I'm a network engineer, from time to time I diagnose problems using a LAN analyser.
I seen several win2k servers on different customer sites generating 2 identical IP packets, even with the same IP id.
So say you trace a telnet session, to the server you see 1 packet, but the reply is 2...