🚀 go-pugleaf

I assume you know what "IP fragmentation" is, it is basucally used
to send IP packets which are larger then the data link maximum
packet (e.g. larger then Ethernet's 1500 bytes.

There are however many situations when certain fragmentation
methods can be used to cause DoS and to bypass firewalls,
packet filters and IDS.

There are also exploits that use IP fragmentation to evade
filtering and detection (e.g. :fragrouter" and "nmap"), and the
fragments of size <=16 bytes, are typical intrusion or mapping
attempts, a fragment of this size will not contain the full TCP
or UDP header, and a naive packet filter won't be able to determine
the true nature of the packet using only the giuven fragment, and
might pass it through.

FW-1 performs "virtual defragmentaton" whereby it will rassembly
the IP packet in order to perform meaningful sateful inspection,
and will timeout fragments if the entire packet was not succesfully
reassmbled within a given timeout period.

--
-----------------------------------------------------------------------
   Leonid Rosenboim     Visit:  http://www.masada2000.org/historical.html
       Consultant                Email: my first name at consultant dot com
            Why do they sterilize the needle for lethal injections?

" hans mayer " <mayer39@relay.bfl.at> wrote in message
news:1037006948.396083@bfl-ea1...
>
> hi all
>
> i installed checkpoint fw-1 ng fp2 on
> on sun blade 100 with solaris 8 with latest patch cluster
>
> i see a lot of entries with log-viewer in the info field:
>
> "14"  "11Nov2002"  " 8:53:37"  "log"  "drop"  " message Virtual
defragmentation error: Timeout ip_id 12807 ip_len 0 ip_offset 0
fragments_dropped 1 during_sec 60"
> "15"  "11Nov2002"  " 8:55:58"  "log"  "drop"  " message Virtual
defragmentation error: Timeout ip_id 45063 ip_len 0 ip_offset 0
fragments_dropped 1 during_sec 60"
> "16"  "11Nov2002"  " 8:57:17"  "log"  "drop"  " message Virtual
defragmentation error: Timeout ip_id 65287 ip_len 0 ip_offset 0
fragments_dropped 2 during_sec 60"
>
>
> any ideas where to tune ?
>
>
> --
> best regards from vienna           |
> hans                               |   mayer (at) relay.bfl.at_SPAM
>

hi Leonid 

thanks for reply.
i know what "IP fragmentation" is. 
i was only wondering, if this happens between 2 hosts, which are 
both in my LAN connected through firewall. 
of course, i didn't show src and dest-ip-adr in the example. 

best regards 
hans 

-- 

In article <newscache$roue5h$0h$1@lnews.actcom.co.il>,
Leonid Rosenboim <EDIT_THE_ADDRESS> wrote:
>I assume you know what "IP fragmentation" is, it is basucally used
>to send IP packets which are larger then the data link maximum
>packet (e.g. larger then Ethernet's 1500 bytes.
>
>There are however many situations when certain fragmentation
>methods can be used to cause DoS and to bypass firewalls,
>packet filters and IDS.
>
>There are also exploits that use IP fragmentation to evade
>filtering and detection (e.g. :fragrouter" and "nmap"), and the
>fragments of size <=16 bytes, are typical intrusion or mapping
>attempts, a fragment of this size will not contain the full TCP
>or UDP header, and a naive packet filter won't be able to determine
>the true nature of the packet using only the giuven fragment, and
>might pass it through.
>
>FW-1 performs "virtual defragmentaton" whereby it will rassembly
>the IP packet in order to perform meaningful sateful inspection,
>and will timeout fragments if the entire packet was not succesfully
>reassmbled within a given timeout period.
>
>--
>-----------------------------------------------------------------------
>   Leonid Rosenboim     Visit:  http://www.masada2000.org/historical.html
>       Consultant                Email: my first name at consultant dot com
>            Why do they sterilize the needle for lethal injections?
>
>" hans mayer " <mayer39@relay.bfl.at> wrote in message
>news:1037006948.396083@bfl-ea1...
>>
>> hi all
>>
>> i installed checkpoint fw-1 ng fp2 on
>> on sun blade 100 with solaris 8 with latest patch cluster
>>
>> i see a lot of entries with log-viewer in the info field:
>>
>> "14"  "11Nov2002"  " 8:53:37"  "log"  "drop"  " message Virtual
>defragmentation error: Timeout ip_id 12807 ip_len 0 ip_offset 0
>fragments_dropped 1 during_sec 60"
>> "15"  "11Nov2002"  " 8:55:58"  "log"  "drop"  " message Virtual
>defragmentation error: Timeout ip_id 45063 ip_len 0 ip_offset 0
>fragments_dropped 1 during_sec 60"
>> "16"  "11Nov2002"  " 8:57:17"  "log"  "drop"  " message Virtual
>defragmentation error: Timeout ip_id 65287 ip_len 0 ip_offset 0
>fragments_dropped 2 during_sec 60"
>>
>>
>> any ideas where to tune ?
>>
>>
>> --
>> best regards from vienna           |
>> hans                               |   mayer (at) relay.bfl.at_SPAM
>>
>
>