Overlapping IP Fragmentation

Large payloads are often broken into smaller fragments before they traverse a network. Each fragment is assigned a header that contains the destination IP address and the reassembly order for the entire payload. If the reassembly order in the headers overlaps, operating systems overwrite fragments. Attackers can hide malicious payloads within one or more overlapping fragments, which helps attackers evade the firewalls, intrusion detection systems (IDSs), and intrusion prevention systems (IPSs) that only inspect one fragment, while allowing additional fragments to pass uninspected. However, this evasion technique is only effective if the overlapping fragments are reassembled by the target device in a way that the attacker intends. The majority of current firewalls, IDSs, and IPSs prevent this technique by inspecting every fragment.