Which attack technique uses fragmentation timing differences between an IDS and the host to bypass detection?

Which attack technique uses fragmentation timing differences between an IDS and the host to bypass detection?

• A. Session splicing
• B. Unicode
• C. Fragmentation
• D. invalid reset attack

Answer: (C)

Fragmentation is an evasion technique that exploits how IP fragments are reassembled by different systems. An attacker breaks a malicious payload into multiple IP fragments and times or arranges them so that the host reassembles and processes the complete payload, while the IDS either inspects fragments individually or reassembles them in a way that misses the full malicious content. Because the IDS may have a shorter or differently tuned reassembly window, some fragments can slip through without triggering the expected signatures, allowing the payload to bypass detection once the host reassembles it. This timing difference between the IDS and the host is what enables the bypass.

Fragmentation is an evasion technique that exploits how IP fragments are reassembled by different systems. An attacker breaks a malicious payload into multiple IP fragments and times or arranges them so that the host reassembles and processes the complete payload, while the IDS either inspects fragments individually or reassembles them in a way that misses the full malicious content. Because the IDS may have a shorter or differently tuned reassembly window, some fragments can slip through without triggering the expected signatures, allowing the payload to bypass detection once the host reassembles it. This timing difference between the IDS and the host is what enables the bypass.