Re: Important Comments re: INtrusion Detection

[tqbf () secnet com]

> > First off, a nit: overlapping fragments with inconsistant data are never
                                            ^^^^^^^^^^^^^^^^^^^^^^                                      
> > going to be the valid output of a TCP/IP stack.             

Note underlined text.

> > I don't know that the same
      ^^^^^
        
> > is true of all overlapping fragments. 
               ^^^

Note underlined text.

> Wrong.  If you have asymetrical routing and different MTU's on each route
> then it is possible.  Oh, it also requires path MTU discovery to be off.

You're saying that it's possible to get fragments which overlap and which
have inconsistant data in normal traffic? How?

-----------------------------------------------------------------------------
Thomas H. Ptacek                                        Secure Networks, Inc.
-----------------------------------------------------------------------------
http://www.enteract.com/~tqbf                           "mmm... sacrilicious"