First Commit

2026-02-11 06:27:36 +05:30
commit 94e1e26cc3
56 changed files with 8530 additions and 0 deletions
--- a/analyzer/interface.go
+++ b/analyzer/interface.go
@@ -0,0 +1,131 @@
+package analyzer
+
+import (
+	"net"
+	"strings"
+)
+
+type Analyzer interface {
+	// Name returns the name of the analyzer.
+	Name() string
+	// Limit returns the byte limit for this analyzer.
+	// For example, an analyzer can return 1000 to indicate that it only ever needs
+	// the first 1000 bytes of a stream to do its job. If the stream is still not
+	// done after 1000 bytes, the engine will stop feeding it data and close it.
+	// An analyzer can return 0 or a negative number to indicate that it does not
+	// have a hard limit.
+	// Note: for UDP streams, the engine always feeds entire packets, even if
+	// the packet is larger than the remaining quota or the limit itself.
+	Limit() int
+}
+
+type Logger interface {
+	Debugf(format string, args ...interface{})
+	Infof(format string, args ...interface{})
+	Errorf(format string, args ...interface{})
+}
+
+type TCPAnalyzer interface {
+	Analyzer
+	// NewTCP returns a new TCPStream.
+	NewTCP(TCPInfo, Logger) TCPStream
+}
+
+type TCPInfo struct {
+	// SrcIP is the source IP address.
+	SrcIP net.IP
+	// DstIP is the destination IP address.
+	DstIP net.IP
+	// SrcPort is the source port.
+	SrcPort uint16
+	// DstPort is the destination port.
+	DstPort uint16
+}
+
+type TCPStream interface {
+	// Feed feeds a chunk of reassembled data to the stream.
+	// It returns a prop update containing the information extracted from the stream (can be nil),
+	// and whether the analyzer is "done" with this stream (i.e. no more data should be fed).
+	Feed(rev, start, end bool, skip int, data []byte) (u *PropUpdate, done bool)
+	// Close indicates that the stream is closed.
+	// Either the connection is closed, or the stream has reached its byte limit.
+	// Like Feed, it optionally returns a prop update.
+	Close(limited bool) *PropUpdate
+}
+
+type UDPAnalyzer interface {
+	Analyzer
+	// NewUDP returns a new UDPStream.
+	NewUDP(UDPInfo, Logger) UDPStream
+}
+
+type UDPInfo struct {
+	// SrcIP is the source IP address.
+	SrcIP net.IP
+	// DstIP is the destination IP address.
+	DstIP net.IP
+	// SrcPort is the source port.
+	SrcPort uint16
+	// DstPort is the destination port.
+	DstPort uint16
+}
+
+type UDPStream interface {
+	// Feed feeds a new packet to the stream.
+	// It returns a prop update containing the information extracted from the stream (can be nil),
+	// and whether the analyzer is "done" with this stream (i.e. no more data should be fed).
+	Feed(rev bool, data []byte) (u *PropUpdate, done bool)
+	// Close indicates that the stream is closed.
+	// Either the connection is closed, or the stream has reached its byte limit.
+	// Like Feed, it optionally returns a prop update.
+	Close(limited bool) *PropUpdate
+}
+
+type (
+	PropMap         map[string]interface{}
+	CombinedPropMap map[string]PropMap
+)
+
+// Get returns the value of the property with the given key.
+// The key can be a nested key, e.g. "foo.bar.baz".
+// Returns nil if the key does not exist.
+func (m PropMap) Get(key string) interface{} {
+	keys := strings.Split(key, ".")
+	if len(keys) == 0 {
+		return nil
+	}
+	var current interface{} = m
+	for _, k := range keys {
+		currentMap, ok := current.(PropMap)
+		if !ok {
+			return nil
+		}
+		current = currentMap[k]
+	}
+	return current
+}
+
+// Get returns the value of the property with the given analyzer & key.
+// The key can be a nested key, e.g. "foo.bar.baz".
+// Returns nil if the key does not exist.
