Ask Your Question

Strange IP flags MF and DF

asked 2021-04-03 20:51:39 +0000

BigFatCat gravatar image

updated 2021-04-03 20:54:21 +0000

I am analyzing a packet capture that the IP DF and MF flag bits are not making sense. I am not sure if this a bug or illegal flag settings. The device is sending packets with the IP MF and DF flag bits set to 1 in the same IP header. The MF flag is correct, because there is subsequent packet.

edit retag flag offensive close merge delete

1 Answer

Sort by » oldest newest most voted

answered 2021-04-06 18:11:34 +0000

André gravatar image

Based on the RFC 791 , I read the flags as:

  • MF set: this packet contains a fragment,
  • DF set: this packet cannot be split into (smaller) fragments.

The combination makes it: this packet contains a fragment which in turn may not be split into smaller fragments.
So while unusual, it is allowed.

edit flag offensive delete link more



@André I tend to disagree on your interpretation of RFC 791. It states:

An internet datagram can be marked "don't fragment." Any internet datagram so marked is not to be internet fragmented under any circumstances. If internet datagram marked don't fragment cannot be delivered to its destination without fragmenting it, it is to be discarded instead.

It states that an internet datagram can be marked "don't fragment" not that a fragment can me marked "don't fragment". And this makes sense from the programmatically point of view. It is the application that marks a block of data it gives to the IP layer "don't fragment", it has no control over initial fragmentation.

It would be interesting to see how the IP datagram got fragmented on the path from sender to receiver. @BigFatCat, are you able to make traces along the path?

SYN-bit gravatar imageSYN-bit ( 2021-04-06 20:11:12 +0000 )edit

@SYN-bit: That was my conclusion as well

Christian_R gravatar imageChristian_R ( 2021-04-06 23:33:57 +0000 )edit

@SYN-bit@Christian_R RFC 791 also states:

To fragment a long internet datagram, an internet protocol module (for example, in a gateway), creates two new internet datagrams and copies the contents of the internet header fields from the long datagram into both new internet headers.

These new internet datagrams can be processed independently, regardless of the original datagram size.

I have seen firewalls setting DF flag on all outgoing traffic (fragments can be used as an attack vector). Probably something similar happened in this case. I don't see how an original sender could generate this flag combination; that doesn't make sense.

André gravatar imageAndré ( 2021-04-07 09:12:34 +0000 )edit

@André Interesting, devices that set DF flags on all traffic. I would say it's none of their business to do so, but then again, there are many implementations. You are right in that these packets might be generated by such devices. Hence my remark of doing captures along the path to see where the DF bit got set.

SYN-bit gravatar imageSYN-bit ( 2021-04-07 22:24:29 +0000 )edit

I am trying to determine where the packet is being fragmented. There appears to be stateful firewall somewhere because the TCP SYNC mss is 1460, but I am seeing the fragment packets with TCP segments of 1508. Another strange thing with the fragmented packets is the protocol number (06) is in the last fragment. I am used to seeing the protocol number in the first fragment.

BigFatCat gravatar imageBigFatCat ( 2021-04-14 20:46:54 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2021-04-03 20:51:39 +0000

Seen: 1,608 times

Last updated: Apr 06 '21