In a recent interview, my friend was asked about firewalls’ TCP sequence number randomization feature. The interviewer mentioned that we know that a firewall randomizes the TCP sequence number, but an attacker in the middle can still sniff that packet on the wire and send it on behalf of the sender. So what does randomization bring to the table?
I have studied this attack against sequence numbers in RFC 6528 but haven’t been able to grasp the concept fully.
I would appreciate help in understanding this.