Because they can (allegedly) survive software upgrades (on the ASAs and IOS routers), I&#x27;ve always believed that these &quot;infections&quot; are done at a lower level than the OS, such as in the ROMMON on the IOS routers.<p>After hearing about &quot;SYNful Knock&quot; recently, I&#x27;m inclined to believe this even more.