What is an IP Fragmentation Attack? Types & Prevention

Have you ever had trouble accessing a website? Amongst a few possible causes, one reason could be a cyberattack. Hackers are known to have an arsenal of tools to intercept and disrupt communication, and one particular way is by interfering with how an IP transfers information to the end user.

IP Fragmentation Attacks aren’t anything new. Internet Service Providers and webmasters alike have been coming up with ways to prevent it, but many hackers still resort to such means to interfere with a safe browsing experience. 

In order to understand what an IP Fragmentation Attack is and how it happens, we have to understand a few different concepts. Read on to learn how to protect yourself from becoming a victim of cybercrime. 

What is packet switching?

Since data is sent in IP packets, and such packets are of a specific size.  Patching switching can occur on connection-based means and connectionless platforms alike. 

A connection-based packet switching means that data is delivered and received in a specific order, which allows for a pathway for communication to be established prior to any transfer of data.

Connectionless packet switching, on the other hand, is when every packet is delivered independently instead of in a particular order. Consider it like sending items randomly, instead of in a queue. 

These out-of-queue packets are called datagrams and can travel in all sorts of undetermined, random orders. Since this form is much less structured than that of a connection-based method, datagrams can be used to attack or target servers. 

What is fragmentation?

Diving a datagram into smaller pieces of information packets is IP fragmentation. In order for a successful transfer and procession, these are usually of a very specific size. Before the receiver can look into the data they received, they must re-assemble the packets into order so that the information makes sense. If a datagram is too big to properly process or arrange, the user can re-fragment the packet for their own convenience. 

What is an IP fragmentation attack?

An IP fragmentation attack is a Denial of Service (DoS) attack that uses IP fragmentation to disrupt how the datagrams are being fragmented. This is to distrupt the running of web services, disable websites, or overload the network to make it inaccessible to users and visitors alike. 

The end goal is to stop a server from functioning how it is meant to and to stop traffic from ever reaching the website. There are many different forms of such attacks, but they most typically involve disrupting the flow of datagrams and rearranging them to make them near impossible to reassemble for actual use.

Why Do Attackers Use IP Fragmentation?

Attackers do not fragment packets by accident. They fragment them on purpose, because doing so gives them four distinct advantages over a target network. There are four reasons why the attackers use IP fragmentation:

1. The first is evading detection. Many firewalls and intrusion detection systems inspect packets as they arrive, but some do not reassemble fragments before running that inspection. A malicious payload split across several fragments can slip past these systems undetected, then reassemble into its full form once it reaches the target.

2. The second is exhausting server resources. Reassembling fragmented packets takes memory and processing power. By sending large volumes of fragments, some incomplete or deliberately malformed, attackers force the target system to hold data in memory while it waits for fragments that never arrive, or tries to make sense of fragments that cannot be reassembled at all.

3. The third is exploiting flaws in how operating systems and network devices handle fragmentation. Older systems in particular have shown weaknesses in their reassembly logic, and a well-crafted fragment sequence can trigger crashes, freezes, or unpredictable behavior.

4. The fourth is bypassing security checks on wireless networks, where fragmentation is sometimes used to slip past access controls that were not built to inspect fragmented traffic closely.

Types of an IP Fragmentation Attack

IP fragmentation attacks take several forms, each exploiting a different part of the fragmentation and reassembly process. Below are the attack types that fall directly under this category, followed by the tools attackers commonly use to carry them out.

1. Tiny Fragment Attack

In a tiny fragment attack, the attacker sends fragments so small that critical header information, such as port numbers, gets pushed into a second fragment. Some firewalls only inspect the first fragment against their filtering rules, so a malicious packet split this way can pass through without the full header ever being checked.

2. UDP and ICMP Fragmentation Attack

These attacks flood a target with oversized or malformed UDP and ICMP packets. Since the target cannot reassemble them properly, it spends resources trying to process them anyway, which eventually overwhelms the system and disrupts normal traffic handling.

3. Teardrop Attack

A teardrop attack sends fragments with overlapping offset values, so the fragments do not line up correctly during reassembly. Systems that cannot handle this overlap crash or freeze. This attack was especially effective against older Windows operating systems, where flawed reassembly code made it a reliable method of disruption in the late 1990s.

4. Bonk Attack

A variation on the teardrop attack, a bonk attack targets UDP packets specifically, sending fragments with conflicting offset and length values. Vulnerable systems become unstable or crash while trying to process the corrupted data.

5. Nestea Attack

The nestea attack is another teardrop variant. It exploits inconsistencies in how certain operating systems validate fragment offsets, letting an attacker crash the target with a smaller, more targeted set of fragments than a standard teardrop attack requires.

6. Ping of Death

A ping of death attack sends an oversized ICMP echo request that exceeds the maximum allowed IP packet size and is split into fragments. When the target reassembles the fragments, the resulting packet exceeds system limits, causing buffer overflows, crashes, or reboots. It remains one of the most widely referenced fragmentation-based attacks in the history of network security.

