312-50V9 · Question #147
Which of the following network attacks takes advantage of weaknesses in the fragment reassembly functionality of the TCP/IP protocol stack?
The correct answer is A. Teardrop. The Teardrop attack exploits weaknesses in how TCP/IP stacks reassemble overlapping IP fragments, causing target systems to crash or become unstable.
Question
Which of the following network attacks takes advantage of weaknesses in the fragment reassembly functionality of the TCP/IP protocol stack?
Options
- ATeardrop
- BSYN flood
- CSmurf attack
- DPing of death
How the community answered
(61 responses)- A89% (54)
- B3% (2)
- C7% (4)
- D2% (1)
Why each option
The Teardrop attack exploits weaknesses in how TCP/IP stacks reassemble overlapping IP fragments, causing target systems to crash or become unstable.
Teardrop sends malformed IP fragments with overlapping offset values, causing the fragment reassembly code in the TCP/IP stack to fail. The receiving host cannot correctly reconstruct the original packet, leading to system crashes or freezes. This directly targets the fragment reassembly functionality named in the question.
SYN flood exploits the TCP three-way handshake by sending many SYN packets without completing connections, exhausting server state tables, not fragment reassembly.
Smurf attack abuses ICMP echo requests sent to broadcast addresses to amplify traffic toward a victim, which has nothing to do with IP fragment reassembly.
Ping of death sends ICMP packets that exceed the 65,535-byte maximum IP packet size, exploiting size limits rather than the fragment reassembly offset logic.
Concept tested: Teardrop attack and IP fragment reassembly exploitation
Source: https://learn.microsoft.com/en-us/security/engineering/ddos-best-practices
Topics
Community Discussion
No community discussion yet for this question.