A network security team investigates an incident where an internal server crashed due to an IP fragmentation reassembly attack (Teardrop attack). Although an out-of-band Network Intrusion Detection System (NIDS) was actively monitoring traffic via a switch SPAN port with up-to-date threat signatures, it generated no alerts during the attack. Subsequent packet capture analysis reveals that the attacker intentionally transmitted overlapping IPv4 fragments with inconsistent offset values. Which of the following statements correctly explain why the passive NIDS failed to trigger an alert, and which architectural adjustment would directly prevent this evasion technique? (Select TWO)
- The passive NIDS reassembled the overlapping fragments using different OS-specific reassembly logic than the target server host, causing the NIDS to inspect a harmless payload stream while the host reassembled a malicious one.Answer
- BReconfiguring the switch SPAN port to mirror traffic at Layer 3 instead of Layer 2 forces the switch to strip malformed fragment headers before mirroring data to the NIDS sensor.
- Deploying an inline Network Intrusion Prevention System (NIPS) capable of active packet normalization to reassemble, defragment, and sanitize traffic before it reaches target servers.Answer
- DUpdating the NIDS signature matching engine to inspect TCP port 23 fragment offset fields, allowing the passive sensor to issue automated TCP RST packets back to the source IP.
Answer
The NIDS failed to alert because passive sensors may utilize a different IP fragment reassembly algorithm (operating system target policy) than the target host, allowing overlapping fragments to construct a benign payload on the NIDS while forming a crash-inducing payload on the host. To directly resolve this evasion vulnerability, the organization should deploy an inline NIPS with packet normalization capabilities, which actively defragments, cleans, and sanitizes IP fragment streams before delivering packets to the host.
Passive out-of-band NIDS sensors process duplicated traffic via SPAN/TAP ports and must maintain target host operating system profile policies to reassemble IP fragments accurately. When fragment overlaps occur, an OS-policy mismatch between the NIDS engine and the destination host allows malformed payloads to bypass NIDS signature engines undetected. Replacing or supplementing this with an inline Network Intrusion Prevention System (NIPS) configured for packet normalization resolves the vulnerability by actively enforcing uniform fragment reassembly and dropping illegal overlapping offset sequences before they reach internal endpoints.
Step-by-Step Solution
Key Concept
IP Fragmentation Evasion Ambiguity and NIPS Packet Normalization