An IDS can accept a packet that an end-system rejects. An IDS that does this makes the mistake of believing that the end-system has accepted and processed the packet when it actually hasn't. An attacker can exploit this condition by sending packets to an end-system that it will reject, but that the IDS will think are valid. In doing this, the attacker is ``inserting'' data into the IDS --- no other system on the network cares about the bad packets. Secnet IDS Section 3.1
But I don't get it, if the IDS receives all of the packets and then passes them to the end system, and somehow the end system drops one of them (I guess with checksum or something?) then if its a TCP connection then wouldn't the end system wait until it has all of the packets before sending it to application layer and processing it?
I'm saying TCP because in the Insertion part of that website it gives an HTTP example of this attack, but if one of the packets are corrupted how can the end system process that HTTP request before all of the packets arrives? even if we use URG and PSH flags on TCP, wouldn't the HTTP process wait until all of the packets arrive before translating the HTTP request and running it? I don't get how this can work? (Because if it translates the request before waiting for the packets to be in order, then the request might get corrupted and have no meaning)
In the website's example, it sends
GET /cgi-bin/pleasedontdetecttthisforme? instead of
GET /cgi-bin/phf? but I still don't understand how the end system translates and processes this request when one or some of the packets were corrupted? (based on TCP rules it should always wait before all the packets are OK and present before processing it)