RFC 7739: Security Implications of Predictable Fragment Identification Values
In plain English — editorial summary, not part of the RFC
IPv6 specifies the Fragment Header, which is employed for the fragmentation and reassembly mechanisms. The Fragment Header contains an "Identification" field that, together with the IPv6 Source Address and the IPv6 Destination Address of a packet, identifies fragments that correspond to the same original datagram, such that they can be reassembled together by the receiving host. The only requirement for setting the Identification field is that the corresponding value must be different than that employed for any other fragmented datagram sent recently with the same Source Address and Destination Address. Some implementations use a simple global counter for setting the Identification field, thus leading to predictable Identification values. This document analyzes the security implications of predictable Identification values, and provides implementation guidance for setting the Identification field of the Fragment Header, such that the aforementioned security implications are mitigated.
Document record
- Document ID
- RFC7739
- Published
- February 2016
- Authors
- F. Gont
- Status
- INFORMATIONAL
- Stream
- IETF
- Area
- int
- Pages
- 20
- Also known as
- —
Topics
Related documents
Ranked automatically by shared keywords, IETF area and stream — not by editorial selection.
- RFC 9416Security Considerations for Transient Numeric Identifiers Employed in Network ProtocolsCurrent
July 2023
- RFC 5961Improving TCP's Robustness to Blind In-Window AttacksUpdated
August 2010
- RFC 8021Generation of IPv6 Atomic Fragments Considered HarmfulCurrent
January 2017
- RFC 9414Unfortunate History of Transient Numeric IdentifiersCurrent
July 2023
- RFC 9415On the Generation of Transient Numeric IdentifiersCurrent
July 2023
- RFC 4832Security Threats to Network-Based Localized Mobility Management (NETLMM)Current
April 2007
- RFC 7837IPv6 Destination Option for Congestion Exposure (ConEx)Current
May 2016
- RFC 7873Domain Name System (DNS) CookiesUpdated
May 2016
Also filed under
About this page
The document record above — title, authors, date, status, stream, area, relationships, DOI and errata — is imported verbatim from the public RFC Editor index. The “in plain English” section is editorial: written by The metasystema editorial team, not part of the RFC. Where the two differ, the RFC text governs.
Last checked against the RFC Editor index on . RFCs are never revised after publication; changes are issued as new documents.
Data sources · Editorial policy · Report a correction · What is an RFC?