detection
high
An explicitly test-labeled MAAT signature ("test_wireguard_ww_2", signatureDesc "wireguard_tcp_payload") fingerprints WireGuard's handshake-initiation message by its fixed leading bytes (hex 01000000 = message type 1 + zeroed reserved field), matched both against raw UDP payloads (client-to-server and server-to-client first packets, left-anchored) and against a TCP-encapsulated variant (same pattern at a fixed sub-offset/depth within the TCP payload). This shows active development of WireGuard detection covering both native UDP and TCP-tunneled deployments.
dpi