Re: Fragmentation Attack

["David S. Miller" <davem@redhat.com>]

On Sun, 08 Feb 2004 15:12:36 -0600
Gandalf The White <gandalf@digital.net> wrote:

> The attack has ICMP, UDP and TCP.  If you were seeing a specific signature
> over and over again then I agree that it might be easy to block (depending
> on the firewall) ... But ... If someone were sending fragments destined for
> port 80 to your web server I don't see how you could differentiate between
> "real" fragments going to the web server and faked fragmentation requests.

In this day and age, and with all the headaches fragmentation causes
(either directly or indirectly via these resource consumption DoS's)
we may soon be reaching the point where only talking to sites doing
path-MTU discovery (yes, even for UDP) is a valid decision for a big
site.

This would solve the problem in a hurry.

For TCP I think people can do this today.  For UDP, what do you need fragmented
UDP for, DNS queries?  I think not for those types of usage, and even streaming
voice or whatever UDP uses chop up the datastream themselves spitting out a
non-fragmented time transmitted line of packets looking sort of ATM'ish.

Fragmented ICMP should just be blocked at firewall for people concerned about
this, I see no valid use of this.