For instance, some hostsmay
choose a random identification number, and others may simply increment the
identification number for every packet. Assuming the source host simply increments
the identification field for every packet, the identification number in
the probe response should be near the identification number of the suspicious
packet; otherwise, the suspicious packet was a spoofing packet. Unfortunately,
if the source host sets the identification field in a more complicated manner,
it may be difficult or impossible to decide whether or not a suspicious packet
carries a spoofed source address.