Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
IP fragmentation attack
open-in-new
<h2 id="process">Process</h2> <p>IP packets are encapsulated in datalink frames, and, therefore, the link MTU affects larger IP <a href="/facts/Network_packet/xCYf8SJu">packets</a> and forces them to be split into pieces equal to or smaller than the MTU size. </p><p>This can be accomplished by several approaches: </p> <ul><li>To set the IP <a href="/facts/Network_packet/xCYf8SJu">packet</a> size equal or smaller than the directly attached medium and delegate all further fragmentation of packets to routers, meaning that routers decide if the current packet should be re-fragmented or not. This offloads a lot of work on to routers, and can also result in packets being segmented by several IP routers one after another, resulting in very peculiar fragmentation.</li> <li>To preview all links between source and destination and select the smallest MTU in this route, assuming there is a unique route. This way we make sure that the fragmentation is done by the sender, using a packet-size smaller than the selected MTU, and there is no further fragmentation en route. This solution, called <a href="/facts/Path_MTU_Discovery/0SyST1ms">Path MTU Discovery</a>, allows a sender to fragment/segment a long <a href="/facts/Internet/Xw1rVvJU">Internet</a> <a href="/facts/Packet_(information_technology)/xCYf8SJu">packet</a>, rather than relying on routers to perform IP-level fragmentation. This is more efficient and more scalable. It is therefore the recommended method in the current Internet. The problem with this approach is that each packet is routed independently; they may well typically follow the same route, but they may not, and so a probe packet to determine fragmentation may follow a path different from paths taken by later packets.</li></ul> <p>Three fields in the <a href="/facts/IPv4/bnQ5MEqm">IP header</a> are used to implement fragmentation and reassembly. The "Identification", "Flags" and "Fragment Offset" fields. </p> IPv4 Header Format<table><tbody><tr><th><i>Offsets</i></th><th><a href="/facts/Octet_(computing)/dqCHsuUF">Octet</a></th><th colspan="8">0</th><th colspan="8">1</th><th colspan="8">2</th><th colspan="8">3</th></tr><tr><th><a href="/facts/Octet_(computing)/dqCHsuUF">Octet</a></th><th><a href="/facts/Bit/S972NSaD">Bit</a></th><th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>10</th><th>11</th><th>12</th><th>13</th><th>14</th><th>15</th><th>16</th><th>17</th><th>18</th><th>19</th><th>20</th><th>21</th><th>22</th><th>23</th><th>24</th><th>25</th><th>26</th><th>27</th><th>28</th><th>29</th><th>30</th><th>31</th></tr><tr><th>0</th><th>0</th><td colspan="4"><a href="/facts/IPv4/bnQ5MEqm">Version</a></td><td colspan="4"><a href="/facts/IPv4/bnQ5MEqm">IHL</a></td><td colspan="6"><a href="/facts/IPv4/bnQ5MEqm">DSCP</a></td><td colspan="2"><a href="/facts/IPv4/bnQ5MEqm">ECN</a></td><td colspan="16"><a href="/facts/IPv4/bnQ5MEqm">Total Length</a></td></tr><tr><th>4</th><th>32</th><td colspan="16"><a href="/facts/IPv4/bnQ5MEqm">Identification</a></td><td colspan="3"><a href="/facts/IPv4/bnQ5MEqm">Flags</a></td><td colspan="13"><a href="/facts/IPv4/bnQ5MEqm">Fragment Offset</a></td></tr><tr><th>8</th><th>64</th><td colspan="8"><a href="/facts/IPv4/bnQ5MEqm">Time To Live</a></td><td colspan="8"><a href="/facts/IPv4/bnQ5MEqm">Protocol</a></td><td colspan="16"><a href="/facts/IPv4/bnQ5MEqm">Header Checksum</a></td></tr><tr><th>12</th><th>96</th><td colspan="32"><a href="/facts/IPv4/bnQ5MEqm">Source IP Address</a></td></tr><tr><th>16</th><th>128</th><td colspan="32"><a href="/facts/IPv4/bnQ5MEqm">Destination IP Address</a></td></tr><tr><th>20</th><th>160</th><td colspan="32" rowspan="4"><a href="/facts/IPv4/bnQ5MEqm">Options</a> (if IHL > 5)</td></tr><tr><th>24</th><th>192</th></tr><tr><th>28</th><th>224</th></tr><tr><th>32</th><th>256</th></tr></tbody></table> <p>Flags: </p> A 3 bit field which says if the packet is a part of a fragmented <a href="/facts/Data_frame/ltGCbJIq">data frame</a> or not. Bit 0: reserved, must be zero (unless packet is adhering to RFC 3514) Bit 1: (AF) 0 = May Fragment, 1 = Don't Fragment. Bit 2: (AF) 0 = Last Fragment, 1 = More