Apparatus and method for filtering IP packets

1. A method comprising:

receiving an Ethernet frame at a node, wherein the Ethernet frame comprises an Internet Protocol (IP) datagram that comprises an IP header, wherein

the IP header comprises an IP datagram data length value, and

the IP datagram data length value does not match an actual IP datagram data length;

detecting whether the IP datagram data length value satisfies a length criterion, wherein

the length criterion is based on a type of transport layer protocol header;

calculating the actual IP datagram data length; and

detecting whether the actual IP datagram data length satisfies the length criterion.

2. The method of claim 1 , wherein

the Ethernet frame comprises a Transmission Control Protocol (TCP) header, and

the TCP header comprises a TCP header length value.

3. The method of claim 2 , further comprising:

comparing the TCP header length value to a predetermined value, and

blocking the Ethernet frame if the TCP header length value is less than the predetermined value, wherein

the blocking is performed by a filter.

4. The method of claim 3 , further comprising:

an act of blocking transmission of the Ethernet frame directly or indirectly to an operating system executing on a computer system if the TCP header length value is less than the predetermined value.

5. The method of claim 3 , wherein the predetermined value is 5.

6. The method of claim 3 , further comprising:

counting data bytes of the Ethernet frame to generate a total number of counted bytes;

calculating a data length of an Internet Protocol (IP) payload of the Ethernet frame, wherein the data length is calculated as a function of the total number of counted bytes; and

comparing the calculated IP payload data length to a second predetermined value.

7. The method of claim 6 further comprising:

calculating a second data length of the IP payload, wherein the calculated second data length of the IP payload is calculated as a function of the IP header length value and the IP datagram data length value;

comparing the calculated second data length to the second predetermined value;

blocking the Ethernet frame if the calculated second data length is less than the second predetermined value.

8. An apparatus comprising:

a circuit, the circuit comprising a first circuit, wherein the first circuit is configured to

receive an Ethernet frame, wherein the Ethernet frame comprises

an Internet Protocol (IP) datagram that comprises an IP header, wherein

the IP header comprises an IP datagram data length value, and

the IP datagram data length value does not match an actual IP datagram data length;

detect whether the IP datagram data length value satisfies a length criterion, wherein

the length criterion is based on a type of transport layer protocol header;

calculate the actual IP datagram data length; and

detect whether the actual IP datagram data length satisfies the length criterion.

9. The apparatus of claim 8 wherein

the Ethernet frame comprises a Transmission Control Protocol (TCP) header,

the TCP header comprises a TCP header length value.

10. The apparatus of claim 9 further comprising a computer system coupled to the circuit, wherein the circuit blocks transmission of the Ethernet frame to the computer system if the TCP header length value is less than a predetermined value.

11. The apparatus of claim 9 wherein the predetermined value is 5.

12. The apparatus of claim 10 :

wherein the first circuit is configured to count data bytes of the Ethernet frame to generate a total number of counted bytes;

wherein the first circuit is configured to calculate a data length of an Internet Protocol (IP) payload of the Ethernet frame, wherein the data length is calculated as a function of the total number of counted bytes;

wherein the first circuit is configured to compare the calculated IP payload data length to a second predetermined value.

13. The apparatus of claim 12 , wherein

the first circuit is configured to calculate a second data length of the IP payload, wherein

the calculated second data length of the IP payload is calculated as a function of the IP header length value and the IP datagram data length value;

the first circuit is configured to compare the calculated second data length to the second predetermined value; and

the circuit is configured to block the Ethernet frame if the calculated second data length is less than the second predetermined value.

14. The apparatus of claim 8 wherein:

the first circuit is configured to count data bytes of a datagram contained in the Ethernet frame to generate a total number of counted bytes;

the first circuit is configured to calculate a data length of an Internet Protocol (IP) payload of the Ethernet frame, wherein the data length is calculated as a function of the total number of counted bytes;

the first circuit is configured to compare the calculated IP payload data length to a second predetermined value;

the first circuit is configured to block the Ethernet frame if the calculated data length is less than the predetermined value.

