IP Fragment Reassembly

IP fragment reassembly is very similar to the TCP session reassembly. IP reassembly causes the sensor to reassemble IP packets before they are compared against the signatures. This helps to keep resources from being tied up, since reconstruction does consume some resources. IP fragment reassembly has three parameters:

• Maximum Partial Datagrams  The maximum number of partial datagrams the sensor will attempt to reconstruct at any time.

• Maximum Fragments Per Datagram  The maximum number of fragments that are accepted for a single datagram.

• Fragmented Datagram Timeout  The maximum number of seconds before the sensor stops trying to reassemble a datagram