- \n
![\"Example](\"https:\/\/www.imperva.com\/learn\/wp-content\/uploads\/sites\/13\/2019\/01\/ip-fragmentation.jpeg\")
<\/dt>\n- Example of how an IP datagram is fragmented and reassembled<\/dd>\n<\/dl>\n<\/div>\n
How IP Fragmentation Works<\/h2>\n
IP fragmentation occurs when an IP packet exceeds the Maximum Transmission Unit (MTU) size for a network path. Routers must split the large packet into smaller fragments to be transmitted.<\/p>\n
The router divides the IP packet into fragments starting with offset 0. A header is added to each fragment containing:<\/p>\n
- \n
- Identification – Unique ID matching all fragments<\/li>\n
- Flags – Indicates first, middle, or last fragment<\/li>\n
- Offset – The fragment position within the original packet<\/li>\n<\/ul>\n
The destination host reassembles the fragments using the identification and offset fields. Fragments arrive out-of-order, so buffering allows reordering before reassembly.<\/p>\n
IP Fragmentation Attacks<\/h2>\n
Attackers abuse IP fragmentation to evade security controls and exploit vulnerable systems:<\/p>\n
- \n
- Disrupt reassembly – Sends malformed fragments that cause errors or crashes during the reassembly process, resulting in denial-of-service.<\/li>\n
- Bypass firewalls – Firewall rules are avoided by sending attacks in fragmented packets that are not inspected.<\/li>\n
- Target wireless networks – Fragmentation exacerbates security risks in wireless networks by interfering with integrity mechanisms and exposing data.<\/li>\n
- Overload resources – Large volumes of fragments can overwhelm network capacity and server resources.<\/li>\n
- Takedown websites – Fragmented attacks make web servers unavailable by consuming excessive resources or triggering crashes.<\/li>\n
- Evade detection – Malware and exploits are obfuscated by splitting across random fragment offsets to avoid signature detection.<\/li>\n
- Achieve denial-of-service (DoS) – Most fragmentation attacks aim to disrupt the availability of networks, systems, and services through different attack vectors.<\/li>\n<\/ul>\n
Types of Fragmentation Attacks<\/h2>\n
There are several specialized forms of fragmentation attacks, including:<\/p>\n
Teardrop Attack<\/h3>\n
Sends offset and size fields designed to overwrite the header during reassembly. This has the ability to crash many older systems.<\/p>\n
Bonk Attack<\/h3>\n
Uses a large fragment designed to crash systems attempting to allocate huge buffers during reassembly.<\/p>\n
Fragrouter Tool<\/h3>\n
Performs automated attacks by generating malicious traffic patterns and packet values.<\/p>\n
Jolt2 Attack<\/h3>\n
Sends invalid fragmentation flags triggering crashes in some Windows TCP\/IP implementations.<\/p>\n
Time-to-Live (TTL) Manipulation<\/h3>\n
Changes the IP TTL across fragments to interfere with TTL tracking during reassembly.<\/p>\n
Nestea Attack<\/h3>\n
Sets invalid high fragment offsets combined with very small fragment sizes to crash Linux systems.<\/p>\n
SMS of Death<\/h3>\n
Sends specially crafted ping packets that get fragmented, aiming to disable iPhone devices.<\/p>\n
Other generalized forms, like fragment injection, tiny fragments, overlapping fragments, etc., can crash or exploit different operating systems and devices.<\/p>\n
IP Fragmentation Attacks<\/h2>\n
Attackers abuse IP fragmentation to evade security controls and exploit vulnerable systems:<\/p>\n
Bypassing Firewalls<\/h3>\n
Many firewalls and IPS devices do not inspect fragmented packets, allowing attacks to pass through:<\/p>\n
- \n
- RULE 1: Allow Port 80<\/li>\n
- RULE 2: Block Malicious IP<\/li>\n<\/ul>\n
A fragmented attack packet from the malicious IP with a Port 80 fragment would be allowed since fragments are not reassembled.<\/p>\n
Targeting Fragment Reassembly<\/h3>\n
Attackers send malicious payloads hidden across fragmentation boundaries or fragments that overlap\/overwrite key protocol fields during reassembly.<\/p>\n
