Ping of death and teardrop: crashing a system with broken packets

Protocol attacks as a family are on protocol attacks.

A ping is an ICMP echo request (RFC 792). IP allows a datagram of at most 65,535 octets in total, but a large one can be sent in fragments, each carrying an offset that says where it belongs. The receiver collects the fragments and copies each into a buffer at its offset.

The attacker sends fragments whose last offset plus length goes past the maximum. A stack that trusts the offsets writes beyond the buffer it allocated. In the 1990s this crashed or froze many operating systems; it was fixed by checking the total before copying.

A teardrop attack sends fragments that overlap: the second starts inside the first, or ends before it. A reassembly routine that assumes fragments line up can compute a negative length or copy data over itself, and crash.

Overlapping fragments are also used to slip past filters that inspect only the first fragment, a problem RFC 1858 describes along with how filters should treat such fragments.

The original flaws were fixed long ago, but packet parsing keeps being written anew: in new network stacks, in embedded devices, in support for newer protocol versions. Flaws of the same shape, where a crafted packet crashes or takes over a system, are still found and patched.

The lesson for defenders is general. Keep operating systems, firmware and network devices patched, and treat any packet parser that is exposed to the internet as attack surface.

Fragments can arrive in any order, some may never arrive, and the receiver must hold the early ones in memory while waiting for the rest. That makes reassembly one of the few places where a network stack does real bookkeeping on behalf of an unknown sender.

Every assumption in that bookkeeping, about sizes, offsets and how long to wait, is something an attacker can violate on purpose. Flooding a host with incomplete fragments to fill its reassembly memory is a related attack that needs no parsing bug at all.

They share a protocol and nothing else. A ping flood sends ordinary echo requests in such numbers that the link or the host is overwhelmed; it needs volume and is stopped by capacity and rate limits upstream.

A ping of death sends one broken request and relies on the receiver mishandling it. It needs no volume and is stopped by a correct parser. The protocol attacks that exhaust state instead are the syn flood, which fills the queue of pending connections, and the attack covered in ack flood: exhausting lookups rather than memory, which makes devices search their session tables.

1. Patch operating systems and firmware. This is the actual fix; everything else reduces exposure.
2. Drop malformed and overlapping fragments at the edge. Firewalls and routers can refuse fragments that would reassemble past the limit or overlap.
3. Limit ICMP to what you need. Echo replies from servers are rarely necessary on the public internet.
4. Keep embedded devices off the open internet. They are patched least often.