Three weeks reading pcap files and I still can't tell a normal handshake from an attack.