{ "passive": { "client_ip": "216.73.216.248", "client_port": 50583, "is_ipv6": false, "ip_version": 4, "protocol": "HTTP/1.1", "tcp_mss": 1448, "tcp_mss_grade": { "mss": 1448, "label": "Excelente", "emoji": "🟢", "percent": 97, "mtu_implied": 1500, "description": "MTU 1500, timestamps ON — mais comum." }, "raw_snd_mss": 1448, "raw_rcv_mss": 536, "raw_adv_mss": 1448, "mtu_path": 1488, "mtu_expected": 1500, "mtu_gap": -12, "path_mtu_pmtud": 1500, "opt_timestamps": true, "opt_sack": true, "opt_wscale": true, "opt_ecn": false, "client_wscale": 7, "server_wscale": 9, "client_rwin_max": 8388480, "rtt_us": 168468, "rtt_ms": 168.468, "rttvar_us": 47392, "rttvar_ms": 47.392, "bdp_mbps": 398.34176223377733, "total_retrans": 0, "ipv6_type": null, "server_host": "45.165.82.13", "tls_version": "TLSv1_3", "tls_cipher": "TLS13_AES_256_GCM_SHA384" }, "findings": [ { "severity": "Ok", "category": "TCP MSS", "title": "Excelente — TCP MSS 1448 bytes (97% de qualidade)", "title_en": "Excellent — TCP MSS 1448 bytes (97% quality)", "description": "MTU 1500, timestamps ON — mais comum.\n\nTCP MSS (tcpi_snd_mss): 1448 bytes ← MSS real usado nos segmentos\ntcpi_rcv_mss: 536 bytes ← MSS para receber do cliente\ntcpi_advmss: 1448 bytes ← MSS anunciado pelo servidor\nMTU estimado do caminho: 1488 bytes\nReducao vs. Ethernet puro: 0 bytes", "description_en": "MTU 1500, timestamps ON — mais comum.\n\nTCP MSS (tcpi_snd_mss): 1448 bytes ← actual MSS used in segments\ntcpi_rcv_mss: 536 bytes ← MSS for receiving from client\ntcpi_advmss: 1448 bytes ← MSS announced by server\nEstimated path MTU: 1488 bytes\nReduction vs. pure Ethernet: 0 bytes", "fix_linux": null, "fix_linux_en": null, "fix_windows": null, "fix_windows_en": null, "fix_macos": null, "fix_macos_en": null, "verify_linux": "# Confirmar se o ss mostra o mesmo TCP MSS:\nss -tin dst 45.165.82.13 | grep mss\n# 'mss:XXXX' deve corresponder ao valor exibido acima", "verify_linux_en": "# Confirm ss shows same TCP MSS:\nss -tin dst 45.165.82.13 | grep mss\n# 'mss:XXXX' must match the value shown above", "verify_windows": "# Windows:\nnetsh interface tcp show global\nGet-NetTCPConnection -RemoteAddress 45.165.82.13 | Select-Object LocalAddress, RemoteAddress, State, AppliedSetting", "verify_windows_en": "# Windows:\nnetsh interface tcp show global\nGet-NetTCPConnection -RemoteAddress 45.165.82.13 | Select-Object LocalAddress, RemoteAddress, State, AppliedSetting", "verify_macos": "# macOS:\nsysctl net.inet.tcp.mssdflt\nsysctl net.inet.tcp.v6mssdflt", "verify_macos_en": "# macOS:\nsysctl net.inet.tcp.mssdflt\nsysctl net.inet.tcp.v6mssdflt" }, { "severity": "Ok", "category": "TCP Window", "title": "Window Scaling 2^7 = 128x | RWIN max 8191 KB", "title_en": "Window Scaling 2^7 = 128x | Max RWIN 8191 KB", "description": "RWIN maximo: 8388480 bytes (8191 KB).\nLimite de throughput:\n- A 10ms: 6711 Mbps\n- A 50ms: 1342 Mbps\n- A 100ms: 671 Mbps\n- A 200ms: 336 Mbps", "description_en": "Maximum RWIN: 8388480 bytes (8191 KB).\nThroughput limit:\n- At 10ms: 6711 Mbps\n- At 50ms: 1342 Mbps\n- At 100ms: 671 Mbps\n- At 200ms: 336 Mbps", "fix_linux": null, "fix_linux_en": null, "fix_windows": null, "fix_windows_en": null, "fix_macos": null, "fix_macos_en": null, "verify_linux": "# Linux:\nsysctl net.ipv4.tcp_rmem\nss -tin dst 45.165.82.13 | grep -E 'wscale|rcvq'", "verify_linux_en": "# Linux:\nsysctl net.ipv4.tcp_rmem\nss -tin dst 45.165.82.13 | grep -E 'wscale|rcvq'", "verify_windows": "# Windows:\nnetsh interface tcp show global", "verify_windows_en": "# Windows:\nnetsh interface tcp show global", "verify_macos": "# macOS:\nsysctl net.inet.tcp.recvspace\nsysctl net.inet.tcp.maxsockbuf", "verify_macos_en": "# macOS:\nsysctl net.inet.tcp.recvspace\nsysctl net.inet.tcp.maxsockbuf" }, { "severity": "Ok", "category": "TCP