AT4: Fragmented ACK
Definition
A variation of the ACK and PUSH ACK Flood. This attack uses 1500 byte size packets to consume large amounts of bandwidth, while generating a relatively moderate packet rate. Because routers do not reassemble fragmented packets at the IP level, these packets usually pass through routers, ACL, firewalls, and IDS/IPS unimpeded. The packet content is usually randomized, irrelevant data. The attacker’s goal is to consume all bandwidth of the victim’s network. A Fragmented ACK attack will affect performance of all servers in the victim’s network.
Attack Matrix Dimensions
| Nature of IP | Handshake | Source IP Range | Packet Rate | Packet Size | Packet Content | Fragmenting | Session Rate | Session Duration | VERB Rate |
|---|---|---|---|---|---|---|---|---|---|
| Spoofed | -- | Large | Moderate | Very Large | Not Valid | High | -- | -- | -- |
Defense Fundamentals
Fragmented ACK floods attempt to put large packets into the link with moderate packet counts. Since these are IP level fragmented TCP packets, RFC enforcement would usually eliminate most of these attacks:
- RFC 1858 enforcement will eliminate most simple IP level Fragmented ACK floods. RFC Enforcement is now under AT 62.
- Once an attack is detected, the RioRey device tracks fragments based on Source IP.
Configuration Settings
Click Edit to change default setting(s). When done, remember to Save before moving on to next mitigation section.
| Feature | Default Setting | Comments |
|---|---|---|
| Filter Mode | Auto (Auto/Monitor) | Auto: Algorithms are executed and packets are filtered. Monitor: Packets are viewed, counted and all algorithms are executed. No filtering of these packets will occur Monitor mode. DDoS traffic will be identified and represented in all attack-based charts and the Zone Traffic Chart will represent zero dropped traffic. Off: No filtering or monitoring is performed. |
| Maximum fragmented percentage | 100 (0-100) | This is to adjust the allowed ratio of IP level fragmented packets to unfragmented ones. |
Subtypes
Attack packets are classified under subtypes for better reporting. The subtype and reason the packet is labeled as invalid under its attack type can be found in the following table.
| Attack Type | Subtype | Details |
|---|---|---|
| AT4 | 17 | Excessive Fragmented Packets |