alert http $HOME_NET any -> any any (msg:"ET INFO Tailscale Control Pane Websocket Upgrade Request"; flow:established,to_server; http.header; to_lowercase; content:"sec-websocket-protocol|3a 20|ts2021"; fast_pattern; reference:url,tailscale.com/docs/how-to/set-up-custom-control-server; classtype:misc-activity; sid:2071768; rev:1; metadata:tls_state TLSDecrypt, created_at 2026_08_24, deployment Perimeter, deployment Internal, confidence High, signature_severity Informational, updated_at 2026_08_24;)