On inferring TCP behavior