In some mail from Alex Filacchione, sie said:
[...]
> This leads me to something else...
>
> Anyone know which software will let you (all? None?) assemble the
> fragmented packets AT the firewall (in a cache of sorts) or gateway, and
> then examine them and subject them to normal filtering rules?
Packet filters (ie routers) should not be trying to reassemble packets.
Problem: two routers are passing packets to each other and have n-1 fragments
in their cache and their buffers are full. They can't dequeue all the
fragments because they don't have them all. It is well known if you send
a machine too many fragments, it'll lock up (run out of buffer space),
why make it worse fo routers ?
darren
References:
|
|
