17 May
2002
17 May
'02
1:55 p.m.
Unfortunately, things like TCP ECN and ICMP 'Frag Needed' are often considered "funny packets".
I know ECN etc have been used to evade firewalls but afaik have not been known in and of themselves to compromise or crash hosts or make them do any "funny things" besides dropping the packets outright.
If you have information to the contrary please let me know.
The ECN bits have been used in the past to do OS finger printing. Not a big issue IMHO, but some people don't like it. -- -------------------------------------------------------------------- jullrich@euclidian.com Collaborative Intrusion Detection join http://www.dshield.org