[Bro-Dev] #815: IPv6 atomic fragment optimizations
Bro Tracker
bro at tracker.bro-ids.org
Wed May 2 10:08:44 PDT 2012
#815: IPv6 atomic fragment optimizations
---------------------+------------------------
Reporter: jsiwek | Owner:
Type: Problem | Status: new
Priority: Normal | Milestone: Bro2.2
Component: Bro | Version: git/master
Keywords: ipv6 |
---------------------+------------------------
The draft at http://tools.ietf.org/html/draft-ietf-6man-ipv6-atomic-
fragments-00 should be revisited if it gets published. According to
section 3, atomic fragment headers can just be ignored and "reassembly"
skipped. That also should improve the case where a packet has multiple
atomic fragment headers (see attached pcap), because currently Bro doesn't
recursively reassemble the inner atomic fragments, it just stops
processing the packet and gives the "unknown_protocol_44" weird to
indicate there was packet with multiple fragment headers.
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/815>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
More information about the bro-dev
mailing list