Bugtraq mailing list archives
Re: Re: Verified evasion in Snort
From: "Dave Korn" <davek_throwaway () hotmail com>
Date: Fri, 3 Feb 2006 15:03:53 -0000
anonpoet () inconnu isu edu wrote:
(Windows boxes don't seem to send out a frag time exceeded on anything other than the first fragment.)
That's what the host requirements RFC demands: see e.g. http://www.rfc-editor.org/rfc/rfc1122.txt ----------------------quote---------------------- 3.2.2 Internet Control Message Protocol -- ICMP [ ... snip ... ] An ICMP error message MUST NOT be sent as the result of receiving: [ ... snip ... ] * a non-initial fragment, or ----------------------quote---------------------- cheers, DaveK -- Can't think of a witty .sigline today....
Current thread:
- Re: Verified evasion in Snort Thierry Zoller (Feb 01)
- <Possible follow-ups>
- Re: Verified evasion in Snort mwatchinski (Feb 01)
- Re: Re: Verified evasion in Snort anonpoet (Feb 02)
- Re: Re: Verified evasion in Snort Dave Korn (Feb 03)