This little poor thing looks just odd. When you take a closer look, you will
see that port numbers and other TCP parameters of this packet are
actually... constructed of what should be the packet payload! Source port
and destination port, two 2-byte values that start every TCP header, are
18245 and 28261 - 0x4745, 0x5420 in network endian order. This translates to
ASCII string 'GET ', a beginning of a HTTP request. This kid has lost its
TCP header, but IP header (with protocol type set to TCP) and TCP payload
are still there... We started to see thousands of packets just like this one
somewhere in the middle of 2000, coming from many locations in Poland. After
some time, we realized that all were generated by a badly broken Nortel CVX
access servers deployed country-wide by the Polish Telecom. Firmware was
fixed within a month or so, but this priceless packet dump will live
forever.