What is another evasion technique used to confuse packet reassemblers?

• A. Pausing between sending parts to hope IDS times out.
• B. Sending packets out of order.
• C. Fragmenting packets to confuse reassembly.
• D. Using randomization of source ports.

Answer: (B)

Packet reassembly is how a device stitches fragments back into the original packet so rules and payloads can be inspected. If fragments arrive out of order, the reassembler is confused about which piece goes where, which can produce a misconstructed payload, trigger reassembly timeouts, or simply drop fragments. This disruption lets malicious data slip past checks that assume fragments are assembled in the correct sequence. Fragmenting packets itself can also confuse reassembly, but delivering the fragments in a non-sequential order directly targets the reassembly logic and is the most effective way to cause misinterpretation. Randomizing source ports doesn’t affect reassembly and is aimed more at evading logging or correlation than at breaking how fragments are rebuilt.