What Is a TCP Fragmentation Attack? | Segmentation-Based Evasion and DoS

A TCP Fragmentation attack — more precisely called a TCP segmentation attack — is a network evasion or resource-exhaustion technique that manipulates how a TCP byte stream is split into segments, deliberately crafting abnormally small segments or unusual boundary placement to slip malicious payloads past inspection devices or to exhaust the resources a target spends reassembling and tracking the TCP stream.

TL;DR: TCP normally splits an application’s data into segments sized according to the negotiated Maximum Segment Size (MSS), independent of anything happening at the IP layer. Attackers abuse this by sending deliberately tiny segments that split a single meaningful unit — an HTTP header, a WAF-inspected pattern, an exploit signature — across multiple segments, so that a firewall, IDS, or WAF inspecting segments individually never sees the complete pattern in one place. A related resource-exhaustion variant sends large volumes of out-of-order or incomplete segments to pressure the target’s TCP reassembly buffers. Mitigation requires MSS clamping, full-stream reassembly at inspection points before pattern matching, and connection-level anomaly detection rather than per-packet inspection.

Last updated: 2026-08-27

TCP segmentation evasion is a well-documented category of IDS/IPS bypass technique, formally analyzed in Ptacek and Newsham’s 1998 paper “Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection,” which remains a foundational reference for understanding why stream-aware, stateful inspection is necessary at security chokepoints. Unlike the crash-oriented IP fragmentation bugs of the same era, TCP segmentation attacks have never depended on kernel bugs — they exploit a structural gap between how individual packets look and how the full data stream they carry actually reads, which is a permanent property of the protocol rather than a patchable defect.

TCP Segmentation vs. IP Fragmentation — Why These Are Different Attacks

Before going further, it’s essential to separate this topic from IP Fragmentation attacks, since both involve “splitting data into pieces” and are frequently conflated.

The clearest way to keep these separate: IP fragmentation is something that happens to a single packet when it’s too big for a link. TCP segmentation is something that happens to an entire data stream before any individual packet is even built, governed entirely by the transport layer’s own logic. A TCP connection can experience segmentation-based evasion attempts with zero IP fragmentation ever occurring, and vice versa.

How TCP Segmentation Works Normally

TCP does not send an application’s data as one unbroken transmission. It divides the byte stream into segments no larger than the Maximum Segment Size (MSS), a value negotiated during the three-way handshake via the MSS option, and typically derived from the path’s MTU minus IP and TCP header overhead (commonly MSS = 1460 bytes for a standard 1500-byte Ethernet MTU).

TCP segment structure (relevant fields):

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Source Port         |       Destination Port         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                        Sequence Number                         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Acknowledgment Number                       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Data | |U|A|P|R|S|F|                                          |
| Offset|Reserved|R|C|S|S|Y|I|            Window                 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
...
Options: ... MSS=1460 (negotiated only in SYN/SYN-ACK) ...

MSS/MTU interaction:
  Ethernet MTU:        1500 bytes
  IP header:            -20 bytes
  TCP header:           -20 bytes
  ─────────────────────────────
  Resulting MSS:       1460 bytes  (max TCP payload per segment)

Application writes 4,380 bytes to a TCP socket:

Segment 1: seq=0,    len=1460  (bytes 0-1459)
Segment 2: seq=1460, len=1460  (bytes 1460-2919)
Segment 3: seq=2920, len=1460  (bytes 2920-4379)

Receiving TCP stack reassembles using sequence numbers, not IP fragment
offsets — it buffers out-of-order segments and delivers a contiguous
byte stream to the application once gaps are filled.

The sender’s TCP stack is free to choose segment sizes smaller than the negotiated MSS at any time — there is nothing in RFC 793 that requires every segment to be MSS-sized. This flexibility, essential for legitimate use cases like interactive protocols sending small keystroke-sized segments, is exactly what segmentation-based attacks exploit.

How TCP Fragmentation (Segmentation) Attacks Work

1. Tiny segment evasion. The attacker deliberately sends TCP segments far smaller than the negotiated MSS — sometimes as small as a single byte — splitting an HTTP request, an exploit payload, or any pattern a security device is looking for across multiple segments.

Normal single-segment HTTP request line:
Segment: "GET /admin/config.php HTTP/1.1\r\n"

Tiny-segment evasion of the same request:
Segment 1: "GE"
Segment 2: "T /adm"
Segment 3: "in/config"
Segment 4: ".php HTTP/1.1\r\n"

A packet-by-packet pattern match for "/admin/config.php" fails against
each individual segment. Only a device that reassembles the full TCP
stream before matching will detect the pattern.