How does an IP fragmentation attack work?

The basics are that it involves sending datagrams with the goal of interrupting reassembly. This can be achieved by sending datagrams that are too small, too large, or that are focused on overlapping with pre-existing datagrams to overwhelm the server. An IP fragmentation attack uses IP fragments to disable services, servers, and even devices upon the reception of data packets. 

The fraudulent packets are delivered to the victim, and when the victim sets out to reassemble the packets, their system, server, or device becomes overloaded past the size limit and ends up shutting down.

IPv4 vs IPv6 Fragmentation: Key Differences

Fragmentation does not work the same way across both IP versions, and the differences directly affect how attackers can exploit it.

In IPv4, any router along a packet’s path can fragment it if the packet is larger than the network’s maximum transmission unit. This flexibility is exactly what many fragmentation attacks rely on, since it gives attackers multiple points in the network where fragmentation can be manipulated.

IPv6 removes this flexibility. Only the originating host is allowed to fragment a packet. Routers along the path do not fragment traffic. If a packet is too large, the router drops it and sends an ICMPv6 “Packet Too Big” message back to the sender, which then resends the data in appropriately sized fragments. This process, known as Path MTU Discovery, is mandatory in IPv6, not optional.

This shifts the attack surface. Mid-path manipulation tools like Fragrouter cannot alter fragmentation at the router level on an IPv6 network the way they can on IPv4. Attackers instead have to target the fragmentation logic at the source host or exploit how the destination system handles the IPv6 Fragment Extension Header, which carries the offset and identification data needed for reassembly.

IPv6 fragmentation attacks are less common in practice, partly because IPv6 adoption is still catching up to IPv4 and partly because the protocol was designed with these earlier attack patterns in mind. That does not make IPv6 immune. Overlapping fragment attacks and malformed extension headers remain viable attack paths, and security teams should not assume IPv6 traffic is safe from fragmentation-based threats by default.

How to protect yourself from IP fragmentation attacks

You can lower the possibility of becoming a cyber victim of such attacks by using one or more of these methods:

1. Scan the incoming traffic of packets through a proxy server, firewalls, a detection system, or even a specially configured router
2. Keep all of your devices and software up to date, especially security patches and operating software updates,
3. Disable connectivity to any device or person that sends fragmented packets. Practise discretion with this as some connections (e.g. cellular networks) can send harmless, benign fragment packets that are essential to their traffic. 

It’s best to use a few different approaches at the same time. Our recommendation is to defend your network connection first by using a VPN service provider like AstrillVPN. AstrillVPN has military-grade encryption that keeps your data private and secure, offering unparalleled protection and connectivity. 

Enterprise and Network-Level Protection

Individual precautions help, but organizations running their own network infrastructure need more specific controls.

Block fragments below a safe size threshold

Fragments smaller than roughly 400 bytes for IPv4 traffic are rarely legitimate and are commonly associated with attempts to bypass security filters. Configuring routers and firewalls to drop fragments below this threshold closes off a common attack path.

Disallow overlapping fragments

Overlapping offsets are almost never present in legitimate traffic and are a core mechanic behind teardrop-style attacks. Firewalls and intrusion prevention systems should be configured to reject any fragment set with overlapping data.

Enable fragment reassembly inspection

Rather than inspecting fragments individually, configure firewalls and intrusion prevention systems to reassemble packets first and then apply security policy to the complete packet. This closes the gap that tiny fragment attacks rely on, where only the first fragment gets inspected.

Use Deep Packet Inspection

DPI tools analyze the full content of reassembled packets, not just the header data, which makes it possible to detect malicious payloads split across multiple fragments specifically to avoid detection.

Rate limit fragmented traffic

Set limits on how many fragmented packets a system will process within a given time window. This reduces the risk of resource exhaustion attacks that rely on flooding a target with fragments faster than it can reassemble or discard them.

Disable unnecessary fragmentation at the host level

On systems where fragmentation is not required for normal operation, disabling it removes an entire category of attack surface. Where it must remain enabled, operating-system-level protections, such as Windows IPv6 fragmentation-handling settings, Linux RPFilter, and BSD IPFW, add another layer of defense.

Fragmentation Attack Methodology

Tiny Fragments

Tiny fragments are used in fragmentation attacks where attackers send extremely small IP fragments to exploit vulnerabilities in the reassembly process. By crafting these tiny fragments, threat actors aim to bypass security measures or confuse systems during packet reassembly. 

Such fragments might be smaller than the minimum size allowed by the protocol standards, leading to ambiguities in how the system handles them. This can result in system crashes, data corruption, or exploitation of weaknesses in packet handling mechanisms.

