The “Tiny Fragment Attack” is a technique used by cyber attackers to bypass packet filtering rules in IP networks. This technique exploits the fact that many IP protocol implementations allow for an unusually small fragment size to be set on outgoing packets.

Attack Mechanism

When the fragment size is reduced to the point of forcing certain TCP header fields of a TCP packet into the second fragment, filtering rules that specify patterns for those fields fail to detect them. In other words, if the filtering implementation does not enforce a minimum fragment size, a forbidden packet might be passed because it did not match any filter rules.

Technical Specifications

According to standard STD 5, RFC 791, every Internet module must be able to forward a datagram of 68 octets without further fragmentation. This is because an Internet header can be up to 60 octets, and the minimum fragment is 8 octets.

Security Implications

The tiny fragment attack represents a significant threat to network security. Network administrators must be aware of this vulnerability and take measures to counter it. One strategy is to enforce a minimum fragment size in packet filters to ensure that all relevant parts of the TCP header are contained in a single fragment and can be correctly analyzed.

Mitigation

To mitigate the risk of a Tiny Fragment Attack, it is advisable to:

1. Configure network devices to reject fragments that are too small.
2. Update filtering systems to recognize and handle fragmented packets securely.
3. Implement security policies that include checking for minimum fragment size.

In conclusion, the Tiny Fragment Attack is a sophisticated but well-known technique that can be addressed with appropriate security measures and proper configuration of network devices.