qisniff sniffs for quantum injection (http://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-insert/).
It does this by assembling the streams in temporary files, and comparing incoming packets covering already received segments of the stream with the already received data.
Differences in this data is indicative of trickery.
Tools that can detect this are relatively rare.
Fox IT (see link above) devised a potential detection method, but state
Note that these detection methods are possibly not evasion proof, one could also easily spoof a FIN packet after the QI packet to close the session. This would stop tracking the TCP segments in most IDS systems. Later packets in this stream will not be matched with previous packets.
Other possibilities is to try to create a partial overlap of data, thus avoiding detection of duplicate sequence numbers.
qisniff doesn't close sessions at FIN packets, and it doesn't use sequence numbers directly to detect overlaps, so qisniff will detect all incoming QI packet insertions.
Sniffing a pcap file from a suspected injection by the great firewall of china:
Sniffing a pcap file from a FIN flagged injection packet (which will make most analysis tools drop the later duplicate packet):
$go run qisniff.go -file linkedin_FIN.pcap / 184.108.40.206:80(http)->10.0.1.4:54015 4114717474 <A> HTTP/1.1 302 Found Location: http://fox-it.com/ Content-Length: 0 </A> <B> HTTP/1.1 301 Moved Permanently Date: Tue, 21 Apr 2015 00:40:01 GMT X- </B>