Passive identification of TCP anomalies