A network computing system , comprising: a network adapter configured to transmit and receive data via a transport protocol; a memory device configured to at least temporarily store data received at the network adapter; a processor configured to process at least some of the received data, including: applying one or more transport protocol heuristics to selective acknowledgement, SACK, messages received at the network adapter from a network node , the transport protocol heuristics identifying one or more threshold values for operational functions that are performed when processing the SACK messages; determining , by applying the one or more transport protocol heuristics to the SACK messages received from the network node, that the threshold values for one or more of the transport protocol heuristics have been reached, wherein the determining further includes determining that the network node is attempting to acknowledge a plurality of send attempts to increase the size of a sendmap; and in response to determining that one or more of the threshold values have been reached: identifying the network node as a security threat; and taking one or more remedial actions to mitigate the security threat associated with the identified network node. a network adapter configured to transmit and receive data via a transport protocol; a memory device configured to at least temporarily store data received at the network adapter; a processor configured to process at least some of the received data, including: applying one or more transport protocol heuristics to selective acknowledgement, SACK, messages received at the network adapter from a network node , the transport protocol heuristics identifying one or more threshold values for operational functions that are performed when processing the SACK messages; determining , by applying the one or more transport protocol heuristics to the SACK messages received from the network node, that the threshold values for one or more of the transport protocol heuristics have been reached, wherein the determining further includes determining that the network node is attempting to acknowledge a plurality of send attempts to increase the size of a sendmap; and in response to determining that one or more of the threshold values have been reached: identifying the network node as a security threat; and taking one or more remedial actions to mitigate the security threat associated with the identified network node. applying one or more transport protocol heuristics to selective acknowledgement, SACK, messages received at the network adapter from a network node , the transport protocol heuristics identifying one or more threshold values for operational functions that are performed when processing the SACK messages; determining , by applying the one or more transport protocol heuristics to the SACK messages received from the network node, that the threshold values for one or more of the transport protocol heuristics have been reached, wherein the determining further includes determining that the network node is attempting to acknowledge a plurality of send attempts to increase the size of a sendmap; and in response to determining that one or more of the threshold values have been reached: identifying the network node as a security threat; and taking one or more remedial actions to mitigate the security threat associated with the identified network node. identifying the network node as a security threat; and taking one or more remedial actions to mitigate the security threat associated with the identified network node. <EOS>