Reassembly

Definition

IP reassembly occurs at the final destination when fragmented packets arrive. The receiving host allocates a reassembly buffer keyed by (source IP, destination IP, protocol, identification). Fragments arrive potentially out of order and are placed at their offset positions. When all bytes from offset 0 through the total length are present (indicated by the last fragment having MF=0), the original packet is complete and delivered to the transport layer. Reassembly has resource implications: each in-progress reassembly consumes kernel memory. Attackers exploit this with fragment-based attacks – the Teardrop attack sent overlapping fragments causing crashes, and fragment flooding exhausts reassembly buffers causing legitimate traffic drops. Modern kernels limit reassembly memory (ipfrag_high_thresh) and time out incomplete assemblies after 30 seconds (ipfrag_time). The best defense is avoiding fragmentation entirely via proper MTU configuration and PMTUD.

Examples

• –sysctl net.ipv4.ipfrag_time=30 – reassembly timeout in seconds
• –netstat -s | grep reass – reassembly statistics
• –nf_conntrack handles fragment tracking for stateful firewalls

Related Protocols

Related Terms