This article is only used for data packet learning!
1. Principle of teardrop attack
Teardrop attack is a denial of service attack, which is an attack method against the IP protocol. As the name implies, Teardrop attack is a teardrop attack method, which shows that its destructive power is very powerful. It uses the method of sending malformed data packets (in addition to the method of forging IP addresses for IP protocol attacks), the realization principle is to send abnormal data packet fragments to the target host, so that the IP data packet fragments are The overlapped parts make it impossible for the target system to reorganize it, further causing the system to crash and stop the vicious attack of service.
Working principle of Teardrop attack (picture from the network)
**Attack hazards: **When some operating systems receive such data packets, the system will crash, restart, etc. For Windows systems, it will cause a blue screen of death and display a STOP 0x0000000A error.
**Defense method:**Upgrade the system version, use a network security device that can cache fragmented packets, analyze the data packets, and calculate whether the fragment offset (Offset) of the data packets is wrong.
**Range of influence:** For early Microsoft operating systems (95, 98, 3.x, nt) in recent years, some people have found that the attack on the 2.x version of the Android system and the 6.0 IOS system is effective
2. Data packet analysis
The packet comes from: https://wiki.wireshark.org/SampleCaptures, named teardrop.pcap
-
Check the 8th packet, you can see that MF in Flags is 1, which means it is not the last fragment. Fragment Offset indicates the offset relative to the original position. At this time, it is 0, indicating that the packet is the first packet of the fragment; looking further down, the
Data data size is 36, which is equal to the maximum length of the Ethernet MTU of 70bit minus the Ethernet Header 14bit, then subtract ip header 20bit.
-
Check the 9th data packet, the offset at this time is changed to be smaller, so that the data of the 9th data packet and the 8th data packet overlap, and the two fragmented packets partially overlap, so they cannot be reassembled.
If the target system cannot be reorganized, it will further cause the system to crash and stop the service.