added an attempt to detect TCP three way handshakes