Regardless of how new&#x2F;old this is, shouldn&#x27;t TCP Timestamps provide some degree of protection against this too? If the spoofing host&#x27;s TSval is less than the real host&#x27;s TSval, the spoofed traffic will just be dropped as being &quot;from the past&quot;. I&#x27;m not immediately sure if there&#x27;s a limit to how much &quot;into the future&quot; the next TSval can be.