IP Fragment Incomplete Datagram attack in IPS

[mustafa.papdheen]

Dear Support,

We are seeing "IP Fragment Incomplete Datagram" attack from 10.132.1.17 to 10.132.1.18 and vice versa. These servers are running in Windows 2003 OS but IPS shows IP fragment Incomplete datagram attack from above source to destination on multiple non standard destination port.

What is "IP gragment Incomplete Datagram" attack and why this is happening. Is anything needs to be done on this?

Regards

papdheen M

[Dustin Ralich]

You can review signature details by searching Cisco's Security Intelligence Operations site.

A quick search for "IP Fragment Incomplete Datagram" reveals SIG 1208.0:

http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=1208&signatureSubId=0&softwareVersion=6.0&releaseVersion=S212

Details include a description of what the signature is inspecting for and known benign triggers (false positives).