IP: Option in Fragment

This protocol anomaly triggers when it detects an IP fragment with an IP option that indicates a non-zero fragment offset. Because some IP options are dangerous (and others have only limited use), you may choose to drop these packets.

Extended Description

Any fragmented TCP/IP packet that fails to have the proper fields correctly set constitutes a protocol anomaly. Detecting this condition could be the result of a network configuration error, or that a denial of service attack involving the injection of malformed TCP/IP datagrams is underway.

References

URL: http://www.rhyshaden.com/ipdgram.htm

Short Name

IP:OPTERR:INVALID-INFRAGMENT

Severity

Minor

Recommended

True

Recommended Action

None

IP: Option in Fragment

Extended Description

References

Found a potential security threat?