What does ip fragment reassembly do

Question

hi can someone pls tell me what is the meaning of ip reassembly mode in the global configuration where it gives a option for operating system.
i mean what does this option actually do.
can someone pls guide me.
regards
sebastan

Answer 1

When a datagram is fragmented by normal methods there is never any fragment overlap or overwrite. Where one fragment ends, the next fragment begins at the very next bit. And all operating system assemble these fragments exactly the same.
But fragments can and some times do overlap. One fragment might end at say byte 1400. The next fragment should begin at byte 1401, but on occasion you will have an overlap where that next fragment begins at byte 1399 or earlier. So long as both fragments have the exact same data for those bytes that overlap, then the packet will still be reassembled the same by all operating systems.
BUT if the 2 fragments have DIFFERENT data for that same area of the reassembled datagram, then we call this an overwrite. And each operating system can have a different way with how it deals with the overwrites and chooses which data to accept.
Say for example that the first fragment ended at byte 1400 and had "ab" at bytes 1399 and 1400.
The next fragment is an overwrite and begins and byte 1399 and has "xy" at bytes 1399 and 1400.
One operating system will reassemble these and end up with "ab", while another will reassemble and up with "xy".
Each operating system has their own method of determining whether it will be "ab" or "xy".
In fact there are about 8 different ways that these packets can be reassemmbled depending on how they were sent, how they overlap, and their offset order.
Hackers understand this and will use it to attempt to evade the sensor.
The hacker will determine the operating system of the end host and will then try to send his attack in such away so that the end host will see it as "ab" and get hacked, but the sensor reassemble it as "xy" and thinks there is nothing wrong.
It would be great if the sensor could reassemble the fragments and analyze them in ever one of the 8 possible ways that operating systems can reassemble them.
But this is too cpu and memory intensive for the sensor to be able to handle.
So instead of trying all 8 possibilities the users chooses the operating system that is the most common in their network. The sensor will then reassemble the fragments in the same method as that operating system.
Understand that this ONLY applies to Fragment OverWrites.
For normal fragments where one fragment ends and the next begins, and for fragment Overlaps where both fragments have the same data; this setting doesn't matter because all operating system will reassembly them the same way.
So if you are concerned about this, then you need to monitor for the fragment OverWrite alarm.
The operating system configuration only comes into play when the fragments OverWrite one another, and you will see the fragment OverWrite alarm being triggered.