more fragment fun
Should we consider 3a part of the data stream “USER root”?
Or is 3b part of the data stream? “USER foot”!
-- If the OS makes a different decision than the monitor: Bad.
-- Even worse: Different OS’s have different protocol interpretations,
so it’s impossible for Bro to agree with all of them
Imagine an attacker sends: