Skip to content

NIDS evasion (insertion/evasion)

⭐ Flagship module.

1. Context & stakes

Ptacek-Newsham techniques: insertion/evasion, TCP desync - flagship.

Insertion and evasion exploit the gap between what an IDS thinks the target will accept and what it actually accepts: crafted TTLs, checksums, overlaps and TCP desync make sensor and endpoint see different byte streams. The attack reaches the target while the IDS logs something benign. Ptacek and Newsham's 1998 paper defined the class, and target-aware normalising reassembly is the defence.

2. Theory

A network IDS must reconstruct exactly what the endpoint will see. Insertion feeds it packets the host will drop (bad checksum, a TTL that expires first); evasion hides packets the host accepts. Manipulating TTL, fragmentation and TCP state desynchronises IDS and host (Ptacek-Newsham). Flow normalization removes the ambiguity.

3. Attack (PoC)

netlab-ids-evasion attack --i-own-this-network --iface veth-host
  1. Manipulate TTL/fragmentation (insertion vs evasion)
  2. Desynchronize TCP state

4. Detection

netlab-ids-evasion detect --iface veth-host

Indicators to watch, and the associated IDS rule (see netlab-ids).

5. Defense

  • Flow normalization (traffic scrubbing)
  • Host-state-aware IDS

6. Exercise

Reproduce in the isolated lab (netns/veth): see lab setup.

7. Further reading