| Packet fragmentation is allowed by the TCP/IP specifications and is encouraged in situations where it is needed. However, packet fragmentation has been used to make some attacks harder to detect (by placing them within fragmented packets), and unusual fragmentation has also been used as a form of attack. For example, some network-based attacks have used packets that should not exist in normal communications, such as sending some fragments of a packet but not the first fragment, or sending packet fragments that overlap each other. This latter case, known as the Overlapping Fragment Attack, attempts to “trick” the firewall by overwriting part of the TCP header information of the first fragment, which contained data that was allowed to pass through the firewall, with malicious data in subsequent fragments. A common use of this is to overwrite the destination port number to change the type of service which would not be allowed to pass the router in normal circumstances.
The capability to properly reassemble incoming fragmented packets before configured policies are applied to them can be verified by acceptance/validation processes in DoD or other government agencies. This would be verified, in part, by validation testing. If the device cannot properly reassemble packets before configured policies are applied to them, it must be configured to drop fragmented packets. |
