Hacker News Reader

Sorry if this is obvious, but how do we know this isn't due to something more "innocent" like fragmentation?

Fragmentation doesn’t change the TCP checksum. The packet is reassembled and the original checksum verified against the rehydrated packet and TCP segment.

Reply on news.ycombinator.com