+func (cm CombinedPropMap) Get(an string, key string) interface{} {
+	m, ok := cm[an]
+	if !ok {
+		return nil
+	}
+	return m.Get(key)
+}
+
+type PropUpdateType int
+
+const (
+	PropUpdateNone PropUpdateType = iota
+	PropUpdateMerge
+	PropUpdateReplace
+	PropUpdateDelete
+)
+
+type PropUpdate struct {
+	Type PropUpdateType
+	M    PropMap
+}
--- a/analyzer/internal/tls.go
+++ b/analyzer/internal/tls.go
@@ -0,0 +1,224 @@
+package internal
+
+import (
+	"git.difuse.io/Difuse/Mellaris/analyzer"
+	"git.difuse.io/Difuse/Mellaris/analyzer/utils"
+)
+
+// TLS record types.
+const (
+	RecordTypeHandshake = 0x16
+)
+
+// TLS handshake message types.
+const (
+	TypeClientHello = 0x01
+	TypeServerHello = 0x02
+)
+
+// TLS extension numbers.
+const (
+	extServerName           = 0x0000
+	extALPN                 = 0x0010
+	extSupportedVersions    = 0x002b
+	extEncryptedClientHello = 0xfe0d
+)
+
+func ParseTLSClientHelloMsgData(chBuf *utils.ByteBuffer) analyzer.PropMap {
+	var ok bool
+	m := make(analyzer.PropMap)
+	// Version, random & session ID length combined are within 35 bytes,
+	// so no need for bounds checking
+	m["version"], _ = chBuf.GetUint16(false, true)
+	m["random"], _ = chBuf.Get(32, true)
+	sessionIDLen, _ := chBuf.GetByte(true)
+	m["session"], ok = chBuf.Get(int(sessionIDLen), true)
+	if !ok {
+		// Not enough data for session ID
+		return nil
+	}
+	cipherSuitesLen, ok := chBuf.GetUint16(false, true)
+	if !ok {
+		// Not enough data for cipher suites length
+		return nil
+	}
+	if cipherSuitesLen%2 != 0 {
+		// Cipher suites are 2 bytes each, so must be even
+		return nil
+	}
+	ciphers := make([]uint16, cipherSuitesLen/2)
+	for i := range ciphers {
+		ciphers[i], ok = chBuf.GetUint16(false, true)
+		if !ok {
+			return nil
+		}
+	}
+	m["ciphers"] = ciphers
+	compressionMethodsLen, ok := chBuf.GetByte(true)
+	if !ok {
+		// Not enough data for compression methods length
+		return nil
+	}
+	// Compression methods are 1 byte each, we just put a byte slice here
+	m["compression"], ok = chBuf.Get(int(compressionMethodsLen), true)
+	if !ok {
+		// Not enough data for compression methods
+		return nil
+	}
+	extsLen, ok := chBuf.GetUint16(false, true)
+	if !ok {
+		// No extensions, I guess it's possible?
+		return m
+	}
+	extBuf, ok := chBuf.GetSubBuffer(int(extsLen), true)
+	if !ok {
+		// Not enough data for extensions
+		return nil
+	}
+	for extBuf.Len() > 0 {
+		extType, ok := extBuf.GetUint16(false, true)
+		if !ok {
+			// Not enough data for extension type
+			return nil
+		}
+		extLen, ok := extBuf.GetUint16(false, true)
+		if !ok {
+			// Not enough data for extension length
+			return nil
+		}
+		extDataBuf, ok := extBuf.GetSubBuffer(int(extLen), true)
+		if !ok || !parseTLSExtensions(extType, extDataBuf, m) {
+			// Not enough data for extension data, or invalid extension
+			return nil
+		}
+	}
+	return m
+}
+
+func ParseTLSServerHelloMsgData(shBuf *utils.ByteBuffer) analyzer.PropMap {
+	var ok bool
+	m := make(analyzer.PropMap)
+	// Version, random & session ID length combined are within 35 bytes,
+	// so no need for bounds checking
+	m["version"], _ = shBuf.GetUint16(false, true)
+	m["random"], _ = shBuf.Get(32, true)
+	sessionIDLen, _ := shBuf.GetByte(true)
+	m["session"], ok = shBuf.Get(int(sessionIDLen), true)
+	if !ok {
+		// Not enough data for session ID
+		return nil
+	}
+	cipherSuite, ok := shBuf.GetUint16(false, true)
+	if !ok {
+		// Not enough data for cipher suite
+		return nil
+	}
+	m["cipher"] = cipherSuite
+	compressionMethod, ok := shBuf.GetByte(true)
+	if !ok {
+		// Not enough data for compression method
+		return nil
+	}
+	m["compression"] = compressionMethod
+	extsLen, ok := shBuf.GetUint16(false, true)
+	if !ok {
+		// No extensions, I guess it's possible?
