Teardrop Attack

A teardrop attack sends a series of IP fragments whose offset and length fields overlap or otherwise create impossible reassembly conditions. Older TCP/IP implementations — notably Windows 3.1x, 95, NT 4.0, and certain Linux 2.0 kernels — failed to validate these fields and crashed or hung when attempting to merge the fragments. Modern operating systems fixed the underlying logic, but conceptually similar fragment-overlap bugs continue to be found in less-tested stacks (IoT, mobile basebands, IPv6 implementations). Defences include keeping operating systems patched, perimeter filtering of overlapping or unusually small IP fragments, deep packet inspection, and rigorous fuzz testing of network code paths.