This is the core technique behind many historical IDS/WAF evasion methods: any inspection device that applies signature matching per-packet rather than per-reassembled-stream can be evaded by choosing segment boundaries that split the signature across two or more packets.

2. Segment boundary manipulation with overlapping retransmissions. Beyond simply using tiny segments, an attacker can send an initial segment, then retransmit an overlapping segment at the same or nearby sequence number with different data. If the inspection device and the final destination reassemble overlapping segments differently (some prefer the first-seen data, others prefer the most recent), the attacker can make the inspection device “see” different content than what the destination application ultimately processes — a stream-level analog of the overlapping-fragment ambiguity described in IP fragmentation attacks, but exploiting TCP sequence numbers instead of IP fragment offsets.

Segment A: seq=100, len=20, data="SAFE_LOOKING_CONTENT"
Segment B: seq=105, len=20, data="ALOAD_MALICIOUS_PAY_"  (overlaps A at seq 105-119)

Inspection device policy: "first arrival wins" → sees Segment A's content
Destination OS policy:    "last arrival wins" → application processes
                           a blended stream using Segment B's overlapping bytes

Result: inspected content and delivered content diverge

3. TCP stream reassembly exhaustion. Rather than evasion, this variant targets availability directly. The attacker opens many TCP connections (or uses existing ones) and sends large volumes of segments out of order or with deliberate gaps, forcing the target’s TCP stack — or an inline inspection device performing full-stream reassembly — to buffer growing amounts of out-of-order data per connection while waiting for the missing segments to arrive (which they never do, or arrive very slowly). This consumes memory proportional to the number of connections and the size of each connection’s out-of-order buffer.

Bot opens TCP connection, completes handshake normally
Bot sends segment at seq=50000 (skipping seq=0-49999 entirely)
Target/inspection device: buffers this out-of-order segment,
                           waiting for the missing earlier bytes
Bot repeats across thousands of connections, never sending the gap-filling data

Result: reassembly/reorder buffer memory grows across many
        connections, each held open and consuming resources
        until connection or reassembly timeouts trigger

This overlaps conceptually with low-and-slow attacks in that it relies on holding state open cheaply, but the specific resource under pressure — the reorder buffer for out-of-order segment data — is distinct from Slowloris-style incomplete-header attacks.

TCP Fragmentation Attack Variants Compared

Detection Signals and Telemetry

# Capture only small-payload TCP segments (a common tiny-segment evasion signature)
tcpdump -i eth0 'tcp and (ip[2:2] - ((ip[0]&0xf)*4) - ((tcp[12]&0xf0)>>2)) < 32' -c 200
# Matches packets where the TCP payload length is under 32 bytes

# Per-connection TCP stack counters (Linux)
nstat -az | grep -iE "tcp.*(ofoqueue|reass|prune)"
# TCPOFOQueue: segments currently held in the out-of-order queue

# Live socket-level view of connections with abnormal send/receive queue buildup
ss -tin

# Check current negotiated MSS on active connections
ss -tin | grep -i mss

# nftables counter matching unusually small TCP payload segments
nft add rule inet filter input tcp flags != syn,rst,fin tcp payload-size lt 32 counter

Mitigation Techniques

Common Mistakes

How to Implement on Azion

Azion’s distributed network can help reduce exposure to TCP segmentation-based evasion and reassembly-exhaustion attacks, depending on the products enabled and how they are configured:

• DDoS Protection provides always-on detection and mitigation for connection-level and protocol anomalies, including abnormal segmentation patterns, at the network edge.
• Network Shield can apply connection-level rules to identify anomalous TCP segment patterns before they reach application infrastructure.
• Firewall enables custom rules for connection-based filtering relevant to segmentation-based traffic anomalies.
• WAF inspects reassembled HTTP requests rather than individual TCP segments, which can help reduce exposure to segment-boundary evasion attempts against application-layer rules, depending on configuration.
• WAAP combines network- and application-layer controls for scenarios where segmentation-based evasion is paired with application-layer attack attempts.

Because Azion terminates TCP connections at the edge, requests are reassembled into complete streams as part of normal connection handling before being forwarded to your origin, which can help reduce the exposure of origin-side inspection to raw, attacker-controlled segment sequences — though the specific behavior depends on your configured products.

