RadiSys SEG-100, Руководство администратора

Страница: 172 / 198

10
Advanced Settings
172
Pseudo Reass Max Concurrent
Maximum number of concurrent fragment reassemblies. To drop all fragmented packets, set
PseudoReass_MaxConcurrent to 0.
Device:/> set Settings FragSettings PseudoReass_MaxConcurrent=1024
Default: 1024
Illegal Fragments
Determines how the SEG will handle incorrectly constructed fragments. Examples of
incorrectly constructed fragments are overlapping fragments, duplicate fragments with
different data, and incorrect fragment sizes.
Device:/> set Settings FragSettings IllegalFrags=Drop
Default: DropLog
Possible settings include:
• Drop – Discards the illegal fragment without logging it. Also remembers that the packet
that is being reassembled is “suspect,” which can be used for logging at a later time.
• DropLog – Discards and logs the illegal fragment. Also remembers that the packet that is
being reassembled is “suspect”, which can be used for logging at a later time.
• DropPacket – Discards the illegal fragment and all previously stored fragments. Will not
allow further fragments of this packet to pass through during ReassIllegalLinger seconds.
• DropLogPacket – As DropPacket, but also logs the event.
• DropLogAll – As DropLogPacket, but also logs additional fragments belonging to this
packet that arrive during ReassIllegalLinger seconds.
The choice of whether to discard individual fragments or disallow the entire packet is
governed by two factors:
• It is safer to discard the whole packet.
• If, as the result of receiving an illegal fragment, you choose to discard the whole packet,
attackers will be able to disrupt communication by sending illegal fragments during a
reassembly, and in this way block almost all communication.
Duplicated Fragment Data
Compares the data components of a fragment if the same fragment arrives mores than once.
Device:/> set Settings FragSettings DuplicateFragData=Check8
Default: Check8 – compare 8 random locations, a total of 32 bytes
If the same fragment arrives more than once, this can mean either that it has been duplicated
at some point on its journey to the recipient or that an attacker is trying to disrupt the
reassembly of the packet.
The comparison can be made in 2 to 512 random locations in the fragment, four bytes of each
location being sampled. If the comparison is made in a larger number of samples, it is more
likely to find mismatching duplicates. However, more comparisons result in higher CPU load.