Re: frag3: Fragmentation overlap

[Martin Roesch <roesch () sourcefire com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hey Paul,

It means that there are IP fragments on the network with offsets that  
fall within the data portion of another fragment.  It could be  
indicative of someone trying to evade your IDS by knowing how a  
target will explicitly put its fragments back together in the event  
of overlaps and guessing that the IDS isn't going to do it that way.   
This is a classic evasion scenario as described by Ptacek & Newsham[1].

It's either that, or (way more likely) a misconfigured NFS server or  
something of that ilk.  :)

      -Marty

[1] http://www.snort.org/docs/idspaper/

On Sep 25, 2006, at 1:02 PM, Paul Schmehl wrote:

> Can anyone explain exactly what this alert means?  (Other than the  
> fact that the packets are being fragmented and there is overlap?)   
> Is it the prelude to an attack?  A misconfigured host?
>
> Paul Schmehl (pauls () utdallas edu)
> Adjunct Information Security Officer
> The University of Texas at Dallas
> http://www.utdallas.edu/ir/security/
> ---------------------------------------------------------------------- 
> ---
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to  
> share your
> opinions on IT & business topics through brief surveys -- and earn  
> cash
> http://www.techsay.com/default.php? 
> page=join.php&p=sourceforge&CID=DEVDEV________________________________ 
> _______________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

- --
Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
Sourcefire - Security for the Real World - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)

iD8DBQFFGCBUqj0FAQQ3KOARAmd5AJ4u/Arq2jSkOKqAmmM47mVCP8ov8wCfSN0S
fZRtW56qp+n0mLpNmlf+AE8=
=ujTI
-----END PGP SIGNATURE-----

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users