Locating smart TCP attacks