TCP receive window never auto-tuned across the flow (non-kernel stack)
net.tcp_static_window · convicts
What it catches
A behavioral TCP tell BELOW the SYN — the layer any SYN/TLS/UA/kernel-order spoof (incl. the os-spoof userspace-TCP forger) reaches. Every real OS kernel AUTO-TUNES its advertised receive window (it grows as the receiver buffers): GROUNDED live, a real curl kernel stack advertised 10+ distinct window values across a short two-request flow (645→2296 and climbing). A hand-rolled / userspace TCP that does not implement auto-tuning holds the window CONSTANT — the os-spoof forger hardcodes one value on every packet. The edge's WindowTracker records the distinct windows a source IP advertises on its established (non-SYN) segments; this fires when a flow sent >=12 such segments all with ONE window value (never grew). CORROBORATING (weight 0.4), not convicting: a minimal/embedded real stack, or a client that disabled window scaling, could also be static, and a very short flow may not have grown yet (hence the >=12-segment floor). Catches the userspace-stack-forger class the SYN-level tells (net.tcp_os_vs_ua / tcp_syn_anomaly) cannot — the forger can forge the SYN option layout + values but not a real kernel's window-growth DYNAMICS without reimplementing auto-tuning. GROUNDED LIVE: the edge's WindowTracker recorded the os-spoof userspace stack advertising ONE window value (64240) across its flow, while a real curl kernel advertised MULTIPLE (502,533,… and growing) — the static-vs-dynamic contrast is exactly as designed. EXPERIMENTAL: the >=12-segment floor is FP-conservative (a single small real flow can be near-static before its window grows, and a minimal/embedded stack could be static), so it fires on a SIZABLE static flow (a browser routed through the forger accumulates far more than 12 segments, all one value); the FP-safe floor + which real minimal stacks are static need real-traffic calibration.
Signals it reads
network.tcp_static_window
How it fires
present
Bypassed by 10
Frontier evaders that reach the detector uncaught (scored only suspicious, defeating every convicting tell) — this check is not one that stops them. The red-team frontier this detection still has to convict.