One basic technique is to split the attack payload into multiple small packets, so that the IDS must reassemble the packet stream to detect the attack.

By itself, small packets will not evade any IDS that reassembles packet streams.

The basic assumption behind dense mode is that the multicast packet stream has receivers at most locations.

This is fine for low volume multicast, but not higher bandwidth multicast packet streams.

Pattern matching - the ability to find specific patterns of bits or bytes within packets in a packet stream.

These modified packets can be saved in packet streams which may be stored in pcap files to be replayed later.

Losses between 5% and 10% of the total packet stream will affect the quality significantly.

PIM dense mode is the mode of Protocol Independent Multicast which assumes that almost all receivers receive this packet stream.

These technologies scan packet streams and look for offending patterns.

The Failure packet allows the sender to indicate various problems inside the packet stream.