[Snort-users] bad frag bits

Samuel C. Adams scadams at ...1820...
Tue Nov 25 06:36:06 EST 2003

alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"BAD-TRAFFIC bad frag
bits"; fragbits:MD; sid:1322; classtype:misc-activity; rev:5;) 

So... I believe this signature generates alerts when packets with both
the don't fragment and more fragments bits are set. Anyone see this
alert much? I'm seeing it primarily with udp packets coming from
audio/video streaming sites (i.e. Realnetworks, Kontiki, Shockwave). 
Usually these udp packets are fairly large and it's possible they have
to travel
over a link with low MTU at some point. Is it possible to fragment
packets if the don't fragment bit is set? Are there routers out there
that do that? 

I thought routers were supposed to send ICMP code 3 type 4 messages
(Fragmentation Needed and Don't Fragment was Set) if they are forced to
deal with packets out that are too large. Is that not always the case? 

More information about the Snort-users mailing list