IP fragmentation attack: Difference between revisions

Revision as of 08:03, 13 January 2016

Revision as of 16:10, 14 April 2017

Line 158:

== Fragmentation for evasion ==

Network infrastructure equipment such as [[Router (computing)|routers]], [[Load balancing (computing)|load-balancers]], [[Firewall (computing)|firewalls]] and [[Intrusion preventiondetection system|IPSIDS]] have inconsistent visibility into fragmented packets. For example, a device may subject the initial fragment to rigorous inspection and auditing, but might allow all additional fragments to pass unchecked. Some attacks may use this fact to evade detection by placing incriminating payload data in fragments. Devices operating in [[Proxy server|"full" proxy mode]] are generally not susceptible to this subterfuge.

== References ==