No, the fragment offset is correct.
The top 3 bits of this 16 bit field are flags.
His packet has DontFragment bit set and offset:0
Your packet also has offset:0 but not the DontFragment bit.
it looks like a denial of service attack
On 5/4/05, Visser, Martin <martin.visser@xxxxxx> wrote:
>
> You may are probably right (regarding Denial Of Service attempt). It
> might be useful if you can use the "Decode as" function to force
> decoding as DNS (or at least IP).
>
> However I have compared your trace with a valid DNS request that I have.
> At offset 0x14 you have the value 0x4000 whereas my standard request has
> the value 0x0000. These two bytes are the IP fragment offset field. What
> this means, is that this packet is instructing you that the payload in
> this IP packet should be "glued" on to the previous payload on this
> connection contents at an offset of 0x4000 (16384) x 8 bytes (or 131072
> bytes) after the first fragment. This would be unusual for a DNS request
> (very big request indeed!!!)
>
> Basically you have received a IP fragmentation attack. It may well be
> causing your host to allocate more buffer space than it ought.
>
> You may want to investigate and patch it appropriately.
>
>
>
>
>
> Martin Visser, CISSP
> Network and Security Consultant
> Consulting & Integration
> Technology Solutions Group - HP Services
>
> 410 Concord Road
> Rhodes NSW 2138
> Australia
>
> Mobile: +61-411-254-513
> Fax: +61-2-9022-1800
> E-mail: martin.visser@xxxxxx
>
> This email (including any attachments) is intended only for the use of
> the individual or entity named above and may contain information that is
> confidential, proprietary or privileged. If you are not the intended
> recipient, please notify HP immediately by return email and then delete
> the email, destroy any printed copy and do not disclose or use the
> information in it.
>
>
> -----Original Message-----
> From: ethereal-users-bounces@xxxxxxxxxxxx
> [mailto:ethereal-users-bounces@xxxxxxxxxxxx] On Behalf Of Jim Gonzalez
> Sent: Wednesday, 4 May 2005 8:10 AM
> To: ethereal-users@xxxxxxxxxxxx
> Subject: [Ethereal-users] DNS Malformed Packet
>
> Hello,
> I used ethereal to diagnose a problem with my network this
> morning but I can not find a resolution. I think this was some type of
> DOS. I did have some packet loss to my core router. Can someone explain
> this occurrence and possibility direct me to some more information. here
> is the captured packet. Info on the is Unknown operation (6) [Malformed
> Packet]
>
>
> 0000 00 0f 1f 70 02 6c 00 e0 52 e9 02 00 08 00 45 00 ...p.l..
> R.....E.
> 0010 00 2b 2c fd 40 00 37 11 4f 47 45 09 a6 22 40 b1 .+,.@.7.
> OGE.."@.
> 0020 9b a1 81 8e 00 35 00 17 e7 ed 30 31 32 33 34 35 .....5..
> ..012345
> 0030 36 37 38 39 41 42 43 44 45 00 00 00 6789ABCD E...
>
>
> Thanks
> Jim Gonzalez
>
>
>
>
>
>
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>
