Symantec™ Security Gateways Reference Guide - Sawmill

IDS eventsDenial-of-Service297Fragmentation AttackBase Event:Details:Response:Affected:IP_FRAG_NOMATCHTwo overlapping fragments were found to have different data in the overlapping region. This mayindicate a possible attempt to evade detection or filtering by a security device. Tools like“fragrouter” are used by an attacker to fragment their attacks such that some security devices willnot properly reassemble the packets.If seen in sufficient volume or variation, audit of client and server is recommended.No specific targets.False Positives: None known.Fragmentation AttackBase Event:Details:Response:Affected:IP_FRAG_ODDLENGTHAn IP fragment was detected with an invalid fragment length. This may indicate a fragmentationdenial-of-service attack that is known to crash some operating system network stacks.Response to this attack typically includes applying a patch from the vendor to fix the vulnerabilityon the victim system. Since the source address is usually forged it is not possible to locate theattacker by examining the attack packets.No specific targets.False Positives: None known.Fragmentation AttackBase Event:Details:Response:Affected:IP_FRAG_OVERDROP1An “overdrop” attack was detected. An “overdrop” attack involves an attacker sending oversized IPpackets. This triggers a bug in the victim systems which can cause performance problems.The IP_FRAG_OVERDROP1 event corresponds to detecting that a fragmented datagram wouldreassemble to a IPV4 datagram larger than 65535 bytes by sending a single fragment whose offsetand payload size would simply add up to be larger than 65535.Response to this attack typically includes applying a patch from the vendor to fix the vulnerabilityon the victim system.No specific targets.False Positives: None known.Fragmentation AttackBase Event:Details:IP_FRAG_OVERDROP2An “overdrop” attack was detected. An “overdrop” attack involves an attacker sending oversized IPpackets. This triggers a bug in the victim systems which can cause performance problems.The IP_FRAG_OVERDROP2 event corresponds to detecting that fragments received wouldreassemble to a IPV4 datagram larger than 65535 bytes by sending out of order fragments suchthat the IP header of the reassembled datagram contains options, making the IP header larger thanthe standard 20 bytes allowed for average IP headers, and that this in conjunction with fragmentsalready received would reassemble into a datagram larger than 65535 bytes.