Only if your rules are lax enough to allow IP headers with length
less than 20 bytes. It's good practice to toss/log/alarm all such packets.
E.g.
filter badhdr
not ip_datagram_length in (20..65535) alarm 8 fail; end
Rob
> An attacker can use a packet fragmentation technique to get a spoofed
> packet behind your filter rules by using a set of packet fragments that
> when separate would not trigger your rules, but when assembled would have
> a spoofed address.
--
Rob Peglar Network Systems Corporation
robp @
network .
com 7600 Boone Ave N. Mpls. MN 55428
612.391.1028 612.391.1358 (fax)
Follow-Ups:
References:
|
|