For example, a NOP sled can be split across multiple fragments to evade static signature detection.<\/p>\n
Evading Rate Limiting<\/h3>\n
Size and offset manipulation allows artificially inflating packet sizes to bypass rate limits.<\/p>\n
A 100-byte packet can become a 10,000-byte reassembled packet, overwhelming rate limiting quotas.<\/p>\n
Triggering Implementation Bugs<\/h3>\n
Fragmentation edge cases often contain vulnerabilities that get triggered through maliciously crafted fragments.<\/p>\n
Past issues include Windows kernel panics, Cisco router crashes, and Linux kernel panics due to fragments.<\/p>\n
Fragmentation Attack Methodology<\/h2>\n
Common techniques used in fragmentation attacks include:<\/p>\n
Tiny Fragments<\/h3>\n
Tiny 1-8 byte fragments are sent that are smaller than the header size. These can trigger implementation errors during reassembly.<\/p>\n
Overlapping Fragments<\/h3>\n
Fragments with overlapping offsets are sent to overwrite parts of the packet during reassembly.<\/p>\n
Invalid Flag Combinations<\/h3>\n
Setting invalid flags like multiple \u201cfirst fragments\u201d can expose flawed logic.<\/p>\n
Path MTU Discovery<\/h3>\n
Probing different MTU sizes determines the optimum fragment sizes for an attack.<\/p>\n
Offset Obfuscation<\/h3>\n
NOP sleds are split across random fragment offsets to avoid signature detection.<\/p>\n
Payload Obfuscation<\/h3>\n
Malicious code is sent across multiple reordered fragments with junk fragments interleaved to avoid scans.<\/p>\n
Detecting Fragmentation Attacks<\/h2>\n
Defending against fragmentation attacks involves:<\/p>\n
Stateful Inspection<\/h3>\n
Maintaining fragment state and validating fragment sequences helps prevent attacks.<\/p>\n
Size Thresholds<\/h3>\n
Blocking excessively small fragments protects against tiny fragment attacks.<\/p>\n
Overlapping Offset Detection<\/h3>\n
Blocks if fragments contain overlapping offsets.<\/p>\n
Internet Control Message Protocol (ICMP) Blackhole<\/h3>\n
Rate limit or block ICMP \u201cfragmentation needed\u201d messages used in PMUD attacks.<\/p>\n
Packet Reassembly and Inspection<\/h3>\n
Reassembling and inspecting packets allows for the identification of hidden attacks. But resource-intensive.<\/p>\n
Anomaly Detection<\/h3>\n
Analyze fragmented traffic patterns and block sudden spikes that may indicate attacks.<\/p>\n
Hardening Against Fragmentation Attacks<\/h2>\n
Here are measures to harden systems from fragmentation attacks:<\/p>\n
- \n
- Disable IP fragmentation on host systems unless absolutely required. Drop fragments using firewall rules.<\/li>\n
- Enable attack mitigations in operating systems like Windows IPEV2, Linux RPFilter, and BSD IPFW.<\/li>\n
- Keep firewalls, IPS, and host OS\/kernel patches up-to-date.<\/li>\n
- Block or rate limit tiny fragments, overlapping offsets, and abnormal combinations where possible.<\/li>\n
- For public-facing systems, consider blocking fragmented packets altogether.<\/li>\n
- For internal systems, allow fragmentation only for specified packet sizes and MAC addresses.<\/li>\n
- Use IPS systems capable of fragment reassembly and stateful inspection. Limit assembled packet sizes.<\/li>\n
- Monitor and analyze IP traffic patterns for abnormal fragmentation. Tune allowed parameters.<\/li>\n<\/ul>\n
Fragmentation in IPv6<\/h2>\n
IPv6 networks have built-in security enhancements that protect against fragmentation attacks:<\/p>\n
No Fragmentation by Routers<\/h3>\n
IPv6 routers do not fragment packets. Endpoints must determine MTU and set fragmentation.<\/p>\n
Fragment Header Deprecated<\/h3>\n
The IPv6 fragment header is being removed from core IPv6 due to exploitation risks.<\/p>\n
ICMPv6 Packet Too Big<\/h3>\n
Intermediate routers send this message back if packets exceed MTU. Hosts adjust size.<\/p>\n
Together, these make fragmentation attacks much harder on IPv6 networks.<\/p>\n