On 01/13/2012 12:11 PM, Alexander Bluhm wrote: > On Fri, Jan 13, 2012 at 11:01:43AM -0300, Fernando Gont wrote: >> On 01/12/2012 04:04 PM, Alexander Bluhm wrote: >>> I have reconsidered it and drop the fragments immediately. The >>> packet to be reassembled will be dropped after timeout. >> >> Sorry: immediately, or after a timeout? > > We have a list of fragments that belong to one packet. When an > incomming fragment overlaps any fragment in the list, all fragments > are dropped immediately and the list gets empty. But the state > with the empty list will be kept until timeout.
If there was a fragment overlap, there was malicious activity, and you're certainly not going to get any legitimate fragment reassembled. Therefore, IMO, it doesn't make sense to tie resources (i.e., keep state) for that. If you do not keep state, then. 1) If you don't get any further fragments, you saved memory and other resources, or, 2) If you do get other fragments, they'll be queued, and since other fragments were dropped, there won't be any reassembled datagram, and after a "reassembly timeout" the fragments will get dropped anyway. Thanks, -- Fernando Gont e-mail: [email protected] || [email protected] PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1
