AT24: ICMP Fragmentation

Definition

A victim server receives spoofed, large fragmented ICMP packets (1500 byte) at a high incoming packet rate and these packets cannot be reassembled. The large packet size expands the bandwidth of an ICMP attack. In addition, it causes the victim CPU to waste resources when it attempts to reassemble useless packets. This attack will often cause victim servers to overload and reboot.   

Attack Matrix Dimensions

Nature of IP	Handshake	Source IP Range	Packet Rate	Packet Size	Packet Content	Fragmenting	Session Rate	Session Duration	VERB Rate
Spoofed	--	Moderate	Very High	Large	Not Valid	High	--	--	--

Defense Fundamentals

ICMP Fragmentation Attacks attempt to circumvent normal network protections.   

Normally, we expect to see no ICMP fragments in a network. However, in rare cases legitimate ICMP fragmentation can occur. Therefore, instead of changing to a simpler and more restrictive algorithms, we have elected to deploy the same TCP and UDP fragmentation algorithms for ICMP.

Since these are IP level fragmented ICMP packets, RFC enforcement will usually eliminate most of these attacks:

• RFC 1858 enforcement will mitigate most simple IP level fragmented ICMP floods. These controls are now under AT 62.

• Once an attack is detected, the RioRey device tracks fragments based on Source IP.

• Since we expect similar server behaviors within a zone, a source that generates a disproportional amount of fragmented ICMP will be removed as attacker.  

• The recommended level of fragmented traffic in a zone should be no more than 20%. This is the recommended default.  

• However, in networks that have a 9000 byte packet size but make mistakes in maximum MTU negotiation, the % of legitimate fragmented traffic may be higher. This is mostly found with content download sites that are popular in Asia and Latin America. In these cases, the 20% levels may need to be increased. Within our current customer base, we have not experience any needs beyond 35%.    

Configuration Settings   

Click Edit to change default setting(s). When done, remember to Save before moving on to next mitigation section.  

Feature	Default Setting	Comments
Filter Mode	Auto (Auto/Monitor)	Auto: Algorithms are executed and packets are filtered. Monitor: Packets are viewed, counted and all algorithms are executed. No filtering of these packets will occur Monitor mode. DDoS traffic will be identified and represented in all attack-based charts and the Zone Traffic Chart will represent zero dropped traffic. Off: No filtering or monitoring is performed.
Maximum fragmented percentage	20 (0-100)	This is to adjust the allowable ratio of IP level fragmented packet to unfragmented ones. This check is done first against total traffic in the zone, but if there is a declared victim of another ICMP attack type it will be performed against traffic to that victim as well. The normal practice is to keep this at 20% except when there is a high
quantity of large file downloads (not streaming media).

Subtypes

Attack packets are classified under subtypes for better reporting. The subtype and reason the packet is labeled as invalid under its attack type can be found in the following table.

Attack Type	Subtype	Details
AT24	17	Excessive Fragmented Packets