Subject: Re: [v6ops] [ipv6-wg] Extension Headers / Impact on Security Devices
From: Brian Haberman <[email-masked]>
To: [email-masked]
Date: Wed, 17 Jun 2015 13:48:15 -0400
List-Id: v6ops discussion list <v6ops.ietf.org>

On 6/17/15 1:43 PM, Enno Rey wrote:

> 
> Let's put it slightly different: the intrusion detector is supposed
> to detect/block certain application layer attacks. Which it does as
> long as those come in/pass by without extension

If the device is trying to inspect application-layer data, it might as
well act like the destination and re-assemble the fragments. Yes, this
is costly processing, but it mitigates this bypass mechanism.

Regards,
Brian