Re: tcp overlap

["Thomas H. Ptacek" <tqbf () pobox com>]

On 1/13/03 2:16 PM, "fr0ck9" <fr0ck9 () yahoo com> wrote:

> I know Thomas Ptacek from Secure Networks documented
> some findings that when an overlap occurs that the
> following list of OS respond accordingly.  Has anyone
> else verified this or have any insight?

I believe you're referring to the OS-dependant behavior of fragmentation
reassembly that Tim Newsham and I pointed out in our paper, which you can
find at

    http://www.aciri.org/vern/Ptacek-Newsham-Evasion-98.ps

I haven't heard any claims about inaccuracies, although the study does date
back a few years. When we wrote the paper, virtually no IDS even attempted
fragmentation reassembly.

---
Thomas H. Ptacek
Arbor Networks, Inc.