-
Notifications
You must be signed in to change notification settings - Fork 99
Description
These statements are made in the latest version of that file as of 2022-Feb-23:
-
If a subsequent packet arrives that is the start of a fragmented packet, the Frag ID must be used to create a new temporal flow that can be uniquely identified by the (Frag ID, DST, SRC) tuple.
-
If the connection is closed with the arrival of the FIN packet then all temporal flows must be closed as well.
The last statement seems to be assuming that temporal flows can be associated with a 5-tuple. That is true if the first IP fragment arriving for one original unfragmented packet contains the L4 header.
Is there a preferred behavior if the first IP fragment for a particular (Frag ID, DST, SRC) tuple is a non-first fragment, and contains no L4 header information, and thus cannot be associated with a particular 5-tuple (at least not yet)?