Description
Niels Provos Honeyd before 1.5 replies to certain illegal IP packet fragments that other IP stack implementations would drop, which allows remote attackers to identify IP addresses that are being simulated using honeyd.
References
- 20060212 honeyd security advisory: remote detection mailing-list
- honeyd-ipfrag-obtain-information(24728) vdb-entry
- 16595 vdb-entry
- 18867 third-party-advisory
- ADV-2006-0552 vdb-entry
- http://www.honeyd.org/phpBB2/viewtopic.php?t=106
- http://www.honeyd.org/adv.2006-01