+		return m
+	}
+	extBuf, ok := shBuf.GetSubBuffer(int(extsLen), true)
+	if !ok {
+		// Not enough data for extensions
+		return nil
+	}
+	for extBuf.Len() > 0 {
+		extType, ok := extBuf.GetUint16(false, true)
+		if !ok {
+			// Not enough data for extension type
+			return nil
+		}
+		extLen, ok := extBuf.GetUint16(false, true)
+		if !ok {
+			// Not enough data for extension length
+			return nil
+		}
+		extDataBuf, ok := extBuf.GetSubBuffer(int(extLen), true)
+		if !ok || !parseTLSExtensions(extType, extDataBuf, m) {
+			// Not enough data for extension data, or invalid extension
+			return nil
+		}
+	}
+	return m
+}
+
+func parseTLSExtensions(extType uint16, extDataBuf *utils.ByteBuffer, m analyzer.PropMap) bool {
+	switch extType {
+	case extServerName:
+		ok := extDataBuf.Skip(2) // Ignore list length, we only care about the first entry for now
+		if !ok {
+			// Not enough data for list length
+			return false
+		}
+		sniType, ok := extDataBuf.GetByte(true)
+		if !ok || sniType != 0 {
+			// Not enough data for SNI type, or not hostname
+			return false
+		}
+		sniLen, ok := extDataBuf.GetUint16(false, true)
+		if !ok {
+			// Not enough data for SNI length
+			return false
+		}
+		m["sni"], ok = extDataBuf.GetString(int(sniLen), true)
+		if !ok {
+			// Not enough data for SNI
+			return false
+		}
+	case extALPN:
+		ok := extDataBuf.Skip(2) // Ignore list length, as we read until the end
+		if !ok {
+			// Not enough data for list length
+			return false
+		}
+		var alpnList []string
+		for extDataBuf.Len() > 0 {
+			alpnLen, ok := extDataBuf.GetByte(true)
+			if !ok {
+				// Not enough data for ALPN length
+				return false
+			}
+			alpn, ok := extDataBuf.GetString(int(alpnLen), true)
+			if !ok {
+				// Not enough data for ALPN
+				return false
+			}
+			alpnList = append(alpnList, alpn)
+		}
+		m["alpn"] = alpnList
+	case extSupportedVersions:
+		if extDataBuf.Len() == 2 {
+			// Server only selects one version
+			m["supported_versions"], _ = extDataBuf.GetUint16(false, true)
+		} else {
+			// Client sends a list of versions
+			ok := extDataBuf.Skip(1) // Ignore list length, as we read until the end
+			if !ok {
+				// Not enough data for list length
+				return false
+			}
+			var versions []uint16
+			for extDataBuf.Len() > 0 {
+				ver, ok := extDataBuf.GetUint16(false, true)
+				if !ok {
+					// Not enough data for version
+					return false
+				}
+				versions = append(versions, ver)
+			}
+			m["supported_versions"] = versions
+		}
+	case extEncryptedClientHello:
+		// We can't parse ECH for now, just set a flag
+		m["ech"] = true
+	}
+	return true
+}
--- a/analyzer/tcp/fet.go
+++ b/analyzer/tcp/fet.go
@@ -0,0 +1,162 @@
+package tcp
+
+import "git.difuse.io/Difuse/Mellaris/analyzer"
+
+var _ analyzer.TCPAnalyzer = (*FETAnalyzer)(nil)
+
+// FETAnalyzer stands for "Fully Encrypted Traffic" analyzer.
