🚀 go-pugleaf

hi Leonid 

thanks for reply.
i know what "IP fragmentation" is. 
i was only wondering, if this happens between 2 hosts, which are 
both in my LAN connected through firewall. 
of course, i didn't show src and dest-ip-adr in the example. 

best regards 
hans 

-- 

In article <newscache$roue5h$0h$1@lnews.actcom.co.il>,
Leonid Rosenboim <EDIT_THE_ADDRESS> wrote:
>I assume you know what "IP fragmentation" is, it is basucally used
>to send IP packets which are larger then the data link maximum
>packet (e.g. larger then Ethernet's 1500 bytes.
>
>There are however many situations when certain fragmentation
>methods can be used to cause DoS and to bypass firewalls,
>packet filters and IDS.
>
>There are also exploits that use IP fragmentation to evade
>filtering and detection (e.g. :fragrouter" and "nmap"), and the
>fragments of size <=16 bytes, are typical intrusion or mapping
>attempts, a fragment of this size will not contain the full TCP
>or UDP header, and a naive packet filter won't be able to determine
>the true nature of the packet using only the giuven fragment, and
>might pass it through.
>
>FW-1 performs "virtual defragmentaton" whereby it will rassembly
>the IP packet in order to perform meaningful sateful inspection,
>and will timeout fragments if the entire packet was not succesfully
>reassmbled within a given timeout period.
>
>--
>-----------------------------------------------------------------------
>   Leonid Rosenboim     Visit:  http://www.masada2000.org/historical.html
>       Consultant                Email: my first name at consultant dot com
>            Why do they sterilize the needle for lethal injections?
>
>" hans mayer " <mayer39@relay.bfl.at> wrote in message
>news:1037006948.396083@bfl-ea1...
>>
>> hi all
>>
>> i installed checkpoint fw-1 ng fp2 on
>> on sun blade 100 with solaris 8 with latest patch cluster
>>
>> i see a lot of entries with log-viewer in the info field:
>>
>> "14"  "11Nov2002"  " 8:53:37"  "log"  "drop"  " message Virtual
>defragmentation error: Timeout ip_id 12807 ip_len 0 ip_offset 0
>fragments_dropped 1 during_sec 60"
>> "15"  "11Nov2002"  " 8:55:58"  "log"  "drop"  " message Virtual
>defragmentation error: Timeout ip_id 45063 ip_len 0 ip_offset 0
>fragments_dropped 1 during_sec 60"
>> "16"  "11Nov2002"  " 8:57:17"  "log"  "drop"  " message Virtual
>defragmentation error: Timeout ip_id 65287 ip_len 0 ip_offset 0
>fragments_dropped 2 during_sec 60"
>>
>>
>> any ideas where to tune ?
>>
>>
>> --
>> best regards from vienna           |
>> hans                               |   mayer (at) relay.bfl.at_SPAM
>>
>
>