15. The apparatus of claim 8 wherein the first circuit is configured to compare the TCP header length value to the predetermined value if a fragment offset value contained in the Ethernet frame is set to zero.

16. A non-transitory computer readable medium for storing software instructions executable by a data processing circuit, wherein the data processing circuit performs a method in response to executing the instructions, the method comprising

receiving an Ethernet frame, wherein the Ethernet frame comprises

an Internet Protocol (IP) datagram that comprises an IP header, wherein

the IP header comprises an IP datagram data length value, and

the IP datagram data length value does not match an actual IP datagram data length;

detecting whether the IP datagram data length value satisfies a length criterion, wherein

the length criterion is based on a type of transport layer protocol header;

calculating the actual IP datagram data length; and

detecting whether the actual IP datagram data length satisfies the length criterion.

17. The non-transitory computer readable medium of claim 16 wherein

the Ethernet frame comprises a Transmission Control Protocol (TCP) header, and

the TCP header comprises a TCP header length value.

18. The non-transitory computer readable medium of claim 17 wherein the method further comprises an act of blocking transmission of the Ethernet frame through a router firewall if the TCP header length value is less than a predetermined value.

19. The non-transitory computer readable medium of claim 17 wherein the method further comprises an act of blocking transmission of the Ethernet frame directly or indirectly to an operating system executing on a computer system if the TCP header length value is less than the predetermined value.

20. The non-transitory computer readable medium of claim 17 wherein the predetermined value is 5.

21. The non-transitory computer readable medium of claim 18 wherein the method further comprises:

counting data bytes of the Ethernet frame to generate a total number of counted bytes;

calculating a data length of an Internet Protocol (IP) payload of the Ethernet frame, wherein the data length is calculated as a function of the total number of counted bytes; and

comparing the calculated IP payload data length to a second predetermined value.

22. The non-transitory computer readable medium of claim 21 wherein the method further comprises:

calculating a second data length of the IP payload, wherein the calculated second data length of the IP payload is calculated as a function of the IP header length value and the IP datagram data length value;

comparing the calculated second data length of the IP payload to the second predetermined value;

blocking the Ethernet frame if the calculated second data length of the IP payload is less than the second predetermined value.

23. An apparatus comprising:

means for receiving an Ethernet frame wherein the Ethernet frame comprises an Internet Protocol (IP) datagram that comprises an IP header, wherein

the IP header comprises an IP datagram data length value, and

the IP datagram data length value does not match an actual IP datagram data length;

means for detecting whether the IP datagram data length value satisfies a length criterion, wherein

the length criterion is based on a type of transport layer protocol header;

means for calculating the actual IP datagram data length; and

means for detecting whether the actual IP datagram data length satisfies the length criterion.

24. The method of claim 1 wherein the TCP header length value is compared to the predetermined value if a fragment offset value contained in the Ethernet frame is set to zero.

25. The method of claim 1 further comprising:

counting data bytes of a datagram contained in the Ethernet frame to generate a total number of counted bytes;

calculating a data length of an Internet Protocol (IP) payload of the Ethernet frame, wherein the data length is calculated as a function of the total number of counted bytes;

comparing the calculated IP payload data length to a second predetermined value;

blocking the Ethernet frame if the calculated data length is less than the predetermined value.

26. The method of claim 25 wherein the datagram bytes are counted if a fragment offset value contained in the Ethernet frame is set to zero.

27. The method of claim 1 , wherein

the Ethernet frame is generated to facilitate an unauthorized operation.

28. The method of claim 1 , wherein

the IP datagram length value is rewritten as a result of the Ethernet frame being fragmented.

29. The method of claim 1 , wherein

the actual IP datagram length is unchanged since a time at which the Ethernet frame was transmitted to the node.