IP fragmentation attack: Difference between revisions

Revision as of 22:47, 8 July 2018

Revision as of 15:27, 28 November 2018

Line 123:

Fragment Offset specifies the fragment's position within the original packet, measured in 8-byte units.

Accordingly, every fragment except the last must contain a multiple of 8 bytes of data. It is obvious that Fragment Offset can hold 8192 (2^13) units but the [[network packet|packet]] can't have 8192 * 8 = 6553665,536 bytes of data because "Total Length" field of [[internet protocol|IP]] header records the total size including the header and data. An IP header is at least 20 bytes long, so the maximum value for "Fragment Offset" is restricted to 8189, which leaves room for 3 bytes in the last fragment.

Because an IP internet can be connectionless, fragments from one [[network packet|packet]] may be interleaved with those from another at the destination. The "Identification field" uniquely identifies the fragments of a particular [[network packet|packet]].