This paper presents a passive end-to-end loss monitoring method, which relies on traffic monitoring at a core or ingress router interface. The monitoring node captures the packets of TCP connections generated by end-hosts. Based on the seen sequence number pattern the loss ratios are estimated for the two segments of end-to-end path divided by the monitor. This feature is especially useful if the monitoring node is placed at the border of an autonomous system, e.g., at the egress point of an ISP. When applied to mobile Internet access, packet losses on the radio interface can be distinguished from losses in the core network or in the public Internet. The packet loss estimation algorithm is rigorously validated using simulations and testbed measurements. Additionally, measurement results and an application example in a dial-up ISP are presented.