H3C Technologies H3C SecPath F1000-E - Manual (Page 579)

1
Virtual Fragment Reassembly
Virtual Fragment Reassembly Overview
To prevent service modules (such as IPSec, NAT and firewall) from processing packet fragments that
arrive out of order, you can enable the virtual fragment reassembly feature. This feature can virtually
reassemble the fragments of a datagram through fragment checking, sequencing and caching so as to
ensure that fragments arrive at service modules in order.
The virtual fragment reassembly feature can also detect the following types of fragment attacks, and
discard the attack fragments for security.
• Tiny fragment attack: If the first fragment of a datagram is very small and the transport layer
protocol (such as TCP and UDP) header is in the second fragment, a tiny fragment attack is
considered.
• Overlapping fragment attack: If two consecutive incoming fragments are identical or overlapping,
an overlapping fragment attack is considered .
• Fragment-flood attack: If the maximum number of fragments per datagram or the maximum
number of fragment queues on the device is reached, a fragment-flood attack is considered.
Configuring Virtual Fragment Reassembly
Select Firewall > Session Table > Advanced from the navigation tree to enter the virtual fragment
reassembly configuration page, as shown in
Figure 8 .