IPS signature to log TCP retransmission

[howardsinc]

Hello Everyone,

Recently I've been researching on devloping an IPS signature that could log TCP retransmission. This would be used in correlation with times when link saturation is occuring.

Just would like some input from the community if anyone has already tried this or even has a signature already wrote.

Thanks,