+// It implements an algorithm to detect fully encrypted proxy protocols
+// such as Shadowsocks, mentioned in the following paper:
+// https://gfw.report/publications/usenixsecurity23/data/paper/paper.pdf
+type FETAnalyzer struct{}
+
+func (a *FETAnalyzer) Name() string {
+	return "fet"
+}
+
+func (a *FETAnalyzer) Limit() int {
+	// We only really look at the first packet
+	return 8192
+}
+
+func (a *FETAnalyzer) NewTCP(info analyzer.TCPInfo, logger analyzer.Logger) analyzer.TCPStream {
+	return newFETStream(logger)
+}
+
+type fetStream struct {
+	logger analyzer.Logger
+}
+
+func newFETStream(logger analyzer.Logger) *fetStream {
+	return &fetStream{logger: logger}
+}
+
+func (s *fetStream) Feed(rev, start, end bool, skip int, data []byte) (u *analyzer.PropUpdate, done bool) {
+	if skip != 0 {
+		return nil, true
+	}
+	if len(data) == 0 {
+		return nil, false
+	}
+	ex1 := averagePopCount(data)
+	ex2 := isFirstSixPrintable(data)
+	ex3 := printablePercentage(data)
+	ex4 := contiguousPrintable(data)
+	ex5 := isTLSorHTTP(data)
+	exempt := (ex1 <= 3.4 || ex1 >= 4.6) || ex2 || ex3 > 0.5 || ex4 > 20 || ex5
+	return &analyzer.PropUpdate{
+		Type: analyzer.PropUpdateReplace,
+		M: analyzer.PropMap{
+			"ex1": ex1,
+			"ex2": ex2,
+			"ex3": ex3,
+			"ex4": ex4,
+			"ex5": ex5,
+			"yes": !exempt,
+		},
+	}, true
+}
+
+func (s *fetStream) Close(limited bool) *analyzer.PropUpdate {
+	return nil
+}
+
+func popCount(b byte) int {
+	count := 0
+	for b != 0 {
+		count += int(b & 1)
+		b >>= 1
+	}
+	return count
+}
+
+// averagePopCount returns the average popcount of the given bytes.
+// This is the "Ex1" metric in the paper.
+func averagePopCount(bytes []byte) float32 {
+	if len(bytes) == 0 {
+		return 0
+	}
+	total := 0
+	for _, b := range bytes {
+		total += popCount(b)
+	}
+	return float32(total) / float32(len(bytes))
+}
+
+// isFirstSixPrintable returns true if the first six bytes are printable ASCII.
+// This is the "Ex2" metric in the paper.
+func isFirstSixPrintable(bytes []byte) bool {
+	if len(bytes) < 6 {
+		return false
+	}
+	for i := range bytes[:6] {
+		if !isPrintable(bytes[i]) {
+			return false
+		}
+	}
+	return true
+}
+
+// printablePercentage returns the percentage of printable ASCII bytes.
+// This is the "Ex3" metric in the paper.
+func printablePercentage(bytes []byte) float32 {
+	if len(bytes) == 0 {
+		return 0
+	}
+	count := 0
+	for i := range bytes {
+		if isPrintable(bytes[i]) {
+			count++
+		}
+	}
+	return float32(count) / float32(len(bytes))
+}
+
+// contiguousPrintable returns the length of the longest contiguous sequence of
+// printable ASCII bytes.
+// This is the "Ex4" metric in the paper.
+func contiguousPrintable(bytes []byte) int {
+	if len(bytes) == 0 {
+		return 0
+	}
+	maxCount := 0
+	current := 0
+	for i := range bytes {
+		if isPrintable(bytes[i]) {
+			current++
+		} else {
+			if current > maxCount {
+				maxCount = current
+			}
+			current = 0
+		}
+	}
+	if current > maxCount {
+		maxCount = current
+	}
+	return maxCount
+}
+
+// isTLSorHTTP returns true if the given bytes look like TLS or HTTP.
+// This is the "Ex5" metric in the paper.
