tcpad status report #3
So, I’ve been offline for some days now and I’ll continue to be until the end of the month. Development of tcpad is going fine and I just committed a few days of work into Perforce. This new work includes parsing of the TCP options and further SEQ/ACK analysis.
SEQ/ACK analysis is probably the most challenging task of this project, so it hasn’t been finished yet.
The good news is that I’m learning a lot about TCP and its extensions and it’s being thrilling!
In other news, my TCP ECN work will most likely be committed to FreeBSD-CURRENT RSN. 
I just read about tcpad on a freebsd mailing. Is this for debugging IP stacks or acting as a potential sensor for network attacks? Or both?
thx
jim
30 Aug 08 at 12:21 am
tcpad is most useful for debugging TCP stacks. We don’t do data inspection, so detecting network attacks is not viable just by inspecting headers.
Rui Paulo
30 Aug 08 at 11:10 am