Certified Ethical Hacker (CEH) Practice Question

Session (or TCP) splicing is an IDS-evasion method in which the attacker breaks a payload into numerous small TCP segments-often only a few bytes each-and sends them just fast enough for the target stack to reassemble them. Most signature-based IDS engines inspect packets individually or use limited buffering; they will not see the complete attack pattern and therefore fail to match it, allowing the injected commands to slip through and letting the attacker hijack the session successfully.

Tunneling Telnet inside HTTPS hides traffic content but cannot help if the IDS monitors connections before encryption or flags the tunneled protocol. Lowering the IP TTL so packets expire past the sensor can bypass network segments but will also prevent packets from reaching the victim host. Creating an ACK storm may desynchronize sequence numbers but does not fragment the payload and is more likely to trigger anomaly detection than to evade it.