Methods, systems, and computer readable media for combining IP fragmentation evasion techniques
View Patent ↗Methods, systems, and computer readable media for combining IP fragmentation evasion techniques are disclosed. According to one aspect, the subject matter described herein includes a method for combining IP fragmentation evasion techniques. In a packet network test device, a plurality of IP fragmentation evasion techniques are defined. An IP packet is generated and fragmented into a first set of IP packet fragments. To the first set of IP packet fragments, each of the multiple IP fragmentation evasion techniques are applied. This produces a second set of IP packet fragments, which are transmitted to the device under test.
1. A method for combining IP fragmentation evasion techniques, the method comprising:
in a packet network test device:
defining a plurality of IP fragmentation evasion techniques;
generating an IP packet;
fragmenting the IP packet to produce a first set of IP packet fragments;
applying each of the plurality of IP fragmentation evasion techniques to the first set of IP packet fragments to produce a second set of IP packet fragments; and
transmitting the second set of IP packet fragments to the device under test.
2. The method of claim 1 wherein the plurality of IP fragmentation evasion techniques comprises at least two of:
a fragment reordering technique;
a fragment duplication technique;
a null fragment generation technique; and
a fragment overlap technique.
3. The method of claim 1 wherein the plurality of IP fragmentation evasion techniques are applied sequentially such that the packets produced as output from an (i) th IP fragmentation evasion technique are provided as input to an (i+1) th IP fragmentation evasion technique.
4. The method of claim 1 comprising providing for user selection of the plurality of IP fragmentation techniques to be applied.
5. The method of claim 1 comprising defining an order in which the plurality of IP fragmentation evasion techniques is applied to the first set of IP packet fragments and applying the plurality of IP fragmentation evasion techniques according to the defined order.
6. The method of claim 5 comprising providing for user definition of the order in which the plurality of IP fragmentation evasion techniques is applied to the first set of IP packet fragments.
7. The method of claim 6 wherein providing for user definition of the order in which the plurality of IP fragmentation evasion techniques is applied to the first set of IP packet fragments includes providing a user interface that allows definition of the order.
8. The method of claim 5 comprising providing for static, dynamic, or algorithmic definition of the order in which the plurality of IP fragmentation evasion techniques is applied.
9. A system for combining IP fragmentation evasion techniques, the system comprising:
a packet network test device including:
a packet generation module for generating an IP packet;
a fragmentation and evasion module for receiving the generated IP packet, fragmenting the IP packet to produce a first set of IP packet fragments, and applying a plurality of IP fragmentation evasion techniques to produce a second set of IP packet fragments for transmission to a device under test; and
a network interface for transmitting the packet fragments to a device under test.
10. The system of claim 9 wherein the plurality of IP fragmentation evasion techniques comprises at least two of:
a fragment reordering technique;
a fragment duplication technique;
a null fragment generation technique; and
a fragment overlap technique.
11. The system of claim 9 wherein the plurality of IP fragmentation evasion techniques are applied sequentially such that the packets produced as output from an (i) th IP fragmentation evasion technique are provided as input to an (i+1) th IP fragmentation evasion technique.
12. The system of claim 9 comprising an interface providing for user selection of the plurality of IP fragmentation techniques to be applied.
13. The system of claim 9 wherein the second module applies the plurality of IP fragmentation evasion techniques according to a defined order.
14. The system of claim 13 comprising an interface providing for user definition of the order in which the plurality of IP fragmentation evasion techniques is applied.
15. The system of claim 13 comprising an interface providing for static, dynamic, or algorithmic definition of the order in which the plurality of IP fragmentation evasion techniques is applied.
16. The system of claim 9 comprising an interface providing for at least one of:
user specification of the plurality of IP fragmentation evasion techniques to be applied to produce the second set of IP packet fragments for transmission to a device under test; and
user definition of an order in which the plurality of IP fragmentation evasion techniques is to be applied to produce the second set of IP packet fragments for transmission to a device under test.
17. A non-transitory computer readable medium having stored thereon executable instructions that when executed by the processor of a computer control the computer to perform steps comprising:
defining a plurality of IP fragmentation evasion techniques;
generating an IP packet;
fragmenting the IP packet to produce a first set of IP packet fragments; and
applying each of the plurality of IP fragmentation evasion techniques to the first set of IP packet fragments to produce a second set of IP packet fragments for transmission to a device under test.