Fragments

• Fragments are PITA

• If you cache them you open up a DoS on the firewall

• Reassembling is against the specification (RFC791)

• Different hosts have different behaviour w.r.t. reassembling overlapping packets

• Hard to deal with for IDS

Notes: