Apparatus and method for detecting tiny fragment attacks

An apparatus comprising:

• a circuit comprising a first circuit for receiving a frame;
• wherein the first circuit counts data bytes of the frame to generate a total number of counted bytes in response to receiving the frame.

A computer readable medium for storing software instructions executable by a data processing circuit, wherein the data processing circuit performs a method in response to executing the instructions, the method comprising counting data bytes of a frame transmitted via a communication link, wherein the data bytes are counted to generate a total number of counted bytes.

An apparatus comprising:

• means for receiving a link layer protocol frame;
• means for counting data bytes of the link layer protocol frame to generate a total number of counted bytes.

A method comprising:

• receiving a Ethernet frame, wherein the Ethernet frame comprises a Transmission Control Protocol (TCP) header, wherein the TCP header comprises a TCP header length value;
• comparing the TCP header length value to a predetermined value.

An apparatus comprising:

• a circuit, the circuit comprising a first circuit;
• wherein the first circuit is configured to receive a Ethernet frame, wherein the Ethernet frame comprises a TCP header, wherein the TCP header comprises a TCP header length value;
• wherein the first circuit is configured to compare the TCP header length value to a predetermined value.

A computer readable medium for storing software instructions executable by a data processing circuit, wherein the data processing circuit performs a method in response to executing the instructions, the method comprising comparing a TCP header length value of a Ethernet frame to a predetermined value.

An apparatus comprising:

• means for receiving an Ethernet frame;
• means for comparing a TCP header length value in the Ethernet frame to a predetermined value.

A method comprising:

• receiving an Ethernet frame, wherein the Ethernet frame comprises an IP datagram, wherein the IP datagram comprises an IP header and an IP payload, wherein the IP payload comprises a User Datagram Protocol (UDP) header;
• calculating a length in bytes of the IP payload of the IP datagram.

An apparatus comprising:

• a circuit comprising a first circuit, wherein the first circuit is configured for receiving an Ethernet frame, wherein the Ethernet frame comprises an IP datagram, wherein the IP datagram comprises an IP header and an IP payload, wherein the IP payload comprises a User Datagram Protocol (UDP) header;
• calculating a length in bytes of the IP payload of the IP datagram;
• comparing the calculated IP payload length to a predetermined value.

A computer readable medium for storing software instructions executable by a data processing circuit, wherein the data processing circuit performs a method in response to executing the instructions, the method comprising:

• receiving an Ethernet frame, wherein the Ethernet frame comprises an IP datagram, wherein the IP datagram comprises an IP header and an IP payload, wherein the IP payload comprises a User Datagram Protocol (UDP) header;
• calculating a length in bytes of the IP payload of the IP datagram..

An apparatus comprising:

• means for receiving an Ethernet frame, wherein the Ethernet frame comprises an IP datagram, wherein the IP datagram comprises an IP header and an IP payload, wherein the IP payload comprises a User Datagram Protocol (UDP) header;
• means for calculating a length in bytes of the IP payload of the IP datagram.