more fragment fun

Should we consider 3a part of the data stream “USER root”?

Or is 3b part of the data stream? “USER foot”!

-- If the OS makes a different decision than the monitor: Bad.

-- Even worse: Different OS’s have different protocol interpretations,

so it’s impossible for Bro to agree with all of them

1.

2.

3b.

4.

Imagine an attacker sends:

3a.

Seq. #

Time

Previous slide

Next slide

Back to first slide

View graphic version