Question

While analyzing a suspicious PCAP, an analyst notices multiple IPv4 packets from a single source that each carry the More Fragments (MF) flag set and non-zero Fragment Offset values, but the reassembled payloads produce overlapping byte ranges. Based on interpreting these IPv4 header fields, what is the most likely purpose of this traffic?

Accepted Answer

The sender is using overlapping IP fragments in an attempt to evade IDS reassembly and signature detection

Answer

The packets indicate normal Path MTU Discovery behavior on a congested link

Answer

The traffic is a standard TCP three-way handshake split across multiple segments

Answer

The Fragment Offset values confirm the packets are ARP broadcasts being relayed across VLANs