so your saying that in TCP, a connection orientated protocol, at each hop the router/firewall/kernel is _not_ doing basic validation to see if that connection

so your saying that in TCP, a connection orientated protocol, at each hop the router/firewall/kernel is _not_ doing basic validation to see if that connection is valid, and not coming from a spurious source? The client does all this when you open socket.connect()? no, no, you're not and no, it doesn't, which is part of my point. Lots more noise will be forwarded to the client directly, after all, stateful connection management is impossible. With more noise, comes a bigger attack surface.