| 12.3 |  | Attack Guards |
| 12.3.3 |  | FragGuard and Virtual Reassembly |

| In an IP network, a fragment is a packet that has been broken down into smaller pieces in order to be accommodated on a network. There are many legitimate reasons why fragmentation of IP packets occurs. However, many hackers use IP packet fragments to propagate DoS attacks, such as the Teardrop.c attack. FragGuard and Virtual Reassembly help combat this problem, by providing the PIX with a way to track fragment anomalies and reduce the strain these attacks place on the buffer.

FragGuard and Virtual Reassembly is a PIX Security Appliance feature that provides IP fragment protection. Virtual Reassembly is the process of gathering a set of IP fragments, verifying integrity and completeness, tagging each fragment in the set with the transport header, and not coalescing the fragments into a full IP packet. Virtual Reassembly, which is enabled by default, provides the benefits of full reassembly by verifying each fragment set for integrity and tagging it with the transport header. However, Virtual Reassembly does not require the buffer space that must be reserved for full packet reassembly. This is because full reassembly of packets requires that buffer space be reserved for collecting and coalescing the fragments. Virtual reassembly does not coalesce the fragments, and no pre-allocation of the buffer is needed.

FragGuard and Virtual Reassembly perform full reassembly of all Internet Control Message Protocol (ICMP) error messages and virtual reassembly of the remaining IP fragments that are routed through the PIX Security Appliance. It uses Syslog to log any fragment overlapping and small fragment offset anomalies, especially those caused by a Teardrop.c attack.

The fragment command provides management of packet fragmentation and improves PIX Security Appliance compatibility with the Network File System (NFS). NFS is a client/server application that enables computer users to view and optionally store and update files on a remote computer as though they were on their own computer. In general, the default values of the fragment command should be used. However, if a large percentage of the network traffic through the PIX Security Appliance is NFS, additional tuning may be necessary to avoid database overflow.

FragGuard and Virtual Reassembly are enabled by default on the PIX. There are also a number of options that can be configured using various fragment commands. These commands and their syntaxes are explained in the Command Reference.