{
  "passive": {
    "client_ip": "216.73.216.115",
    "client_port": 18501,
    "is_ipv6": false,
    "ip_version": 4,
    "protocol": "HTTP/1.1",
    "tcp_mss": 1448,
    "tcp_mss_grade": {
      "mss": 1448,
      "label": "Excelente",
      "emoji": "🟢",
      "percent": 97,
      "mtu_implied": 1500,
      "description": "MTU 1500, timestamps ON — mais comum."
    },
    "raw_snd_mss": 1448,
    "raw_rcv_mss": 536,
    "raw_adv_mss": 8948,
    "mtu_path": 8988,
    "mtu_expected": 1500,
    "mtu_gap": 7488,
    "path_mtu_pmtud": 9000,
    "opt_timestamps": true,
    "opt_sack": true,
    "opt_wscale": true,
    "opt_ecn": false,
    "client_wscale": 7,
    "server_wscale": 14,
    "client_rwin_max": 8388480,
    "rtt_us": 141558,
    "rtt_ms": 141.558,
    "rttvar_us": 29876,
    "rttvar_ms": 29.876,
    "bdp_mbps": 474.0660365362608,
    "total_retrans": 0,
    "ipv6_type": null,
    "server_host": "177.11.98.12"
  },
  "findings": [
    {
      "severity": "Ok",
      "category": "TCP MSS",
      "title": "Excelente — TCP MSS 1448 bytes (97% de qualidade)",
      "title_en": "Excellent — TCP MSS 1448 bytes (97% quality)",
      "description": "MTU 1500, timestamps ON — mais comum.\n\nTCP MSS (tcpi_snd_mss): 1448 bytes  ← MSS real usado nos segmentos\ntcpi_rcv_mss:           536 bytes  ← MSS para receber do cliente\ntcpi_advmss:            8948 bytes  ← MSS anunciado pelo servidor\nMTU estimado do caminho: 8988 bytes\nReducao vs. Ethernet puro: 0 bytes",
      "description_en": "MTU 1500, timestamps ON — mais comum.\n\nTCP MSS (tcpi_snd_mss): 1448 bytes  ← actual MSS used in segments\ntcpi_rcv_mss:           536 bytes  ← MSS for receiving from client\ntcpi_advmss:            8948 bytes  ← MSS announced by server\nEstimated path MTU: 8988 bytes\nReduction vs. pure Ethernet: 0 bytes",
      "fix_linux": null,
      "fix_linux_en": null,
      "fix_windows": null,
      "fix_windows_en": null,
      "fix_macos": null,
      "fix_macos_en": null,
      "verify_linux": "# Confirmar se o ss mostra o mesmo TCP MSS:\nss -tin dst 177.11.98.12 | grep mss\n# 'mss:XXXX' deve corresponder ao valor exibido acima",
      "verify_linux_en": "# Confirm ss shows same TCP MSS:\nss -tin dst 177.11.98.12 | grep mss\n# 'mss:XXXX' must match the value shown above",
      "verify_windows": "# Windows:\nnetsh interface tcp show global\nGet-NetTCPConnection -RemoteAddress 177.11.98.12 | Select-Object LocalAddress, RemoteAddress, State, AppliedSetting",
      "verify_windows_en": "# Windows:\nnetsh interface tcp show global\nGet-NetTCPConnection -RemoteAddress 177.11.98.12 | Select-Object LocalAddress, RemoteAddress, State, AppliedSetting",
      "verify_macos": "# macOS:\nsysctl net.inet.tcp.mssdflt\nsysctl net.inet.tcp.v6mssdflt",
      "verify_macos_en": "# macOS:\nsysctl net.inet.tcp.mssdflt\nsysctl net.inet.tcp.v6mssdflt"
    },
    {
      "severity": "Ok",
      "category": "TCP Window",
      "title": "Window Scaling 2^7 = 128x | RWIN max 8191 KB",
      "title_en": "Window Scaling 2^7 = 128x | Max RWIN 8191 KB",
      "description": "RWIN maximo: 8388480 bytes (8191 KB).\nLimite de throughput:\n- A 10ms:  6711 Mbps\n- A 50ms:  1342 Mbps\n- A 100ms: 671 Mbps\n- A 200ms: 336 Mbps",
      "description_en": "Maximum RWIN: 8388480 bytes (8191 KB).\nThroughput limit:\n- At 10ms:  6711 Mbps\n- At 50ms:  1342 Mbps\n- At 100ms: 671 Mbps\n- At 200ms: 336 Mbps",
      "fix_linux": null,
      "fix_linux_en": null,
      "fix_windows": null,
      "fix_windows_en": null,
      "fix_macos": null,
      "fix_macos_en": null,
      "verify_linux": "# Linux:\nsysctl net.ipv4.tcp_rmem\nss -tin dst 177.11.98.12 | grep -E 'wscale|rcvq'",
      "verify_linux_en": "# Linux:\nsysctl net.ipv4.tcp_rmem\nss -tin dst 177.11.98.12 | grep -E 'wscale|rcvq'",
      "verify_windows": "# Windows:\nnetsh interface tcp show global",
      "verify_windows_en": "# Windows:\nnetsh interface tcp show global",
