>Notice that last sentence. The client is the only device which
>interprets the sequence field, so it's up to the client on how he wants to
encode
>the sequence field. Apparently Linux doesn't convert the 16-bit uint
>to network order, but keeps it in native order.
You are absolutely correct.
Incidentally, this is also true of the identification field in the IP
header, the one that is used to match fragments with each other. Although
many stacks implement this as a monotonically increasing integer, the
specifications do NOT require this. They basically say this is just a
'cookie' that is used to match packets up with each other, and nothing else
can be assumed about its contents. Sure enough, if you watch a Windows
box, it generates increasing *little endian* integers in the IP
identification field.
=====================================
Tim Farley
X-Force Researcher
mailto:tfarley@xxxxxxx
Direct: (678) 443-6189 / fax (678) 443-6498
=====================================