SACK", "title": "SACK habilitado (RFC 2018)", "title_en": "SACK enabled (RFC 2018)", "description": "Retransmissao seletiva ativa. Apenas segmentos perdidos sao reenviados.", "description_en": "Selective retransmission active. Only lost segments are resent.", "fix_linux": null, "fix_linux_en": null, "fix_windows": null, "fix_windows_en": null, "fix_macos": null, "fix_macos_en": null, "verify_linux": "sysctl net.ipv4.tcp_sack", "verify_linux_en": "sysctl net.ipv4.tcp_sack", "verify_windows": "netsh interface tcp show global", "verify_windows_en": "netsh interface tcp show global", "verify_macos": "sysctl net.inet.tcp.sack", "verify_macos_en": "sysctl net.inet.tcp.sack" }, { "severity": "Info", "category": "TCP Timestamps", "title": "Timestamps RFC 1323 ativos — reduz TCP MSS em 12 bytes (snd_mss=1448, advmss=1448)", "title_en": "Timestamps RFC 1323 active — reduces TCP MSS by 12 bytes (snd_mss=1448, advmss=1448)", "description": "Timestamps ativos explicam a diferenca entre os campos:\ntcpi_snd_mss = 1448 bytes (MSS efetivo — com desconto de 12 bytes)\ntcpi_advmss = 1448 bytes (MSS base — sem desconto de timestamps)\n\nBeneficios: medicao precisa de RTT (RTTM) e protecao PAWS.\nCusto: 12 bytes por segmento (0.8% do payload).\nRecomendacao: manter ativo — o custo e negligenciavel.", "description_en": "Active timestamps explain the difference between fields:\ntcpi_snd_mss = 1448 bytes (effective MSS — 12 bytes deducted)\ntcpi_advmss = 1448 bytes (base MSS — no timestamp deduction)\n\nBenefits: precise RTT measurement (RTTM) and PAWS protection.\nCost: 12 bytes per segment (0.8% of payload).\nRecomendation: keep active — the cost is negligible.", "fix_linux": null, "fix_linux_en": null, "fix_windows": null, "fix_windows_en": null, "fix_macos": null, "fix_macos_en": null, "verify_linux": "# Linux:\nsysctl net.ipv4.tcp_timestamps\n# 0=desligado, 1=ligado, 2=ligado sem echo\n\n# Confirmar diferenca entre snd_mss e advmss:\nss -tin dst 45.165.82.13", "verify_linux_en": "# Linux:\nsysctl net.ipv4.tcp_timestamps\n# 0=off, 1=on, 2=on without echo\n\n# Confirm snd_mss vs advmss difference:\nss -tin dst 45.165.82.13", "verify_windows": "# Windows:\nnetsh interface tcp show global", "verify_windows_en": "# Windows:\nnetsh interface tcp show global", "verify_macos": "# Capturar o handshake TCP com verbosidade maxima:\nsudo tcpdump -i any -nn -vvv 'host 45.165.82.13 and tcp[tcpflags] & tcp-syn != 0'\n\n# Observe na lista de 'options [...]' do pacote se existe o campo 'TS val ecr ' para confirmar se esta ativo.", "verify_macos_en": "# Capture the TCP handshake with maximum verbosity:\nsudo tcpdump -i any -nn -vvv 'host 45.165.82.13 and tcp[tcpflags] & tcp-syn != 0'\n\n# Look at the 'options [...]' list in the packet to see if 'TS val ecr ' is present to confirm if it is active." }, { "severity": "Info", "category": "ECN", "title": "ECN desabilitado", "title_en": "ECN disabled", "description": "Opcional. Util em redes com QoS/AQM modernos.", "description_en": "Optional. Useful in networks with modern QoS/AQM.", "fix_linux": "sysctl -w net.ipv4.tcp_ecn=1", "fix_linux_en": "sysctl -w net.ipv4.tcp_ecn=1", "fix_windows": "netsh interface tcp set global ecncapability=enabled", "fix_windows_en": "netsh interface tcp set global ecncapability=enabled", "fix_macos": "sudo sysctl -w net.inet.tcp.ecn_initiate_out=1", "fix_macos_en": "sudo sysctl -w net.inet.tcp.ecn_initiate_out=1", "verify_linux": "sysctl net.ipv4.tcp_ecn", "verify_linux_en": "sysctl net.ipv4.tcp_ecn", "verify_windows": "netsh interface tcp show global", "verify_windows_en": "netsh interface tcp show global", "verify_macos": "sysctl net.inet.tcp.ecn_initiate_out", "verify_macos_en": "sysctl net.inet.tcp.ecn_initiate_out" } ], "score": 100 }