I'm trying to verify an answer I posted to a recent question:
Client A with real IP has connected ... Now, the attacker machine M sends a [data] packet [with a correct sequential identifier] spoofing the IP address of A ... Will the ACK flag/field from server S be accepted by A?
For passive attacks the answer is no. The client will not accept the Acknowledgement (from the Server) for a data packet which it did not send. (the attacker sent it instead)
However, would the connection be able to continue? The client will eventually send another Data packet with the same sequential identifier (that the attacker used) which the Server just Acknowledged.
I assume the server does not log previously acknowledged data, and would simply repeat the acknowledgement, dropping the new Data packet (on the basis of the duplicated sequential identifier) without realizing that the new data is different. Is this correct? Or, is this implementation-dependent?