Global, Passive Detection of Connection Tampering