TLS protocol detection by using client hello message

Question

I need to detect https packets in network traffic . Until now I were marking all "443" as https but I don't want to use port information for this case any more .

Will it be enough to check client hello message like :

//Check 22 and version info 0300 0301 or 0302
if (packet->payload[0] == 0x16 && packet->payload[1] == 0x03
  && (packet->payload[2] == 0x00 || packet->payload[2] == 0x01 || packet->payload[2] == 0x02)

{
    int temp = ntohs(get_u16(packet->payload, 3)) + 5;//Get lenght 
    //Check lenght is valid and 6th byte is client hello(which is 1)
    if (temp < packet->payload_length && temp > 50 && packet->payload[5]) == 1) 
        MARK AS HTTPS 
}

Because of my project design, I can't check more than one packet. Can you please advise if just checking client hello like above is ok or not ?

Answer 1

Because of my project design, I can't check more than one package . Can you please advise if just checking client hello like above is ok or not ?

I assume you mean "packet" not "package." Given that we're using TCP here, being able to reassemble fragmented messages is essential. So long as you have a tool which only operates on single packets, you cannot expect to reliably (as in 100% of the time) detect message content longer than a single byte. That's because it's perfectly legal for the TCP sender to dribble the bytes to you one-by-one...so you need to be prepared to reassemble them or know that you'll miss some information.