Fragments. <table><tbody><tr><th>Bit</th><th>0</th><th>1</th><th>2</th><th>3</th><th>4</th><th>5</th><th>6</th><th>7</th><th>8</th><th>9</th><th>10</th><th>11</th><th>12</th><th>13</th><th>14</th><th>15</th></tr><tr><th>Field</th><td>0</td><td>DF</td><td>MF</td><td colspan="13">Fragment Offset</td></tr></tbody></table> <p>Fragment Offset specifies the fragment's position within the original packet, measured in 8-byte units. </p><p>Accordingly, every fragment except the last must contain a multiple of 8 bytes of data. It is obvious that Fragment Offset can hold 8192 (2^13) units but the <a href="/facts/Network_packet/xCYf8SJu">packet</a> can't have 8192 * 8 = 65,536 bytes of data because "Total Length" field of <a href="/facts/Internet_Protocol/Qq6VeEal">IP</a> header records the total size including the header and data. An IP header is at least 20 bytes long, so the maximum value for "Fragment Offset" is restricted to 8189, which leaves room for 3 bytes in the last fragment. </p><p>Because an IP internet can be connectionless, fragments from one <a href="/facts/Network_packet/xCYf8SJu">packet</a> may be interleaved with those from another at the destination. The "Identification field" uniquely identifies the fragments of a particular <a href="/facts/Network_packet/xCYf8SJu">packet</a>. </p><p>The source system sets "Identification" field in each <a href="/facts/Network_packet/xCYf8SJu">packet</a> to a unique value for all <a href="/facts/Network_packet/xCYf8SJu">packets</a> which use the same source IP address, destination IP address, and "Protocol" values, for the lifetime of the <a href="/facts/Network_packet/xCYf8SJu">packet</a> on the internet. This way the destination can distinguish which incoming fragments belong to a unique <a href="/facts/Network_packet/xCYf8SJu">packet</a> and buffer all of them until the last fragment is received. The last fragment sets the "More Fragment" bit to 0 and this tells the receiving station to start reassembling the data if all fragments have been received. </p><p>The following is a real-life fragmentation example: </p><p>The following was obtained using the <a href="/facts/Wireshark/tTRY1DJr">Ethereal</a> protocol analyzer to capture <a href="/facts/ICMP/sUvo3J3y">ICMP</a> <a href="/facts/Echo_request/BoyaWck6">echo request</a> packets. To simulate this open up a terminal and type ping ip_dest -n 1 -l 65000. </p><p>The results are as follows: </p> No. Time Source Destination Protocol Info 1 0.000000 87.247.163.96 66.94.234.13 ICMP Echo (ping) request 2 0.000000 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=1480) 3 0.002929 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=2960) 4 6.111328 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=4440) 5 6.123046 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=5920) 6 6.130859 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=7400) 7 6.170898 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=8880) 8 6.214843 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=10360) 9 6.239257 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=11840) 10 6.287109 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=13320) 11 6.302734 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=14800) 12 6.327148 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=16280) 13 6.371093 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=17760) 14 6.395507 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=19240) 15 6.434570 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=20720) 16 6.455078 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=22200) 17 6.531250 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=23680) 18 6.550781 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=25160) 19 6.575195 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=26640) 20 6.615234 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=28120) 21 6.634765 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=29600) 22 6.659179 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=31080) 23 6.682617 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=32560) 24 6.699218 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=34040) 25 6.743164 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=35520) 26 6.766601 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=37000) 27 