What is the consequence of an IDS stopping reassembly during a session splicing attack?

• A. The IDS will not log any attack attempt after a successful splicing attack.
• B. The IDS will log all attempts for audit.
• C. The IDS will terminate the connection.
• D. The IDS will ignore the attack and alert later.

Answer: (A)

Reassembly is needed for an IDS to see the complete payload of fragmented packets and understand the full context of a session. In a session splicing attack, fragments are manipulated, and without reassembly the IDS can’t piece together the stream to spot the malicious content. If reassembly is stopped, the IDS can’t recognize the attack, so there’s no log of the intrusion. In other words, the event goes undetected, leaving no audit record.

The other outcomes assume the IDS actively detects or enforces the attack, which isn’t possible when it isn’t reassembling fragments.