From: grahn+nntp@snipabacken.se   
      
   On Tue, 2009-11-03, Noah Davids wrote:   
   > Pascal Hambourg wrote:   
   >> Hello,   
   >>   
   >> Noah Davids a écrit :   
   >>> Can anyone suggest what type of device would rewrite sequence numbers in   
   >>> a connection.   
   >>   
   >> Stateful firewalls and NAT devices.   
   > I thought of a NAT device but since the IP addresses and port numbers   
   > are unchanged it didn't seem likely. Are you suggesting that a NAT   
   > device might not rewrite addresses and port numbers?   
   >   
   > As far as a stateful firewall, I thought of that as well but I couldn't   
   > think of a reason why it would bother to rewrite the sequence numbers   
   > but leave everything else unchanged. Is there a reason?   
      
   Don't know ... Whatever it is, it is stateful, and spends a lot of   
   resources on this.  Your data must be valuable to this third party   
   somehow ...   
      
   Does this happen on "popular" ports only, or on any TCP ports?   
      
      (I assume you are not simply misinterpreting the snooped traffic?   
      Tcpdump/Wireshark/etc often try to be user-friendly by showing the   
      sequence numbers as if they started on 0.)   
      
   /Jorgen   
      
   --   
     // Jorgen Grahn    O  o   .   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)