Passive analysis of TCP anomalies