Analyzing Fragmentation

Believe it or not, fragmentation is not really so complicated after you understand a little theory and get comfortable with the notation associated with it. Many times as a network analyst, in the process of examining TCPdump output, I have gone through the mental exercise of "what's wrong with this fragmentation?" It is more than an academic skill; it is required theory in your arsenal of knowledge to analyze traffic on your network and safeguard it against fragmentation types of exploits.

If you do discover some kind of genuine mutant fragmentation, you might experience an initial and well-deserved feeling of triumph. But, realize that the discovery is just the first step in unraveling the mystery. Next, you have to figure out what the intended purpose of the weird fragmentation is, and this is not always obvious. One common explanation is some kind of denial of service, either a degradation of service or an outright disabling of the target host. Other explanations are to evade detection or circumvent shunning by monitoring or filtering devices incapable of fragment reassembly. Take a look at what is happening on the network in general and the target host specifically to make your assessment.

Finally, if you think that your site is well-protected at the perimeter and you don't have a firewall or filtering router that is stateful, think again! With such a gaping hole, it is almost trivial for even an inexperienced intruder to bypass your weak defense.

Summary

Normal fragmentation involves separating and packaging the original datagram into new packets less than or equal to the size of a smaller MTU. Each new fragment becomes a packet of its own with a new IP header consisting of many cloned fields (IP numbers, IP identification number, and so on) from the IP header of the original unfragmented datagram. However, each new fragment will contain some unique identifying information such as the offset into the fragment train, the number of data bytes in the fragment, and whether more fragments follow. Malicious fragmentation comes in many different forms. Ultimately, the purpose might be a denial of service or an opportunity to sneak some traffic into a network that might normally block an unfragmented incarnation of this traffic. Some packet-filtering devices do not handle fragmentation well, if at all, allowing these fragments entry into the network. By having an appreciation and understanding of fragmentation, in general, you will be better able to detect malicious fragmentation and recognize normal fragmentation.

Chapter 4. ICMP

Internet Control Message Protocol (ICMP) was conceived as an innocuous method of reporting