Diagnostic programs are commonly available that record the first 100 bytes, say, of every TCP connection to a certain host, port. Outline what must be done with each received TCP packet, P, in order to determine if it contains data that belong to the first 100 bytes of a connection to host HOST, port PORT. Assume the IP header is P.IPHEAD, the TCP header is P.TCPHEAD, and header fields are as named in Figures 3.17 and 5.4. To get initial sequence numbers (ISNs), you will have to examine every packet with the SYN bit set. Ignore the fact that sequence numbers will eventually be reused.

Figures 3.17)

Figures 5.4)

0 4 Version HLen Ident TTL 8 TOS Protocol 16 SourceAddr Flags Options (variable) 19 DestinationAddr Data Length Offset Checksum Pad (variable) 31