> Is the story here that ALG is a crude hack, which works by naively looking at each packet, without trying to parse the whole stream, and so is vulnerable to t

> Is the story here that ALG is a crude hack, which works by naively looking at each packet, without trying to parse the whole stream, and so is vulnerable to this kind of confusion? If so, there are presumably endless varieties of ways to fool it. Yes, ALGs basically try to understand the protocol while implementing as little of it as possible. They are likely always broken in some way, and there is almost always a better way to solve the problem they attempt to solve.