Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose that I want to send a very large chunk of data using IP, and that the data gets fragmented into 100 IP datagrams.

By the time I have sent the first 90 datagrams, I realise that I would like to tweak a few bits in the payload of the 3rd datagram. Is it possible to send an "amendment" to the 3rd datagram before sending the last 10 datagrams, avoiding me a resend of the initial 90 datagrams?

Part of the reason I ask is that this RCF says (see page 1):

[a new fragment] may overlap with existing fragments

share|improve this question
If you're somehow getting 100 fragments instead of 100 packets, some of which may be fragmented along the way, then something is seriously wrong with your setup (or you're attempting to attack the destination site). Don't do either of these. – Michael Hampton Oct 29 '12 at 14:13
I'm trying to optimise financial transactions for latency. No attacking. :) – Randomblue Oct 29 '12 at 14:19
In principle this should work but why you want to know this? You only send fragments in TCP when your TCP payload is larger than the MTU of the link you are traversing (assuming Ethernet). In such a case, data from an application has passed down the OSI stack, its now being transmitted, the only need to change something in a previous fragment would be the result of an application level error (in my oppinion), transmiting incorrect data, so I would change that first. Also, how will you know the data you have just sent was fragmented? The application in user-land is typically unaware? – jwbensley Oct 29 '12 at 15:13
No. I have Ethernet frame level control, using FPGAs. I can fragment TCP fragments at will. – Randomblue Oct 29 '12 at 15:29
up vote 2 down vote accepted

This absolutely can happen in practice but it's often part of an attack or detection evasion technique. I've not heard of anyone using it to correct previously sent data as you suggest, though it may be possible.

Here's a specific attack that I've come across

and here's wiki on the technique:

This is the manual page in the Snort IDS about the preprocessor frag3 that looks for frag attacks:

share|improve this answer
I would be interested in using this for TCP, as opposed to UDP. – Randomblue Oct 29 '12 at 12:52
Oh sorry I misunderstood you. The techniques all work with any IP protocol (ICMP, TCP, UDP, etc) and I've removed the line about UDP for clarity. – adric Oct 30 '12 at 14:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.