Hello to the list and RA guard evasion technique

[sthaug at nethelp.no]

> > But, you obviously have found a work-around around the work-around: overlapping fragments. Especially if hosts accept it... (which is weird BTW but what can we do?).
> 
> An open question is whether one should treat this as a bug in the end
> systems. Shouldn't packets with overlapping fragments just be treated
> as malformed and dropped? Or would checking for this have a
> significant performance cost?

But if you want to block undesired RAs at the switch level, you then
need to treat the switches as end systems. Not really practical...

Steinar Haug, Nethelp consulting, sthaug at nethelp.no