Re: Important Comments re: INtrusion Detection

[Darren Reed <darrenr () cyber com au>]

In some mail I received from tqbf () secnet com, sie wrote
> First off, a nit: overlapping fragments with inconsistant data are never
> going to be the valid output of a TCP/IP stack. I don't know that the same
> is true of all overlapping fragments. I used to be comfortable making
> claims like "this will never happen", but then I learned about Vern
> Paxson's work, and now I try to be more careful.

Wrong.  If you have asymetrical routing and different MTU's on each route
then it is possible.  Oh, it also requires path MTU discovery to be off.

Darren