7-28
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter 7 Defining Signatures
Configuring Signatures
Step 8
Press Enter to apply the changes or enter
no
to discard them.
Configuring IP Fragment Reassembly
This section describes IP fragment reassembly, lists the IP fragment reassembly signatures with the
configurable parameters, describes how to configure these parameters, and how to configure the method
for IP fragment reassembly. It contains the following topics:
•
Understanding IP Fragment Reassembly, page 7-28
•
IP Fragment Reassembly Signatures and Configurable Parameters, page 7-28
•
Configuring IP Fragment Reassembly Parameters, page7-30
•
Configuring the Method for IP Fragment Reassembly, page 7-30

Understanding IP Fragment Reassembly

You can configure the sensor to reassemble a datagram that has been fragmented over multiple packets.
You can specify boundaries that the sensor uses to determine how many datagram fragments it
reassembles and how long to wait for more fragments of a datagram . The goal is to ensure that the sensor
does not allocate all its resources to datagrams that cannot be completely reassembled, either because
the sensor missed some frame transmissions or because an attack has been launched that is based on
generating random fragmented datagrams.
Note
You configure the IP fragment reassembly per signature.

IP Fragment Reassembly Signatures and Configurable Parameters

Tabl e 7-5 lists IP fragment reassembly signatures with the parameters that you can configure for IP
fragment reassembly. The IP fragment reassembly signatures are part of the Normalizer engine.
Table7-5 IP Fragment Reassembly Signatures
Signature ID and Name Description
Parameter With Default Value
and Range Default Action
1200 IP Fragmentation
Buffer Full
Fires when the total number of
fragments in the system exceeds the
threshold set by Max Fragments.
Specify Max Fragments 10000
(0-42000)
Deny Packet Inline
Produce Alert
1
1201 IP Fragment Overlap Fires when the fragments queued for
a datagram overlap each other.
—
2
Deny Packet Inline
Produce Alert
1
1202 IP Fragment Overrun
- Datagram Too Long
Fires when the fragment data (offset
and size) exceeds the threshold set
with Max Datagram Size.
Specify Max Datagram Size
65536 (2000-65536)
Deny Packet Inline
Produce Alert
3
1203 IP Fragment
Overwrite - Data is
Overwritten
Fires when the fragments queued for
a datagram overlap each other and
the overlapping data is different.
4
— Deny Packet Inline
Produce Alert
5