Overlapping Fragments

Overlapping fragments involve sending IP fragments that intentionally overlap with each other when reassembled by the target system. Attackers manipulate the offset values in the packet headers, causing the receiving system to face difficulties in correctly reassembling the fragmented packets. 

This technique exploits vulnerabilities in the reassembly process, potentially leading to system crashes, data corruption, or triggering security flaws.

Invalid Flag Combinations

Fragmentation attacks may involve crafting IP packets with invalid header flag combinations. Attackers manipulate the control flags (such as the More Fragments (MF) flag and the Don’t Fragment (DF) flag) in ways that do not adhere to standard protocol specifications. 

Attackers aim to confuse or overload the target system’s packet processing mechanisms by sending packets with contradictory or unexpected flag settings, potentially leading to service disruptions or system instability.

Path MTU Discovery

Path Maximum Transmission Unit (PMTU) Discovery involves manipulating the packet size to exploit vulnerabilities in how networks handle packet fragmentation. Attackers deliberately send packets larger than the maximum supported size along a network path. 

This forces routers to fragment the packets, potentially causing performance degradation, packet loss, or denial of service by overwhelming network resources.

Offset Obfuscation

Offset obfuscation is used to manipulate the offset values in IP packet headers. Attackers intentionally modify these values to obscure the target system’s proper reassembly of fragmented packets. This manipulation disrupts the reassembly process, potentially causing system crashes, data corruption, or exploitation of vulnerabilities in packet handling mechanisms.

Payload Obfuscation

This technique aims to hide malicious payloads within fragmented packets, making it challenging for security systems to effectively detect and mitigate the threats.

Payload obfuscation involves manipulating the content of packet payloads to evade detection or exploit vulnerabilities in systems. Attackers might encrypt, encode, or modify the payload contents to bypass security measures or confuse systems during reassembly. 

How to Detect Fragmentation Attacks

The following are the various methods used to detect fragmentation attacks:

1. Stateful Inspection

Stateful inspection is a firewall technology that monitors the state of active connections and inspects the context of packets passing through a network. Stateful inspection involves examining packet headers and tracking the state of fragmented packets and their associated fragments to detect fragmentation attacks. 

By maintaining information about packet sequences and their expected fragments, firewalls can flag anomalies or inconsistencies in packet sequences, aiding in detecting potential fragmentation attacks.

2. Size Thresholds

Implementing size thresholds involves limiting the size of incoming fragmented packets that a system or network can handle. By defining acceptable size ranges for packets, administrators can detect anomalies when packets exceed these predetermined thresholds.

This method helps identify excessively large or unusually small fragmented packets that might indicate a fragmentation attack, triggering alarms or blocking such packets from entering the network.

3. Overlapping Offset Detection

Overlapping offset detection involves scrutinizing the offset values in fragmented packet headers to identify any overlaps or inconsistencies between packet fragments. Properly assembled fragments should align sequentially without overlaps. 

Network monitoring systems can analyze the offset values within fragmented packets, flagging irregularities or overlaps that might indicate a potential attack exploiting vulnerabilities in packet reassembly.

4. Internet Control Message Protocol (ICMP) Blackhole

ICMP blackhole detection involves monitoring ICMP traffic for indications of blackhole routes. During a fragmentation attack, attackers might manipulate ICMP messages or responses, attempting to create black hole routes that discard legitimate packets. 

Detection mechanisms can analyze ICMP traffic patterns and identify abnormalities, such as unexpected or excessive ICMP messages, aiding in identifying potential black hole routes caused by a fragmentation attack.

5. Packet Reassembly and Inspection

Packet reassembly and inspection involve reconstructing fragmented packets and analyzing their content for anomalies or malicious patterns. Network devices capable of reassembling fragmented packets can inspect the reassembled data for irregularities, such as unexpected packet content or corrupted payloads. 

6.Anomaly Detection

Anomaly detection involves employing machine learning or heuristic-based algorithms to establish baseline behaviors within a network. This approach helps in recognizing deviations from standard traffic patterns or expected behaviors. 

Detection systems analyze packet characteristics, such as packet size, fragmentation patterns, and header information, to identify anomalous activities that might indicate a fragmentation attack.

How common is IP fragmentation?

IP fragmentation has been around for many years, and it is still considerably widespread. IP packets are globally broken into multiple packets for easy transferring of data and convenience of use. These packets are sent through various network layers and are then reassembled on a near daily basis, even as a part of routine, ordinary transfers. 

Because of this, it’s important to put your security first by making sure that you are aware and keeping yourself safe from any cyberattacks. 

Conclusion

IIP fragmentation is the basis of how IP protocol works; it is essential and necessary to understand the pros and cons of the IP protocols you are using. However, hackers have found multiple ways to intercept connections and exploit the mechanism for nefarious attacks and schemes. Always practice caution and invest in a good protection system, like AstrillVPN, to prevent such attacks from reaching your connection.

Was this article helpful?

Yes No