Enterasys Intrusion Prevention System Manual page 66

Configuring the Network Layer Module
12. Click the Advanced Settings pane.
13. Selecting Log Packets with Reserve Bit Turned On causes the sensor to log any IP packet
with the reserved bit turned on. This bit is not used by IP networks, but is still part of the IP
header. It is reserved for future use. Several years ago, many packet filters could be bypassed
simply by enabling this bit. Old routers incorrectly treated this bit as part of the IP
fragmentation offset field.
14. Selecting Log First Fragmented Packet enables the sensor to decode any TCP fragments with
an IP fragment offset of zero. The fragment must contain enough information in the packet to
obtain the source port, destination port and TCP flags.
Offsets of zero occur naturally on some networks, but also occur when hackers want to
artificially create fragmented packets for Syn scanning, bypassing of firewalls, and other
activities. Selecting this option tells the Network Sensor to record any of these packets and
decode the source and destination port as well as the TCP flags. Basically, when TCP traffic is
fragmented, this setting will attempt to log the beginning of the fragmented packet for further
analysis. These events are labeled [FIRST-TCP-FRAG].
15. Selecting Log Frag TCP Flags Overlay enables the sensor to decode TCP packets with a
fragment offset of 1.
Fragment offsets of 1 happen on some networks, but they are extremely rare. More likely they
are artificial packets generated by a hacker. It is a technique used to bypass some firewalls and
avoid port scanning detection. Using an offset of 1 creates packets that have source and
destination ports in one packet, and the TCP flags in another. This confuses many network
devices including firewalls and some intrusion detection systems. The Network Sensor will
record the entire packet, and gather subsequent packets if Dynamic logging (See
the Dynamic
packet arrive first, it may not be recorded. These events are labeled [TCP-FRAG-OVERLAY].
This setting most commonly picks up on NMAP fragmented Syn scans where the TCP
destination and source ports arrive in the first fragment, but the TCP flags arrive in the second
packet. It also occurs when a remote attacker attempts to bypass a network IDS by artificially
fragmenting their packets into smaller packets.
2-36 Creating Network Sensor Policies
Module" on page 2-28) is enabled. However, if other portions of the fragmented
"Configuring