What it detects
The same segment retransmitted above threshold.
Why it fires
Mostly congestion or loss, but low-and-slow DoS or keep-alive abuse is possible.
Worst case
Link degradation · resource drain
Matching signatures
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.