LeeBrotherston/gist:92cc2637f33468485b8f

## gistfile1.txt
Match TLS Client Hello packets with a BPF:

IPv4 + TCP:                          (tcp[tcp[12]/16*4]=22 and (tcp[tcp[12]/16*4+5]=1) and (tcp[tcp[12]/16*4+9]=3) and (tcp[tcp[12]/16*4+1]=3))
IPv6 + TCP:                          (ip6[(ip6[52]/16*4)+40]=22 and (ip6[(ip6[52]/16*4+5)+40]=1) and (ip6[(ip6[52]/16*4+9)+40]=3) and (ip6[(ip6[52]/16*4+1)+40]=3))
Teredo
(IPv6 + TCP over IPv4 + UDP):        ((udp[14] = 6 and udp[16] = 32 and udp[17] = 1) and ((udp[(udp[60]/16*4)+48]=22) and (udp[(udp[60]/16*4)+53]=1) and (udp[(udp[60]/16*4)+57]=3) and (udp[(udp[60]/16*4)+49]=3)))
6in4 (IPv6 + TCP over IPv4):         (proto 41 and ip[26] = 6 and ip[(ip[72]/16*4)+60]=22 and (ip[(ip[72]/16*4+5)+60]=1) and (ip[(ip[72]/16*4+9)+60]=3) and (ip[(ip[72]/16*4+1)+60]=3)

Complete: (tcp[tcp[12]/16*4]=22 and (tcp[tcp[12]/16*4+5]=1) and (tcp[tcp[12]/16*4+9]=3) and (tcp[tcp[12]/16*4+1]=3)) or (ip6[(ip6[52]/16*4)+40]=22 and (ip6[(ip6[52]/16*4+5)+40]=1) and (ip6[(ip6[52]/16*4+9)+40]=3) and (ip6[(ip6[52]/16*4+1)+40]=3)) or ((udp[14] = 6 and udp[16] = 32 and udp[17] = 1) and ((udp[(udp[60]/16*4)+48]=22) and (udp[(udp[60]/16*4)+53]=1) and (udp[(udp[60]/16*4)+57]=3) and (udp[(udp[60]/16*4)+49]=3))) or (proto 41 and ip[26] = 6 and ip[(ip[72]/16*4)+60]=22 and (ip[(ip[72]/16*4+5)+60]=1) and (ip[(ip[72]/16*4+9)+60]=3) and (ip[(ip[72]/16*4+1)+60]=3))
	Match TLS Client Hello packets with a BPF:

	IPv4 + TCP: (tcp[tcp[12]/164]=22 and (tcp[tcp[12]/164+5]=1) and (tcp[tcp[12]/164+9]=3) and (tcp[tcp[12]/164+1]=3))
	IPv6 + TCP: (ip6[(ip6[52]/164)+40]=22 and (ip6[(ip6[52]/164+5)+40]=1) and (ip6[(ip6[52]/164+9)+40]=3) and (ip6[(ip6[52]/164+1)+40]=3))
	Teredo
	(IPv6 + TCP over IPv4 + UDP): ((udp[14] = 6 and udp[16] = 32 and udp[17] = 1) and ((udp[(udp[60]/164)+48]=22) and (udp[(udp[60]/164)+53]=1) and (udp[(udp[60]/164)+57]=3) and (udp[(udp[60]/164)+49]=3)))
	6in4 (IPv6 + TCP over IPv4): (proto 41 and ip[26] = 6 and ip[(ip[72]/164)+60]=22 and (ip[(ip[72]/164+5)+60]=1) and (ip[(ip[72]/164+9)+60]=3) and (ip[(ip[72]/164+1)+60]=3)

	Complete: (tcp[tcp[12]/164]=22 and (tcp[tcp[12]/164+5]=1) and (tcp[tcp[12]/164+9]=3) and (tcp[tcp[12]/164+1]=3)) or (ip6[(ip6[52]/164)+40]=22 and (ip6[(ip6[52]/164+5)+40]=1) and (ip6[(ip6[52]/164+9)+40]=3) and (ip6[(ip6[52]/164+1)+40]=3)) or ((udp[14] = 6 and udp[16] = 32 and udp[17] = 1) and ((udp[(udp[60]/164)+48]=22) and (udp[(udp[60]/164)+53]=1) and (udp[(udp[60]/164)+57]=3) and (udp[(udp[60]/164)+49]=3))) or (proto 41 and ip[26] = 6 and ip[(ip[72]/164)+60]=22 and (ip[(ip[72]/164+5)+60]=1) and (ip[(ip[72]/164+9)+60]=3) and (ip[(ip[72]/164+1)+60]=3))