Related Resources

• What Is a DDoS Attack?
• DDoS Attack Types
• What Is DDoS Protection and Mitigation?
• What Is an IP Fragmentation Attack?
• Low and Slow Attacks
• Azion DDoS Protection
• Azion WAF

Frequently Asked Questions

What is a TCP fragmentation attack? A TCP fragmentation attack, more accurately called a TCP segmentation attack, manipulates how a TCP byte stream is divided into segments — usually by sending abnormally tiny segments or overlapping retransmissions — to evade inspection devices that analyze packets individually rather than as a reassembled stream, or to exhaust reassembly resources on the target.

Is TCP fragmentation the same as IP fragmentation? No, and this is the most common point of confusion. IP fragmentation splits a single IP datagram at the network layer when it exceeds a link’s MTU, governed by the fragment offset and More Fragments flag. TCP fragmentation (segmentation) splits the application’s data stream at the transport layer into segments based on the negotiated Maximum Segment Size, entirely independent of what happens later at the IP layer.

Why do attackers send unusually small TCP segments? Sending tiny segments — sometimes just a few bytes each — splits meaningful patterns like HTTP request paths or exploit signatures across multiple packets. Security devices that inspect each packet’s payload individually, without reassembling the full TCP stream first, can fail to detect the complete pattern, letting malicious content pass undetected.

What is MSS and how does it relate to this attack? The Maximum Segment Size (MSS) is negotiated during the TCP handshake and represents the largest amount of data a segment should carry, typically derived from the path MTU. Attackers aren’t bound by the MSS as a minimum — nothing prevents sending segments far smaller than MSS — and that flexibility is exactly what tiny-segment evasion techniques exploit.

Can MSS clamping alone stop TCP segmentation attacks? No. MSS clamping sets an upper bound on segment size at the network edge, but it does not prevent a sender from choosing to transmit segments much smaller than that bound. MSS clamping should be combined with full-stream reassembly at inspection points and connection-level anomaly detection for effective coverage.

How does TCP stream reassembly exhaustion cause denial of service? An attacker sends segments out of order or with deliberate gaps across many connections, forcing the target (or an inline inspection device) to buffer growing amounts of out-of-order data while waiting for missing segments that never arrive. Across enough connections, this consumes memory and connection-table resources similarly to how other state-exhaustion attacks work, but the specific resource is the TCP reorder/reassembly buffer.

What’s the difference between overlapping TCP segments and overlapping IP fragments? Overlapping TCP segments exploit ambiguity in how a receiver resolves conflicting data at the same sequence number within a byte stream, potentially causing an inspection device and the destination application to process different content. Overlapping IP fragments exploit ambiguity in fragment offset and length at the network layer, historically causing crashes and, today, primarily used for stateless-filter evasion — the two exploit different header fields and different reassembly logic entirely.

How do WAFs defend against TCP segmentation evasion? Effective WAFs reconstruct the complete HTTP request from the reassembled TCP stream before applying signature or rule matching, rather than inspecting individual packets or segments. This ensures that a pattern split across multiple tiny segments is still detected once the full stream is available for inspection.

Is TCP segmentation evasion still relevant given widespread TLS encryption? Yes, though the target shifts. With TLS, payload-level pattern matching happens after decryption at a TLS-terminating device, so segmentation evasion against that inspection point still matters if the device doesn’t fully reassemble the decrypted stream before analysis. Segmentation-based reassembly-exhaustion attacks also remain fully relevant regardless of encryption, since they target connection and buffer state rather than payload content.

How can I detect TCP segmentation attacks on my network? Look for a sustained pattern of TCP segments with payload sizes far below the connection’s negotiated MSS, elevated out-of-order queue depth (TCPOFOQueue via nstat -az), and retransmissions with overlapping sequence ranges carrying different data. Correlating these signals with connection-level anomaly baselines, rather than relying on any single packet’s content, gives the most reliable detection.

Sources

• IETF. “Transmission Control Protocol.” RFC 793. 1981.
• IETF. “TCP Extensions for High Performance.” RFC 7323. 2014.
• Ptacek, Thomas H., and Timothy N. Newsham. “Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection.” Secure Networks, Inc. 1998.
• IETF. “Security Considerations for IP Fragment Filtering.” RFC 1858. 1995.
• CISA. “Understanding and Responding to Distributed Denial-of-Service Attacks.”
• NIST. “Guide to Intrusion Detection and Prevention Systems.” SP 800-94.