# about "reassembles IP fragments" **URL:** \ **Category:** Zeek\ **Created:** [October 22, 2004, 1:56am UTC](https://community.zeek.org/t/about-reassembles-ip-fragments/615 "2004-10-22T01:56:10Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Cliff1](https://avatars.discourse-cdn.com/v4/letter/c/c57346/32.png) [@Cliff1](https://community.zeek.org/u/Cliff1)\ **Post date:** [October 22, 2004, 1:56am UTC](https://community.zeek.org/t/about-reassembles-ip-fragments/615/1 "2004-10-22T01:56:10Z")
Hi all,     In Vern's paper,bro:a system for detecting network intruders in real-time,there are the following sentences:     "The resulting filtered packet stream is then handed up to the next layer, the Bro ``event engine.'' This layer first performs several integrity checks to assure that the packet headers are well-formed, including verifying the IP header checksum. If these checks fail, then Bro generates an event indicating the problem and discards the packet. It is also at this point that Bro reassembles IP fragments so it can then analyze complete IP datagrams."     Howerver,I can't find the implementation detail from source code,i.e."verifying the IP header checksum" and "reassembles IP fragments".     I wish get your help.Thanks a lot! Best Regards, Cliff ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [October 22, 2004, 8:16am UTC](https://community.zeek.org/t/about-reassembles-ip-fragments/615/2 "2004-10-22T08:16:56Z")
The fragment reassembler is in Frag.\*. Checksums are verified at multiple locations; try grepping for "\_checksum" Robin ---
**Author:** ![Christian\_Kreibich3](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)\ **Post date:** [October 22, 2004, 10:24am UTC](https://community.zeek.org/t/about-reassembles-ip-fragments/615/3 "2004-10-22T10:24:51Z")
Hi, ---
**Author:** ![Christian\_Kreibich3](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)\ **Post date:** [October 22, 2004, 10:29am UTC](https://community.zeek.org/t/about-reassembles-ip-fragments/615/4 "2004-10-22T10:29:42Z")
Hrm. Maybe I should learn to read my mails before replying 🙂 Cheers, Christian. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/about-reassembles-ip-fragments/615/5 "2022-05-06T15:37:13Z")