On Fri, 6 May 2016, Jonathan Morton wrote: >> On 6 May, 2016, at 21:50, David Lang wrote: >> >> what IP id are you referring to? I don't remember any such field in the packet header. > > It’s the third halfword. half a word is hardly enough to be unique across the Internet, anything that small would lead to lots of attackes that inserted garbage data into threads. looking at the IP header, the minimum size header includes fragment offset, source and destination IP addresses, and I'd bet a lot of money that every fragment of TCP/UDP includes the port numbers as well because there is just not enough into in the 20 byte header to identify what it matches with. and I don't see this field you are talking about. http://www.erg.abdn.ac.uk/users/gorry/course/inet-pages/ip-packet.html David Lang