally not susceptible to this subterfuge.

=== IP fragment overrun ===

The IP Fragment Overrun exploit is when a reassembled fragmented datagram exceeds the declared IP data length or the maximum datagram length. By definition, no IP datagram should be larger than 65,535 bytes. Systems that try to process these large datagrams can crash, and can be indicative of a denial of service attempt.

== References ==

=== IP fragment overwrite ===

Overlapping fragments may be used in an attempt to bypass Intrusion Detection Systems. In this exploit, part of an attack is sent in fragments along with additional random data; future fragments may overwrite the random data with the remainder of the attack. If the completed datagram is not properly reassembled at the IDS, the attack will go undetected. <!-- Triggers when a fragment overlap occurs which results in existing data being overwritten. This part seems random, but it might belong in here somewhere.-->

=== IP fragment too many datagrams ===

The Too Many Datagrams exploit is identified by an excessive number of incomplete fragmented datagrams detected on the network. This is usually either a denial of service attack or an attempt to bypass security measures. An example of "Too Many Datagrams", "Incomplete Datagram" and "Fragment Too Small" is the Rose Attack.<ref>[http://digital.net/~gandalf/Rose_Frag_Attack_Explained.htm Ken Hollis, "The Rose Attack Explained", Retrieved on 2009-06-08]</ref>

=== IP fragment incomplete datagram===

This exploit occurs when a datagram can not be fully reassembled due to missing data. This can indicate a denial of service attack or an attempt to defeat packet filter security policies.

=== IP fragment too small ===

An IP Fragment Too Small exploit is when any fragment other than the final fragment is less than 400 bytes, indicating that the fragment is likely intentionally crafted. Small fragments may be used in denial of service attacks or in an attempt to bypass security measures or detection.

== Fragmentation for evasion ==

Network infrastructure equipment such as [[Router (computing)|routers]], [[Load balancing (computing)|load-balancers]], [[Firewall (computing)|firewalls]] and [[Intrusion prevention system|IPS]] have inconsistent visibility into fragmented packets. For example, a device may subject the initial fragment to rigorous inspection and auditing, but might allow all additional fragments to pass unchecked. Some attacks may use this fact to evade detection by placing incriminating payload data in fragments. Devices operating in [[Proxy server|"full" proxy mode]] are generally not susceptible to this subterfuge.

==References==

{{reflist}}

== External links ==

*{{Waybackdate|site=http://www.kohala.com/start/|date=20020802080303|title=W. Richard Stevens' Home Page}}

*[http://www.ietf.org/rfc/rfc1858.txt RFC 1858]

*[http://www.ietf.org/rfc/rfc791.txt RFC 791]

* [http://kohala.com/start/ W. Richard Stevens' Home Page]

==External links==

* {{IETF RFC|1858|link=no}}

* {{IETF RFC|791|link=no}}

[[Category:Internet security]]

[[Category:Computer networking]]