Overlapping fragments in IPv6 and firewalls

[Suresh Krishnan <[e-mail]>]

Hi Folks,
   This draft describes how to use overlapping fragments in IPv6 to 
bypass firewalling restrictions. It recommends disallowing overlapping 
fragments in IPv6.

Thanks
Suresh


-------- Original Message --------
Subject: I-D Action:draft-krishnan-6man-overlap-fragment-01.txt
Date: Mon, 14 Jul 2008 14:15:02 -0700 (PDT)
From: [e-mail]
Reply-To: [e-mail]
To: [e-mail]

A New Internet-Draft is available from the on-line Internet-Drafts 
directories.

	Title           : Issues with overlapping IPv6 fragments
	Author(s)       : S. Krishnan
	Filename        : draft-krishnan-6man-overlap-fragment-01.txt
	Pages           : 7
	Date            : 2008-07-13

The fragmentation and reassembly algorithm specified in the base IPv6
specification allows fragments to overlap.  This document
demonstrates the security issues with allowing overlapping fragments
and updates the IPv6 specification to explicitly forbid overlapping
fragments.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-krishnan-6man-overlap-fragment-01.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[e-mail]
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------