+func isTLSorHTTP(bytes []byte) bool {
+	if len(bytes) < 3 {
+		return false
+	}
+	// "We observe that the GFW exempts any connection whose first
+	// three bytes match the following regular expression:
+	// [\x16-\x17]\x03[\x00-\x09]" - from the paper in Section 4.3
+	if bytes[0] >= 0x16 && bytes[0] <= 0x17 &&
+		bytes[1] == 0x03 && bytes[2] <= 0x09 {
+		return true
+	}
+	// HTTP request
+	str := string(bytes[:3])
+	return str == "GET" || str == "HEA" || str == "POS" ||
+		str == "PUT" || str == "DEL" || str == "CON" ||
+		str == "OPT" || str == "TRA" || str == "PAT"
+}
+
+func isPrintable(b byte) bool {
+	return b >= 0x20 && b <= 0x7e
+}
--- a/analyzer/tcp/http.go
+++ b/analyzer/tcp/http.go
@@ -0,0 +1,193 @@
+package tcp
+
+import (
+	"bytes"
+	"strconv"
+	"strings"
+
+	"git.difuse.io/Difuse/Mellaris/analyzer"
+	"git.difuse.io/Difuse/Mellaris/analyzer/utils"
+)
+
+var _ analyzer.TCPAnalyzer = (*HTTPAnalyzer)(nil)
+
+type HTTPAnalyzer struct{}
+
+func (a *HTTPAnalyzer) Name() string {
+	return "http"
+}
+
+func (a *HTTPAnalyzer) Limit() int {
+	return 8192
+}
+
+func (a *HTTPAnalyzer) NewTCP(info analyzer.TCPInfo, logger analyzer.Logger) analyzer.TCPStream {
+	return newHTTPStream(logger)
+}
+
+type httpStream struct {
+	logger analyzer.Logger
+
+	reqBuf     *utils.ByteBuffer
+	reqMap     analyzer.PropMap
+	reqUpdated bool
+	reqLSM     *utils.LinearStateMachine
+	reqDone    bool
+
+	respBuf     *utils.ByteBuffer
+	respMap     analyzer.PropMap
+	respUpdated bool
+	respLSM     *utils.LinearStateMachine
+	respDone    bool
+}
+
+func newHTTPStream(logger analyzer.Logger) *httpStream {
+	s := &httpStream{logger: logger, reqBuf: &utils.ByteBuffer{}, respBuf: &utils.ByteBuffer{}}
+	s.reqLSM = utils.NewLinearStateMachine(
+		s.parseRequestLine,
+		s.parseRequestHeaders,
+	)
+	s.respLSM = utils.NewLinearStateMachine(
+		s.parseResponseLine,
+		s.parseResponseHeaders,
+	)
+	return s
+}
+
+func (s *httpStream) Feed(rev, start, end bool, skip int, data []byte) (u *analyzer.PropUpdate, d bool) {
+	if skip != 0 {
+		return nil, true
+	}
+	if len(data) == 0 {
+		return nil, false
+	}
+	var update *analyzer.PropUpdate
+	var cancelled bool
+	if rev {
+		s.respBuf.Append(data)
+		s.respUpdated = false
+		cancelled, s.respDone = s.respLSM.Run()
+		if s.respUpdated {
+			update = &analyzer.PropUpdate{
+				Type: analyzer.PropUpdateMerge,
+				M:    analyzer.PropMap{"resp": s.respMap},
+			}
+			s.respUpdated = false
+		}
+	} else {
+		s.reqBuf.Append(data)
+		s.reqUpdated = false
+		cancelled, s.reqDone = s.reqLSM.Run()
+		if s.reqUpdated {
+			update = &analyzer.PropUpdate{
+				Type: analyzer.PropUpdateMerge,
+				M:    analyzer.PropMap{"req": s.reqMap},
+			}
+			s.reqUpdated = false
+		}
+	}
+	return update, cancelled || (s.reqDone && s.respDone)
+}
+
+func (s *httpStream) parseRequestLine() utils.LSMAction {
+	// Find the end of the request line
+	line, ok := s.reqBuf.GetUntil([]byte("\r\n"), true, true)
+	if !ok {
+		// No end of line yet, but maybe we just need more data
+		return utils.LSMActionPause
+	}
