RFProwl exploit
advICE :Intrusions : 2000319

Summary

A TCP header containing more than 20 bytes has been split into multiple frames in an attempt to crash or bypass your intrusion detection system.

Details

Some intrusion detection systems will crash if they receive fragmented frames in which the TCP layer is split into different fragments. Some systems are especially susceptible if the TCP layer is more than the standard 20 bytes in length. The product has detected this combination of frames, which almost always indicates a serious attempt by a hacker to crash your IDS system.

This attack is dubbed the "RFProwl exploit" because the original program which generated this attack is named rfprowl.c.

The source address is usually spoofed when this attack is seen.

parametric information expected The expected value of the fragment offset. offset The actual value of the fragment offset. length The length of the fragment.

 
Version appeared: 2.2