What is 'session splicing' in the context of packet crafting?

• A. It refers to merging multiple sessions into one.
• B. It refers to crafting packets with small payloads to evade detection.
• C. It refers to altering TCP sequence numbers to reset connections.
• D. It refers to reassembling fragmented packets at the destination.

Answer: (B)

Session splicing is a packet‑crafting technique where a single session’s data is split into many tiny pieces and sent across multiple packets, often interleaving with other traffic. The attacker crafts those packets with small payloads so each one looks innocuous to security tools, making it harder for IDS/IPS or WAFs to detect the overall pattern. When the packets reach the destination, the legitimate endpoint reassembles them into the original stream, allowing the session to proceed while evading per-packet detection.

This differs from simply merging sessions or resetting a connection, and it’s not merely about reassembling fragmented IP packets at the destination. The emphasis is on distributing small, benign-looking chunks to slip past defenses while still achieving a coherent session on the receiving end.