An IDS can accept a packet that an end-system rejects. An IDS that does this makes the mistake of believing that the end-system has accepted and processed the packet when it actually hasn't. An attacker can exploit this condition by sending packets to an end-system that it will reject, but that the IDS will think are valid. In doing this, the attacker is ``inserting'' data into the IDS --- no other system on the network cares about the bad packets. Secnet IDS Section 3.1

But I don't get it, if the IDS receives all of the packets and then passes them to the end system, and somehow the end system drops one of them (I guess with checksum or something?) then if its a TCP connection then wouldn't the end system wait until it has all of the packets before sending it to application layer and processing it?

I'm saying TCP because in the Insertion part of that website it gives an HTTP example of this attack, but if one of the packets are corrupted how can the end system process that HTTP request before all of the packets arrives? even if we use URG and PSH flags on TCP, wouldn't the HTTP process wait until all of the packets arrive before translating the HTTP request and running it? I don't get how this can work? (Because if it translates the request before waiting for the packets to be in order, then the request might get corrupted and have no meaning)

In the website's example, it sends GET /cgi-bin/pleasedontdetecttthisforme? instead of GET /cgi-bin/phf? but I still don't understand how the end system translates and processes this request when one or some of the packets were corrupted? (based on TCP rules it should always wait before all the packets are OK and present before processing it)

1 Answer 1


The problem with some simple IDS/IPS devices is that they do not perform stream reassembly. They treat those two as different flows and throw the data away since they do not associate the two.

Luckily all modern IDS's perform stream reassembly. You can read about SNORT's implementation here: https://www.snort.org/faq/readme-stream5

  • But in this scenario we can do reassembly tho, only problem here is that IDS wont drop a certain packet but host will (for checksum i guess), therefore IDS wont notice the real message
    – AlenT
    Jul 31, 2018 at 18:16
  • Hey AlenT - SNORT in IPS mode will drop those packets. An IDS never drops packets as an intrusion detection system, but when running inline in IPS (intrusion prevention system) mode will. Regardless you brought up a good example of layered security with host based IPS and network based IPS being deployed.
    – Joe M
    Jul 31, 2018 at 19:36
  • Thanks, so basically I don't need to worry about Insertion attacks when i have a modern IDS/IPS correct?
    – AlenT
    Aug 1, 2018 at 5:45
  • Sort of :) You are never fully protected against all threats, but modern IDS/IPS will detect or protect (based on how it is deployed) the kinds of attacks you described using stream reassembly. Update you definitions regularly for new attacks, etc. And layered security is always the best approach. Good question!
    – Joe M
    Aug 1, 2018 at 15:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .