Many TCP/IP implementations follow a predictable pattern for picking sequence numbers. When a host is bootstrapped, the initial sequence number is 1. The initial sequence number is incremented by 128,000 every second, which causes the 32-bit initial sequence number counter to wrap every hours if no connections occur. Each time a connection is initiated, however, the counter is incremented by 64,000. If sequence numbers were chosen at random when a connection arrived, no guarantees could be made that the sequence numbers would be different from a previous incarnation. If an attacker wants to determine the sequencing pattern, all she has to.