6.783203 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=38480) 28 6.806640 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=39960) 29 6.831054 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=41440) 30 6.850586 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=42920) 31 6.899414 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=44400) 32 6.915039 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=45880) 33 6.939453 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=47360) 34 6.958984 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=48840) 35 6.983398 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=50320) 36 7.023437 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=51800) 37 7.046875 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=53280) 38 7.067382 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=54760) 39 7.090820 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=56240) 40 7.130859 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=57720) 41 7.151367 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=59200) 42 7.174804 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=60680) 43 7.199218 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=62160) 44 7.214843 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=63640) 45 7.258789 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=65120) The first packet details: No.Time Source Destination Protocol Info 1 0.000000 87.247.163.96 66.94.234.13 ICMP Echo (ping) request Frame 1 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: OmronTat_00:00:00 (00:00:0a:00:00:00), Dst: 40:0f:20:00:0c:00 (40:0f:20:00:0c:00) Internet Protocol, Src: 87.247.163.96 (87.247.163.96), Dst: 66.94.234.13 (66.94.234.13) Internet Control Message Protocol Type: 8 (Echo (ping) request) Code: 0 Checksum: 0x6b7d Identifier: 0x0600 Sequence number: 0x0200 Data (1472 bytes) The second packet details: No. Time Source Destination Protocol Info 2 0.000000 87.247.163.96 66.94.234.13 IP Fragmented IP protocol (proto=ICMP 0x01, off=1480) Frame 2 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: OmronTat_00:00:00 (00:00:0a:00:00:00), Dst: 40:0f:20:00:0c:00 (40:0f:20:00:0c:00) Internet Protocol, Src: 87.247.163.96 (87.247.163.96), Dst: 66.94.234.13 (66.94.234.13) Data (1480 bytes) <p>Note that only the first fragment contains the ICMP header and all remaining fragments are generated without the ICMP header. </p><p>Two important points here: </p> <ul><li>In some datalink protocols such as Ethernet, only the first fragment contains the full upper layer header, meaning that other fragments look like beheaded <a href="/facts/Network_packet/xCYf8SJu">packets</a>.</li> <li>Additional overhead imposed over network because all fragments contains their own IP header. Additional overhead = (number_of_fragments - 1) * (ip_header_len);</li></ul> <h2 id="exploits">Exploits</h2> IP fragment overlapped The IP fragment overlapped <a href="/facts/Exploit_(computer_security)/EdlqsRJM">exploit</a> occurs when two fragments contained within the same IP <a href="/facts/Network_packet/xCYf8SJu">packet</a> have offsets that indicate that they overlap each other in positioning within the <a href="/facts/Network_packet/xCYf8SJu">packet</a>. This could mean that either fragment A is being completely overwritten by fragment B, or that fragment A is partially being overwritten by fragment B. Some operating systems do not properly handle fragments that overlap in this manner and may throw exceptions or behave in other undesirable ways upon receipt of overlapping fragments. This is the basis for the <a href="/facts/Teardrop_attack/6nkoK02J">teardrop attack</a>. Overlapping fragments may also be used in an attempt to bypass Intrusion Detection Systems. In this exploit, part of an attack is sent in fragments along with additional random data; future fragments may overwrite the random data with the remainder of the attack. If the completed <a href="/facts/Network_packet/xCYf8SJu">packet</a> is not properly reassembled at the IDS, the attack will go undetected. IP fragmentation buffer full The IP fragmentation buffer full exploit occurs when there is an excessive amount of incomplete fragmented traffic detected on the protected network. This could