hi ahmad,
this is a rather artificial and academic attack possibility:
the attacker has to know the precise source/dest on L3 and L4 and then guesstimate the sequence number in order to exploit this.
since in XR BGP, the most likely potential for this "attack" because of long lived tcp sessions is protected heavily by LPTS with a full tupple of L3/L4 info and even possibility of TTL check in hardware (and if no match it will get dropped in hw also) there is a very small chance that someone may be able to get any possibly joy out of this.
Other TCP sessions such as telnet or ftp are too short lived for it to be even worth attacking/exploiting.
If you are truly concerned about this adding ttl security and possibly md5 for bgp will alleviate this all together.
regards!
xander
