LeeBrotherston · February 21, 2016 05:38
diff --git a/gistfile1.txt b/gistfile1.txt
 Match TLS Client Hello packets with a BPF:

 IPv4 + TCP:                          (tcp[tcp[12]/16*4]=22 and (tcp[tcp[12]/16*4+5]=1) and (tcp[tcp[12]/16*4+9]=3) and (tcp[tcp[12]/16*4+1]=3))
 IPv6 + TCP:                          (ip6[(ip6[52]/16*4)+40]=22 and (ip6[(ip6[52]/16*4+5)+40]=1) and (ip6[(ip6[52]/16*4+9)+40]=3) and (ip6[(ip6[52]/16*4+1)+40]=3))
 Teredo 
 (IPv6 + TCP over IPv4 + UDP):        ((udp[14] = 6 and udp[16] = 32 and udp[17] = 1) and ((udp[(udp[60]/16*4)+48]=22) and (udp[(udp[60]/16*4)+53]=1) and (udp[(udp[60]/16*4)+57]=3) and (udp[(udp[60]/16*4)+49]=3)))
 6in4 (IPv6 + TCP over IPv4):         (proto 41 and ip[26] = 6 and ip[(ip[72]/16*4)+60]=22 and (ip[(ip[72]/16*4+5)+60]=1) and (ip[(ip[72]/16*4+9)+60]=3) and (ip[(ip[72]/16*4+1)+60]=3)

 Complete: (tcp[tcp[12]/16*4]=22 and (tcp[tcp[12]/16*4+5]=1) and (tcp[tcp[12]/16*4+9]=3) and (tcp[tcp[12]/16*4+1]=3)) or (ip6[(ip6[52]/16*4)+40]=22 and (ip6[(ip6[52]/16*4+5)+40]=1) and (ip6[(ip6[52]/16*4+9)+40]=3) and (ip6[(ip6[52]/16*4+1)+40]=3)) or ((udp[14] = 6 and udp[16] = 32 and udp[17] = 1) and ((udp[(udp[60]/16*4)+48]=22) and (udp[(udp[60]/16*4)+53]=1) and (udp[(udp[60]/16*4)+57]=3) and (udp[(udp[60]/16*4)+49]=3))) or (proto 41 and ip[26] = 6 and ip[(ip[72]/16*4)+60]=22 and (ip[(ip[72]/16*4+5)+60]=1) and (ip[(ip[72]/16*4+9)+60]=3) and (ip[(ip[72]/16*4+1)+60]=3))
	Match TLS Client Hello packets with a BPF:

	IPv4 + TCP: (tcp[tcp[12]/164]=22 and (tcp[tcp[12]/164+5]=1) and (tcp[tcp[12]/164+9]=3) and (tcp[tcp[12]/164+1]=3))
	IPv6 + TCP: (ip6[(ip6[52]/164)+40]=22 and (ip6[(ip6[52]/164+5)+40]=1) and (ip6[(ip6[52]/164+9)+40]=3) and (ip6[(ip6[52]/164+1)+40]=3))
	Teredo
	(IPv6 + TCP over IPv4 + UDP): ((udp[14] = 6 and udp[16] = 32 and udp[17] = 1) and ((udp[(udp[60]/164)+48]=22) and (udp[(udp[60]/164)+53]=1) and (udp[(udp[60]/164)+57]=3) and (udp[(udp[60]/164)+49]=3)))
	6in4 (IPv6 + TCP over IPv4): (proto 41 and ip[26] = 6 and ip[(ip[72]/164)+60]=22 and (ip[(ip[72]/164+5)+60]=1) and (ip[(ip[72]/164+9)+60]=3) and (ip[(ip[72]/164+1)+60]=3)

	Complete: (tcp[tcp[12]/164]=22 and (tcp[tcp[12]/164+5]=1) and (tcp[tcp[12]/164+9]=3) and (tcp[tcp[12]/164+1]=3)) or (ip6[(ip6[52]/164)+40]=22 and (ip6[(ip6[52]/164+5)+40]=1) and (ip6[(ip6[52]/164+9)+40]=3) and (ip6[(ip6[52]/164+1)+40]=3)) or ((udp[14] = 6 and udp[16] = 32 and udp[17] = 1) and ((udp[(udp[60]/164)+48]=22) and (udp[(udp[60]/164)+53]=1) and (udp[(udp[60]/164)+57]=3) and (udp[(udp[60]/164)+49]=3))) or (proto 41 and ip[26] = 6 and ip[(ip[72]/164)+60]=22 and (ip[(ip[72]/164+5)+60]=1) and (ip[(ip[72]/164+9)+60]=3) and (ip[(ip[72]/164+1)+60]=3))