Which IDS evasion technique involves splitting attack traffic into many small packets so that no single packet triggers the IDS?

Which IDS evasion technique involves splitting attack traffic into many small packets so that no single packet triggers the IDS?

• A. Session splicing
• B. Unicode
• C. Fragmentation
• D. Time to Live (TTL)

Answer: (A)

Splitting attack traffic into many small packets to avoid triggering the IDS is session splicing. The IDS often detects threats by looking for known signatures within individual packets or simple payload chunks. When the payload is spread across multiple packets, no single packet contains enough data to match a signature, so the IDS may miss the attack unless it reassembles the entire session and inspects the full stream. This technique exploits a lack of proper stream reassembly or correlation across packets. Fragmentation would involve breaking at the IP layer and can be mitigated if the IDS reassembles fragments; the scenario described focuses on distributing the payload so that no single packet raises an alert, which is characteristic of session splicing.

Splitting attack traffic into many small packets to avoid triggering the IDS is session splicing. The IDS often detects threats by looking for known signatures within individual packets or simple payload chunks. When the payload is spread across multiple packets, no single packet contains enough data to match a signature, so the IDS may miss the attack unless it reassembles the entire session and inspects the full stream. This technique exploits a lack of proper stream reassembly or correlation across packets. Fragmentation would involve breaking at the IP layer and can be mitigated if the IDS reassembles fragments; the scenario described focuses on distributing the payload so that no single packet raises an alert, which is characteristic of session splicing.