When an IPv4 packet is fragmented, what is copied into each fragment's IP header?

The entire original IP header, including all options

A new IP header with a new Identification value for each fragment

The original IP header fields, except for the Total Length, Fragment Offset, and possibly the Flags field

Only the source and destination IP addresses

An analyst notices a series of tiny fragments, each carrying only 8 bytes of payload, all with the same identification value and MF=1 except the last. The fragments are destined for an internal web server. The analyst suspects an IDS evasion technique. What is the most likely purpose of this pattern?

To bypass the MTU of the network path by using smaller packets.

To force the IDS to reassemble the fragments before it can inspect the payload, potentially overwhelming it.

To ensure the fragments are delivered out of order to confuse the receiving host.

To hide the source IP address by fragmenting the IP header.

An analyst is using tcpdump to capture fragmented traffic. The analyst sees a fragment with an offset of 0 and MF=1, followed by a fragment with an offset of 185 and MF=0, but the total reassembled packet length is only 2960 bytes. The original packet should have been 4000 bytes. What is the most likely cause?

The DF flag is set, preventing reassembly.

The capture is missing one or more fragments.

The identification field is different, so the fragments are not part of the same packet.

The fragments are overlapping, causing data loss during reassembly.

An analyst is using Wireshark to inspect fragmented traffic. The analyst sees a series of fragments with the same identification value, but one fragment has an offset that overlaps with the previous fragment. What should the analyst conclude?

The traffic may be an attempt to evade an IDS by exploiting reassembly differences.

The fragments are simply out of order and will be reassembled correctly.

The identification field is being reused, causing confusion.

The DF flag is set, so the fragments will be dropped.

An IDS analyst sees three fragments with the same identification value. Fragment 1 has offset 0 and MF=1. Fragment 2 has offset 185 and MF=1. Fragment 3 has offset 370 and MF=0. The original unfragmented packet's total length was 3000 bytes. What is the total length of the reassembled packet?

3000 bytes minus the first fragment's payload length

2960 bytes plus the last fragment's payload length

GIAC Certified Intrusion Analyst

Domain 4Objective 2

Fragmentation GCIA Practice Questions (Page 7)

Part of the Packet Analysis and Engineering domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

Questions 31–35

31foundation · easy
When an IPv4 packet is fragmented, what is copied into each fragment's IP header?
Select an answer first
32application · medium
An analyst notices a series of tiny fragments, each carrying only 8 bytes of payload, all with the same identification value and MF=1 except the last. The fragments are destined for an internal web server. The analyst suspects an IDS evasion technique. What is the most likely purpose of this pattern?
Select an answer first
33expert · hard
An analyst is using tcpdump to capture fragmented traffic. The analyst sees a fragment with an offset of 0 and MF=1, followed by a fragment with an offset of 185 and MF=0, but the total reassembled packet length is only 2960 bytes. The original packet should have been 4000 bytes. What is the most likely cause?
Select an answer first
34application · medium
An analyst is using Wireshark to inspect fragmented traffic. The analyst sees a series of fragments with the same identification value, but one fragment has an offset that overlaps with the previous fragment. What should the analyst conclude?
Select an answer first
35application · medium
An IDS analyst sees three fragments with the same identification value. Fragment 1 has offset 0 and MF=1. Fragment 2 has offset 185 and MF=1. Fragment 3 has offset 370 and MF=0. The original unfragmented packet's total length was 3000 bytes. What is the total length of the reassembled packet?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.

Fragmentation GCIA Practice Questions (Page 7)

Questions 31–35

When an IPv4 packet is fragmented, what is copied into each fragment's IP header?

An analyst is using Wireshark to inspect fragmented traffic. The analyst sees a series of fragments with the same identification value, but one fragment has an offset that overlaps with the previous fragment. What should the analyst conclude?

An IDS analyst sees three fragments with the same identification value. Fragment 1 has offset 0 and MF=1. Fragment 2 has offset 185 and MF=1. Fragment 3 has offset 370 and MF=0. The original unfragmented packet's total length was 3000 bytes. What is the total length of the reassembled packet?

Keep studying — Packet Analysis and Engineering