Which technique involves generating a series of tiny fragments with overlapping TCP sequence numbers to evade detection?

Which technique involves generating a series of tiny fragments with overlapping TCP sequence numbers to evade detection?

• A. ASCII shellcodes
• B. Polymorphic shellcode attacks
• C. Signature-based network intrusion detection system (NIDS)
• D. IDS evasion

Answer: (D)

IDS evasion is about bypassing intrusion detection systems by manipulating how traffic is presented so it isn’t analyzed effectively. Generating a series of tiny fragments with overlapping TCP sequence numbers takes advantage of how some NIDS reassemble fragmented packets to inspect the payload. When fragments overlap, later fragments can overwrite earlier data or the reassembly can become inconsistent, causing the IDS to miss the malicious content or misclassify the traffic. This technique targets the detection mechanism itself—fragmentation behavior—rather than the payload encoding. In contrast, ASCII shellcodes or polymorphic shellcode attacks focus on altering the payload to defeat signature or pattern-based detection, not on fragmentation-based evasion.

IDS evasion is about bypassing intrusion detection systems by manipulating how traffic is presented so it isn’t analyzed effectively. Generating a series of tiny fragments with overlapping TCP sequence numbers takes advantage of how some NIDS reassemble fragmented packets to inspect the payload. When fragments overlap, later fragments can overwrite earlier data or the reassembly can become inconsistent, causing the IDS to miss the malicious content or misclassify the traffic. This technique targets the detection mechanism itself—fragmentation behavior—rather than the payload encoding. In contrast, ASCII shellcodes or polymorphic shellcode attacks focus on altering the payload to defeat signature or pattern-based detection, not on fragmentation-based evasion.