Вот, ношёл сингтуры для telegram'а в исходниках ndpi:
if (packet->payload_packet_len == 0)
return;
if (packet->tcp != NULL) {
if (packet->payload_packet_len > 56) {
dport = ntohs(packet->tcp->dest);
/* sport = ntohs(packet->tcp->source); */
if (packet->payload[0] == 0xef && (
dport == 443 || dport == 80 || dport == 25
)) {
if (packet->payload[1] == 0x7f) {
ndpi_int_telegram_add_connection(ndpi_struct, flow);
}
else if (packet->payload[1]*4 <= packet->payload_packet_len - 1) {
ndpi_int_telegram_add_connection(ndpi_struct, flow);
}
rejectboth tcp any any <> any any (dsize:>56;content: "|ef|";content: "|7f|"; sid:2462;)
