Frag 3 Configuration

There are at least two preprocessor directives required to activate frag3, a global configuration directive and an engine instantiation. There can be an arbitrary number of engines defined at startup with their own configuration, but only one global configuration.

Global Configuration

• Preprocessor name: frag3_global

• Available options: NOTE: Global configuration options are comma separated.
  • max_frags $<$number$>$ - Maximum simultaneous fragments to track. Default is 8192.

  • memcap $<$bytes$>$ - Memory cap for self preservation. Default is 4MB.

  • prealloc_memcap $<$bytes$>$ - alternate memory management mode, use preallocated fragment nodes based on a memory cap (faster in some situations).

  • prealloc_frags $<$number$>$ - Alternate memory management mode, use preallocated fragment nodes (faster in some situations).

  • disabled - This optional keyword is allowed with any policy to avoid packet processing. This option disables the preprocessor for this config, but not for other instances of multiple configurations. Use the disable keyword in the base configuration to specify values for the options memcap, prealloc_memcap, and prealloc_frags without having the preprocessor inspect traffic for traffic applying to the base configuration. The other options are parsed but not used. Any valid configuration may have "disabled" added to it.

Engine Configuration

• Preprocessor name: frag3_engine

• Available options: NOTE: Engine configuration options are space separated.
  • timeout $<$seconds$>$ - Timeout for fragments. Fragments in the engine for longer than this period will be automatically dropped. Default is 60 seconds.

  • min_ttl $<$value$>$ - Minimum acceptable TTL value for a fragment packet. Default is 1. The accepted range for this option is 1 - 255.

  • detect_anomalies - Detect fragment anomalies.

  • bind_to $<$ip_list$>$ - IP List to bind this engine to. This engine will only run for packets with destination addresses contained within the IP List. Default value is all.

  • overlap_limit <number> - Limits the number of overlapping fragments per packet. The default is "0" (unlimited). This config option takes values equal to or greater than zero. This is an optional parameter. detect_anomalies option must be configured for this option to take effect.

  • min_fragment_length <number> - Defines smallest fragment size (payload size) that should be considered valid. Fragments smaller than or equal to this limit are considered malicious and an event is raised, if detect_anomalies is also configured. The default is "0" (unlimited), the minimum is "0". This is an optional parameter. detect_anomalies option must be configured for this option to take effect.

  • policy $<$type$>$ - Select a target-based defragmentation mode. Available types are first, last, bsd, bsd-right, linux, windows and solaris. Default type is bsd.

    The Paxson Active Mapping paper introduced the terminology frag3 is using to describe policy types. The known mappings are as follows. Anyone who develops more mappings and would like to add to this list please feel free to send us an email!

    Platform	Type
    AIX 2	BSD
    AIX 4.3 8.9.3	BSD
    Cisco IOS	Last
    FreeBSD	BSD
    HP JetDirect (printer)	BSD-right
    HP-UX B.10.20	BSD
    HP-UX 11.00	First
    IRIX 4.0.5F	BSD
    IRIX 6.2	BSD
    IRIX 6.3	BSD
    IRIX64 6.4	BSD
    Linux 2.2.10	linux
    Linux 2.2.14-5.0	linux
    Linux 2.2.16-3	linux
    Linux 2.2.19-6.2.10smp	linux
    Linux 2.4.7-10	linux
    Linux 2.4.9-31SGI 1.0.2smp	linux
    Linux 2.4 (RedHat 7.1-7.3)	linux
    MacOS (version unknown)	First
    NCD Thin Clients	BSD
    OpenBSD (version unknown)	linux
    OpenBSD (version unknown)	linux
    OpenVMS 7.1	BSD
    OS/2 (version unknown)	BSD
    OSF1 V3.0	BSD
    OSF1 V3.2	BSD
    OSF1 V4.0,5.0,5.1	BSD
    SunOS 4.1.4	BSD
    SunOS 5.5.1,5.6,5.7,5.8	First
    Tru64 Unix V5.0A,V5.1	BSD
    Vax/VMS	BSD
    Windows (95/98/NT4/W2K/XP)	Windows