Re: Re: Verified evasion in Snort

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



anonpoet@xxxxxxxxxxxxxxx wrote:


> (Windows boxes don't seem to send out a frag time exceeded on
> anything other than the first fragment.)

  That's what the host requirements RFC demands:  see e.g. 
http://www.rfc-editor.org/rfc/rfc1122.txt

----------------------quote----------------------
 3.2.2 Internet Control Message Protocol -- ICMP

   [ ... snip ... ]

An ICMP error message MUST NOT be sent as the result of
         receiving:

   [ ... snip ... ]

         *    a non-initial fragment, or
----------------------quote----------------------

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today.... 




[Index of Archives]     [Linux Security]     [Netfilter]     [PHP]     [Yosemite News]     [Linux Kernel]

  Powered by Linux