FINDING · DEFENSE

IP-level fragment overlap attacks operate independently of TCP: crafting overlapping IP fragments whose reassembly by the IDS yields benign content while the end-system's reassembly yields the true payload. The paper demonstrates this is a separate attack surface from TCP-level evasion, exploitable below the transport layer before any TCP stream reconstruction begins.

From 1998-ptacek-insertion — Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection · §3 · 1998

Implications

Use overlapping IP fragments to split censored content at the IP layer, below TCP, where censor and endpoint resolve conflicts under different policies; this technique bypasses transport-layer analysis entirely.
Fragment-based evasion can be combined with TCP-level evasion for layered obfuscation; validate that the destination host's IP reassembly behavior matches expectations with a controlled endpoint before deployment.