alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Tailscale Control Pane in TLS SNI"; flow:established,to_server; tls.sni; bsize:26; content:"controlplane.tailscale.com"; fast_pattern; nocase; reference:url,tailscale.com/docs/how-to/set-up-custom-control-server; classtype:misc-activity; sid:2071648; rev:1; metadata:created_at 2026_08_20, deployment Perimeter, confidence High, signature_severity Informational, updated_at 2026_08_20;)