How often does it happen that we benignly see a TCP packet that is retransmitted but has a different payload the second time?
In other words, how often is it that we see a TCP packet with sequence number S, then later see a second TCP packet with sequence number S but with different (inconsistent) payload data? How often does this happen benignly, not due to an attack?
Motivation: This kind of scenario occurs in some IDS evasion attacks. Some IDS's can be fooled if an attacker sends a TCP packet with harmless payload, then immediately sends a second TCP packet with the same sequence number but now containing a malicious payload. One plausible, naive defense is for the IDS to alert whenever it sees a retransmission that carries a different payload than the original. That raises the question of how many false alerts this will trigger. I have read some older research papers which claim that this happens in the field for benign reasons fairly regularly and thus the false alert rate of the naive defense would be too high. I am wondering if this is accurate, and if it is, just how frequently this happens (excluding attacks).