alert http $HOME_NET any -> any any (msg:"ET INFO Tailscale DERP Websocket Upgrade Request"; flow:established,to_server; http.header; content:"sec-websocket-protocol|3a 20|derp"; fast_pattern; nocase; reference:url,tailscale.com/docs/reference/derp-servers; classtype:misc-activity; sid:2071769; rev:1; metadata:tls_state TLSDecrypt, created_at 2026_08_24, deployment Perimeter, deployment Internal, confidence High, signature_severity Informational, updated_at 2026_08_24;)