How to Blocking ULtrasurf?

You might try adding some debug logging of [TCP::payload 11] as that should return 11 bytes of the collected payload. I don't see how binary scan wouldn't return a value for payload_hex if [TCP::payload 11] returns 11 bytes.

 

 

Anyhow, can you try logging this:

 

 

[binary scan [TCP::payload 11] H* payload_hex]

 

 

If that returns more than 22 characters, you might try replacing the H22 with H* and use

 

 

if {[class match $payload_hex contains signature_clientsslhello]} {

 

 

Aaron