I was going through the signature IDs of Cisco IDS and came accross an ID 4050 which says the above. What does it actually mean? Can anyone explain this to me.
A UDP packet is encapsulated inside an IP packet. In the IP header, there is a length field, stating the length of the payload of the IP packet. In the payload sits the UDP packet, with its own header, and also includes a field stating its length.
So you would expect that for as the udp packet sits inside the IP packet, that the length field in the IP headers should match the length field in the UDP headers (excluding the headers themselves).
If not, then it must be malformed, otherwise what would take up the extra space in the IP packet if not the UDP payload.
Unless there is a driver or hardware fault, this should never happen, and so is indicitative of a denial of service attack, where there may not be much care taken to ensure packets are correctly formed.