be due to an excessive number of incomplete fragmented <a href="/facts/Network_packet/xCYf8SJu">packets</a>, a large number of fragments for individual <a href="/facts/Network_packet/xCYf8SJu">packets</a> or a combination of quantity of incomplete <a href="/facts/Network_packet/xCYf8SJu">packets</a> and size/number of fragments in each <a href="/facts/Network_packet/xCYf8SJu">packet</a>. This type of traffic is most likely an attempt to bypass security measures or <a href="/facts/Intrusion_Detection_Systems/mAw24Fyo">Intrusion Detection Systems</a> by intentional fragmentation of attack activity. IP fragment overrun The IP Fragment Overrun exploit is when a reassembled fragmented <a href="/facts/Network_packet/xCYf8SJu">packet</a> exceeds the declared IP data length or the maximum <a href="/facts/Network_packet/xCYf8SJu">packet</a> length. By definition, no IP packet should be larger than 65,535 bytes. Systems that try to process these large <a href="/facts/Network_packet/xCYf8SJu">packets</a> can crash, and can be indicative of a denial of service attempt. IP fragment too many packets The "Too Many Packets" exploit is identified by an excessive number of incomplete fragmented <a href="/facts/Network_packet/xCYf8SJu">packet</a> detected on the network. This is usually either a denial of service attack or an attempt to bypass security measures. An example of "Too Many Packets", "Incomplete Packet" and "Fragment Too Small" is the Rose Attack.<a class="footnote-ref" id="fnref:3" href="#fn:3"><sup>3</sup></a> IP fragment incomplete packet This exploit occurs when a <a href="/facts/Network_packet/xCYf8SJu">packet</a> can not be fully reassembled due to missing data. This can indicate a denial of service attack or an attempt to defeat packet filter security policies. IP Fragment Too Small If an IP fragment is too small it indicates that the fragment is likely intentionally crafted. Any fragment other than the final fragment that is less than 400 bytes could be considered too small. Small fragments may be used in denial of service attacks or in an attempt to bypass security measures or detection. <h2 id="fragmentation-for-evasion">Fragmentation for evasion</h2> <p>Network infrastructure equipment such as <a href="/facts/Router_(computing)/Nh5cIyVf">routers</a>, <a href="/facts/Load_balancing_(computing)/jddk6ang">load-balancers</a>, <a href="/facts/Firewall_(computing)/Et2RkJaU">firewalls</a> and <a href="/facts/Intrusion_detection_system/mAw24Fyo">IDS</a> have inconsistent visibility into fragmented packets. For example, a device may subject the initial fragment to rigorous inspection and auditing, but might allow all additional fragments to pass unchecked. Some attacks may use this fact to evade detection by placing incriminating payload data in fragments. Devices operating in <a href="/facts/Proxy_server/ArhwQE74">"full" proxy mode</a> are generally not susceptible to this subterfuge. </p> <h2 id="external-links">External links</h2> <ul><li><a href="http://kohala.com/start/">W. Richard Stevens' Home Page</a></li> <li>RFC <a href="https://datatracker.ietf.org/doc/html/rfc1858">1858</a></li> <li>RFC <a href="https://datatracker.ietf.org/doc/html/rfc791">791</a></li></ul> <h2 id="references">References</h2> <ol> <li id="fn:1"><p>Kurose, James F. (2013). Computer Networking: A Top-down Approach. Ross, Keith W., 1956- (6th ed.). Boston: Pearson. p. 338. ISBN 9780132856201. OCLC 769141382. <a href="9780132856201" target="_blank">9780132856201</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li> <li id="fn:2"><p>Kurose, James F. (2013). Computer Networking: A Top-down Approach. Ross, Keith W., 1956- (6th ed.). Boston: Pearson. p. 338. ISBN 9780132856201. OCLC 769141382. <a href="9780132856201" target="_blank">9780132856201</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li> <li id="fn:3"><p>Hollis, Ken. "The Rose Fragmentation Attack Explained". Archived from the original on 2012-02-24. Retrieved 2013-11-25. <a href="https://web.archive.org/web/20120224113108/http://www.digital.net/~gandalf/Rose_Frag_Attack_Explained.htm" target="_blank">https://web.archive.org/web/20120224113108/http://www.digital.net/~gandalf/Rose_Frag_Attack_Explained.htm</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li> </ol>