Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was going through the signature IDs of Cisco IDS and came accross an ID 4050 which says the above. What does it actually mean? Can anyone explain this to me.

share|improve this question
I think this is a possible duplicate of Minimum size of the data part of TCP segment, based on the content of that question. If not, I'll retract my close vote. – user3463 May 28 '12 at 23:31
@RandolphWest No, it isn't a dupe for that question. – Paul May 28 '12 at 23:47

A UDP packet is encapsulated inside an IP packet. In the IP header, there is a length field, stating the length of the payload of the IP packet. In the payload sits the UDP packet, with its own header, and also includes a field stating its length.

So you would expect that for as the udp packet sits inside the IP packet, that the length field in the IP headers should match the length field in the UDP headers (excluding the headers themselves).

If not, then it must be malformed, otherwise what would take up the extra space in the IP packet if not the UDP payload.

Unless there is a driver or hardware fault, this should never happen, and so is indicitative of a denial of service attack, where there may not be much care taken to ensure packets are correctly formed.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .