A method and apparatus to determine whether data flow is restricted by a sending node, a receiving node, or by a network. One embodiment of the invention comprises selectively reading a Sequence Number field (SN) and a Data Offset field (DO) from a Transmission Control Protocol (TCP) header in a data packet from a sender to a receiver. Selectively reading a Total Length field (TL) and an Internet Header Length field (IHL) from an Internet protocol (IP) header in the data packet from the sender to the receiver. Selectively reading an Acknowledgment Number field (AN) and a Window field (W) from a TCP header in a data packet from the receiver to the sender. And, using at least one of the SN, DO, TL, IHL, AN, and W from a network communication session to determine whether the sender, the receiver, or whether the network restricts data flow.