Consider the following...
Alice and Bob are communicating over TCP. Currently, the next expected TCP sequence number is 1000. Charlie, pretending to be Alice, sends a spoofed TCP packet to Bob with a sequence number of 1003. Bob's computer holds onto this packet thinking that it arrived out of order. Meanwhile, Alice continues sending packets to Bob, sequenced as 1000, 1001, and 1002. Now, Bob's computer processes the spoofed TCP packet thinking it is the next in sequence.
In this scenario, assuming my understanding is correct, it seems that the attacker doesn't need to exactly predict the next sequence number, but rather just needs to guess the a sequence number that is greater than or equal to the current sequence, but also close enough to the sequence number so that it doesn't expire... as surely it won't hold on to the out-of-order packet forever.
This raises the following questions...
1) Is my understanding of the scenario I described correct?
2) What determines how long an out-of-order packet should be kept, while it waits for the previously sent packets?
3) What would happen to the TCP session when Alice finally sends a packet with TCP sequence 1003, given that Charlie's spoofed packet was already processed?