Suricata

https://access.redhat.com/articles/3553061

Interestingly, on the Linux kernel side they have decided that IP fragment overlaps are never benign and they are starting to drop those packets. Perhaps we can simply do the same, while raising an event and incrementing some counter. Or perhaps a one time warning.