Re: Cisco PIX bug, discussions (lenghty)

["Ryan Russell" <Ryan.Russell () sybase com>]

Some tests I and others on the FW-1 mailing list
have done suggest those statements are incorrect.
At least, it doesn't under all circumstances.

                         Ryan



> Firewall-1 v3.0 manual, p350:
>
> "Firewall-1 performs virtual packet reassembly, and does not send a packet
> until all it's fragments have been collected.  The algorithm used is
> stricter than the standard packet reassembly algorithm, and does not
permit
> overlays".
>
> So it would appear that at least one SMLI firewall on the market does
> defrag.  Of course this takes us back to the DoS attacks hinted at
> previously...
>
> -Euan.