Comment by jsmthrowaway

That can false-positive, for what it's worth, in servers with fixed TLS heartbeats (instead of removing them).