Network Analysis Using Wireshark 2 Cookbook - Second Edition

Fragmentation-based attack

While it is normal to see IP fragments in the network, a malicious attacker can also use the fragmentation for DoS attacks. This attack is known as a Tiny Fragment Attack, where the attacker will send a large volume of tiny fragmented packets to the target host. Such tiny fragments need to be re-assembled by the target host, causing it to hit performance issues or other buffer overrun issues:

In the preceding screenshot, it can be seen that the capture fragments are of size 100 bytes; the attacker could use an even smaller size to trigger a DoS attack on the target host.

By default, Wireshark will reassemble any ...