NSF Weekly Challenge #1 — What happens when you enable "Sending IP Fragment" in DoS protection?
  

George Fady Lv2Posted 2026-Jun-11 04:52

Last edited by George Fady 2026-Jun-19 16:39.

Time for our weekly brain teaser. You're configuring Inbound DoS/DDoS protection on NSF V8 and you see the option: "Sending IP Fragment".

❓ Question: If you enable this option, what will happen to your traffic?

A) Only fragmented attack packets are dropped
B) All data packets are discarded — including legitimate ones
C) Only packets above the threshold are dropped
D) NSF enters SYN proxy mode automatically

Drop your answer in the comments! I'll reveal the correct answer + full explanation in 24 hours.
George Fady Lv2Posted 2026-Jun-11 04:55
  
✅ Answer: B
Reveal in your follow-up reply after 24h to keep comments going
net_specialist Lv2Posted 2026-Jun-11 07:46
  
B) All data packets are discarded — including legitimate ones
Humayun Ahmed Lv4Posted 2026-Jun-11 11:53
  
Correct Answer: B) All data packets are discarded — including legitimate ones

In Sangfor Technologies NGAF/NSF V8, the "Sending IP Fragment" option under Inbound DoS/DDoS Protection is a special protection mechanism.

When enabled, the firewall drops all fragmented IP packets, regardless of whether they are malicious or legitimate.
Prosi Lv3Posted 2026-Jun-11 19:48
  
B) All data packets are discarded — including legitimate ones
With NSF V8 inbound DoS/DDoS protection enabled, "Send IP Fragments" means the firewall will block all fragmented IP packets. This is intended to mitigate fragmentation-based attacks, but it also impacts legitimate traffic that relies on IP fragmentation.