[Bro-Dev] #815: IPv6 atomic fragment optimizations

Bro Tracker bro at tracker.bro-ids.org
Wed May 2 10:08:44 PDT 2012


#815: IPv6 atomic fragment optimizations
---------------------+------------------------
 Reporter:  jsiwek   |      Owner:
     Type:  Problem  |     Status:  new
 Priority:  Normal   |  Milestone:  Bro2.2
Component:  Bro      |    Version:  git/master
 Keywords:  ipv6     |
---------------------+------------------------
 The draft at http://tools.ietf.org/html/draft-ietf-6man-ipv6-atomic-
 fragments-00 should be revisited if it gets published.  According to
 section 3, atomic fragment headers can just be ignored and "reassembly"
 skipped.  That also should improve the case where a packet has multiple
 atomic fragment headers (see attached pcap), because currently Bro doesn't
 recursively reassemble the inner atomic fragments, it just stops
 processing the packet and gives the "unknown_protocol_44" weird to
 indicate there was packet with multiple fragment headers.

-- 
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/815>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker



More information about the bro-dev mailing list