Re: TCP small fragments

[Vern Paxson <vern@icir.org>]

> The point I was trying to make is that it is a malformed 
> packet and IMHO, all malformed packets are suspicious.

This is a nice theory, but unfortunately fails in practice.  See the section
"Crud Seen on a DMZ" in my paper on Bro ("Bro: A System for Detecting Network
Intruders in Real-Time", http://www.icir.org/vern/papers/bro-CN99.html),
where, among other sorts of weird-but-benign traffic, I mention:

	* IP fragments in which the initial fragment is very small and the
	  final fragment is large.  Such fragments can be used to attempt
	  to circumvent firewalls and monitors that do not do fragment
	  reassembly.

These had the TCP header split across two fragments.  They were sent by
Cray supercomputers, I believe - for no good reason, and apparently due to
problems with MTU determination in the presence of TCP options.  So, yes,
these reflect something broken, but the problem is that in a large-scale
operational environment there is a *lot* of such crud, so you generally
can't afford to alarm on it.

		Vern