topic IP Fragment Incomplete Datagram attack in IPS in Network Security

IP Fragment Incomplete Datagram attack in IPS

mustafa.papdheen — Sun, 10 Mar 2019 12:24:15 GMT

Dear Support,

We are seeing "IP Fragment Incomplete Datagram" attack from 10.132.1.17 to 10.132.1.18 and vice versa. These servers are running in Windows 2003 OS but IPS shows IP fragment Incomplete datagram attack from above source to destination on multiple non standard destination port.

What is "IP gragment Incomplete Datagram" attack and why this is happening. Is anything needs to be done on this?

Regards

papdheen M

IP Fragment Incomplete Datagram attack in IPS

Dustin Ralich — Wed, 13 Jul 2011 13:39:03 GMT

You can review signature details by searching Cisco's Security Intelligence Operations site.

A quick search for "IP Fragment Incomplete Datagram" reveals SIG 1208.0:

http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=1208&signatureSubId=0&softwareVersion=6.0&releaseVersion=S212

Details include a description of what the signature is inspecting for and known benign triggers (false positives).