alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Tailscale DERP Relay Server in TLS SNI"; flow:established,to_server; tls.sni; content:"derp"; startswith; content:".tailscale.com"; fast_pattern; endswith; pcre:"/derp\d+[a-z]?\x2etailscale.com/"; reference:url,tailscale.com/docs/reference/derp-servers; classtype:misc-activity; sid:2071656; rev:1; metadata:created_at 2026_08_20, deployment Perimeter, confidence High, signature_severity Informational, updated_at 2026_08_20;)