Re: block CodeRed/Nimda at the firewall?

From: RainbowHat (nHiATlE_at_blSackholeP.mAit.edMu.invalid)
Date: 05/16/03 

Date: Fri, 16 May 2003 11:10:17 +0000 (UTC)

< D. Stussy

>1) UDP packets cannot be fragmented. Only TCP packets can.
     ~~~ ~~~ ~~~~
Wrong. All IP packets can be fragmented.

>2) Some TCP implementations may try fragmented packets before falling back to
     ~~~~ ~~~
     Most IP
>unfragmented ones. Furthermore, it's always possible that a packet may come
>over some link that has a different (smaller) MTU than the other links in that
>transmission and thus be fragmented. It's possible that your machine is left
>to do the reintegration....

"Fragmentation" is a concept of IP layer. TCP|UDP are another layer.
TCP have a concept of "Segmentation". TCP negotiate MSS (Maximum
Segment Size) at 3-way handshake. (Or use default smallest MSS if no
TCP MSS option.) UDP don't have this mechanism. UDP and ICMP large
echo/reply will be IP fragment. Some few cases that TCP will be IP
fragment as you described.

BTW there are PMTUD (Path MTU Discovery) capability. 

-- 
Regards, RainbowHat. To spoof or not to spoof, that is the IPv4 packet.
----+----1----+----2----+----3----+----4----+----5----+----6----+----7

Relevant Pages
Quantcast