When testing an IDS, what is the goal of crafting and sending fragmented packets?

• A. To avoid network congestion
• B. To ensure the IDS logs every packet
• C. To trigger a specific known alert
• D. To evade detection and observe how the IDS handles fragmented traffic

Answer: (D)

Fragmentation tests how well an IDS can handle pieces of a single packet that arrive separately. The idea is to see whether the IDS reassembles the fragments and analyzes the complete payload, or if the fragmented pieces slip through without being fully inspected. If the IDS properly reassembles and applies its signatures, it will detect malicious content even when fragmented; if not, fragmentation can hide the threat, allowing you to observe how the IDS behaves under such traffic. This focus is on detection robustness with fragmented traffic, not on congestion, logging every packet, or forcing a particular alert.