      "verify_macos": "# macOS:\nsysctl net.inet.tcp.recvspace\nsysctl net.inet.tcp.maxsockbuf",
      "verify_macos_en": "# macOS:\nsysctl net.inet.tcp.recvspace\nsysctl net.inet.tcp.maxsockbuf"
    },
    {
      "severity": "Ok",
      "category": "TCP SACK",
      "title": "SACK habilitado (RFC 2018)",
      "title_en": "SACK enabled (RFC 2018)",
      "description": "Retransmissao seletiva ativa. Apenas segmentos perdidos sao reenviados.",
      "description_en": "Selective retransmission active. Only lost segments are resent.",
      "fix_linux": null,
      "fix_linux_en": null,
      "fix_windows": null,
      "fix_windows_en": null,
      "fix_macos": null,
      "fix_macos_en": null,
      "verify_linux": "sysctl net.ipv4.tcp_sack",
      "verify_linux_en": "sysctl net.ipv4.tcp_sack",
      "verify_windows": "netsh interface tcp show global",
      "verify_windows_en": "netsh interface tcp show global",
      "verify_macos": "sysctl net.inet.tcp.sack",
      "verify_macos_en": "sysctl net.inet.tcp.sack"
    },
    {
      "severity": "Info",
      "category": "TCP Timestamps",
      "title": "Timestamps RFC 1323 ativos — reduz TCP MSS em 12 bytes (snd_mss=1448, advmss=8948)",
      "title_en": "Timestamps RFC 1323 active — reduces TCP MSS by 12 bytes (snd_mss=1448, advmss=8948)",
      "description": "Timestamps ativos explicam a diferenca entre os campos:\ntcpi_snd_mss = 1448 bytes  (MSS efetivo — com desconto de 12 bytes)\ntcpi_advmss  = 8948 bytes  (MSS base — sem desconto de timestamps)\n\nBeneficios: medicao precisa de RTT (RTTM) e protecao PAWS.\nCusto: 12 bytes por segmento (0.8% do payload).\nRecomendacao: manter ativo — o custo e negligenciavel.",
      "description_en": "Active timestamps explain the difference between fields:\ntcpi_snd_mss = 1448 bytes  (effective MSS — 12 bytes deducted)\ntcpi_advmss  = 8948 bytes  (base MSS — no timestamp deduction)\n\nBenefits: precise RTT measurement (RTTM) and PAWS protection.\nCost: 12 bytes per segment (0.8% of payload).\nRecomendation: keep active — the cost is negligible.",
      "fix_linux": null,
      "fix_linux_en": null,
      "fix_windows": null,
      "fix_windows_en": null,
      "fix_macos": null,
      "fix_macos_en": null,
      "verify_linux": "# Linux:\nsysctl net.ipv4.tcp_timestamps\n# 0=desligado, 1=ligado, 2=ligado sem echo\n\n# Confirmar diferenca entre snd_mss e advmss:\nss -tin dst 177.11.98.12",
      "verify_linux_en": "# Linux:\nsysctl net.ipv4.tcp_timestamps\n# 0=off, 1=on, 2=on without echo\n\n# Confirm snd_mss vs advmss difference:\nss -tin dst 177.11.98.12",
      "verify_windows": "# Windows:\nnetsh interface tcp show global",
      "verify_windows_en": "# Windows:\nnetsh interface tcp show global",
      "verify_macos": "sysctl net.inet.tcp.timestamps",
      "verify_macos_en": "sysctl net.inet.tcp.timestamps"
    },
    {
      "severity": "Info",
      "category": "ECN",
      "title": "ECN desabilitado",
      "title_en": "ECN disabled",
      "description": "Opcional. Util em redes com QoS/AQM modernos.",
      "description_en": "Optional. Useful in networks with modern QoS/AQM.",
      "fix_linux": "sysctl -w net.ipv4.tcp_ecn=1",
      "fix_linux_en": "sysctl -w net.ipv4.tcp_ecn=1",
      "fix_windows": "netsh interface tcp set global ecncapability=enabled",
      "fix_windows_en": "netsh interface tcp set global ecncapability=enabled",
      "fix_macos": "sudo sysctl -w net.inet.tcp.ecn_initiate_out=1",
      "fix_macos_en": "sudo sysctl -w net.inet.tcp.ecn_initiate_out=1",
      "verify_linux": "sysctl net.ipv4.tcp_ecn",
      "verify_linux_en": "sysctl net.ipv4.tcp_ecn",
      "verify_windows": "netsh interface tcp show global",
      "verify_windows_en": "netsh interface tcp show global",
      "verify_macos": "sysctl net.inet.tcp.ecn_initiate_out",
      "verify_macos_en": "sysctl net.inet.tcp.ecn_initiate_out"
    }
  ],
  "score": 100
}