Next: Reliable RSTs
Up: Network Intrusion Detection: Evasion,
Previous: The IP Identifier and
Examples of TCP Normalizations
We applied the same ``walk the header'' methodology as in the previous section
to TCP, UDP, and ICMP. However, due to space limitations we defer the detailed
analysis to [4], and in this section focus on three examples for TCP
that illuminate different normalization issues: reliable RSTs, cold start
for TCP, and an example of a TCP ambiguity that a normalizer cannot remove.
Vern Paxson
2001-05-22