Maybe detecting QI is actually hard? You need a buffer of TCP data, that was possibly already passed to application. 1) Is there a kernel patch yet? 2) "Honey

Maybe detecting QI is actually hard? You need a buffer of TCP data, that was possibly already passed to application. 1) Is there a kernel patch yet? 2) "HoneyBadger is a passive TCP protocol analyzer whose only purpose in life is to detect and optionally record TCP injection attacks." https://github.com/david415/HoneyBadger_docs/blob/hackpad1/source/how-to-badger-the-puppet-masters.rst#tcp-injection-attack-categories https://github.com/david415/HoneyBadger_docs/blob/hackpad1/s...