From: ndav1@cox.net   
      
   Jorgen Grahn wrote:   
   > On Tue, 2009-11-03, Noah Davids wrote:   
   >> Pascal Hambourg wrote:   
   >>> Hello,   
   >>>   
   >>> Noah Davids a écrit :   
   >>>> Can anyone suggest what type of device would rewrite sequence numbers in   
   >>>> a connection.   
   >>> Stateful firewalls and NAT devices.   
   >> I thought of a NAT device but since the IP addresses and port numbers   
   >> are unchanged it didn't seem likely. Are you suggesting that a NAT   
   >> device might not rewrite addresses and port numbers?   
   >>   
   >> As far as a stateful firewall, I thought of that as well but I couldn't   
   >> think of a reason why it would bother to rewrite the sequence numbers   
   >> but leave everything else unchanged. Is there a reason?   
   >   
   > Don't know ... Whatever it is, it is stateful, and spends a lot of   
   > resources on this.  Your data must be valuable to this third party   
   > somehow ...   
   >   
   > Does this happen on "popular" ports only, or on any TCP ports?   
   >   
   >    (I assume you are not simply misinterpreting the snooped traffic?   
   >    Tcpdump/Wireshark/etc often try to be user-friendly by showing the   
   >    sequence numbers as if they started on 0.)   
   >   
   > /Jorgen   
   >   
      
   The ports that this was first notice on where not your typical ports. I   
   was trying to match up packets from both sides of the network to   
   understand a performance issue. As I test I tried a connection to the   
   echo port and saw the same behavior starting with the initial SYN packet.   
      
   I think I found the performance problem but now I need to figure out why   
   and what.   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)