| Hmm Strange indeed... Isnt the IPid new and random for every new TCP-Connect??
It should be, and if it is, how can the sniffer differ from the different conns an ordinary browser does??
It should be that the NAT-box get a (e.g) tcp-conn packet, remember the ipid "hmm ip-id blalba, and its coming from 10.0.0.x. I'll remember that". When the incoming packets are coming back "Uhh, ip-id blabla(incremented) that should go to 10.0.0.x" I dont get it. Isn't the number just an random one to start with?? |
