Re: Re: Verified evasion in Snort

["Dave Korn" <davek_throwaway@xxxxxxxxxxx>]

anonpoet@xxxxxxxxxxxxxxx wrote:


> (Windows boxes don't seem to send out a frag time exceeded on
> anything other than the first fragment.)

  That's what the host requirements RFC demands:  see e.g. 
http://www.rfc-editor.org/rfc/rfc1122.txt

----------------------quote----------------------
 3.2.2 Internet Control Message Protocol -- ICMP

   [ ... snip ... ]

An ICMP error message MUST NOT be sent as the result of
         receiving:

   [ ... snip ... ]

         *    a non-initial fragment, or
----------------------quote----------------------

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today....