> The port number of the Layer 4 connection cannot be determined without > executing IP fragment reassembly in that case. Routers normally > reassemble fragments they receive, if possible. No, routers normally do *not* reassemble fragments. This is typically done by hosts and firewalls. Steinar Haug, Nethelp consulting, sthaug at nethelp.no