+	fields := strings.Fields(string(line[:len(line)-2])) // Strip \r\n
+	if len(fields) != 3 {
+		// Invalid request line
+		return utils.LSMActionCancel
+	}
+	method := fields[0]
+	path := fields[1]
+	version := fields[2]
+	if !strings.HasPrefix(version, "HTTP/") {
+		// Invalid version
+		return utils.LSMActionCancel
+	}
+	s.reqMap = analyzer.PropMap{
+		"method":  method,
+		"path":    path,
+		"version": version,
+	}
+	s.reqUpdated = true
+	return utils.LSMActionNext
+}
+
+func (s *httpStream) parseResponseLine() utils.LSMAction {
+	// Find the end of the response line
+	line, ok := s.respBuf.GetUntil([]byte("\r\n"), true, true)
+	if !ok {
+		// No end of line yet, but maybe we just need more data
+		return utils.LSMActionPause
+	}
+	fields := strings.Fields(string(line[:len(line)-2])) // Strip \r\n
+	if len(fields) < 2 {
+		// Invalid response line
+		return utils.LSMActionCancel
+	}
+	version := fields[0]
+	status, _ := strconv.Atoi(fields[1])
+	if !strings.HasPrefix(version, "HTTP/") || status == 0 {
+		// Invalid version
+		return utils.LSMActionCancel
+	}
+	s.respMap = analyzer.PropMap{
+		"version": version,
+		"status":  status,
+	}
+	s.respUpdated = true
+	return utils.LSMActionNext
+}
+
+func (s *httpStream) parseHeaders(buf *utils.ByteBuffer) (utils.LSMAction, analyzer.PropMap) {
+	// Find the end of headers
+	headers, ok := buf.GetUntil([]byte("\r\n\r\n"), true, true)
+	if !ok {
+		// No end of headers yet, but maybe we just need more data
+		return utils.LSMActionPause, nil
+	}
+	headers = headers[:len(headers)-4] // Strip \r\n\r\n
+	headerMap := make(analyzer.PropMap)
+	for _, line := range bytes.Split(headers, []byte("\r\n")) {
+		fields := bytes.SplitN(line, []byte(":"), 2)
+		if len(fields) != 2 {
+			// Invalid header
+			return utils.LSMActionCancel, nil
+		}
+		key := string(bytes.TrimSpace(fields[0]))
+		value := string(bytes.TrimSpace(fields[1]))
+		// Normalize header keys to lowercase
+		headerMap[strings.ToLower(key)] = value
+	}
+	return utils.LSMActionNext, headerMap
+}
+
+func (s *httpStream) parseRequestHeaders() utils.LSMAction {
+	action, headerMap := s.parseHeaders(s.reqBuf)
+	if action == utils.LSMActionNext {
+		s.reqMap["headers"] = headerMap
+		s.reqUpdated = true
+	}
+	return action
+}
+
+func (s *httpStream) parseResponseHeaders() utils.LSMAction {
+	action, headerMap := s.parseHeaders(s.respBuf)
+	if action == utils.LSMActionNext {
+		s.respMap["headers"] = headerMap
+		s.respUpdated = true
+	}
+	return action
+}
+
+func (s *httpStream) Close(limited bool) *analyzer.PropUpdate {
+	s.reqBuf.Reset()
+	s.respBuf.Reset()
+	s.reqMap = nil
+	s.respMap = nil
+	return nil
+}
--- a/analyzer/tcp/http_test.go
+++ b/analyzer/tcp/http_test.go
@@ -0,0 +1,64 @@
+package tcp
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"git.difuse.io/Difuse/Mellaris/analyzer"
+)
+
+func TestHTTPParsing_Request(t *testing.T) {
+	testCases := map[string]analyzer.PropMap{
+		"GET / HTTP/1.1\r\n": {
+			"method": "GET", "path": "/", "version": "HTTP/1.1",
+		},
+		"POST /hello?a=1&b=2 HTTP/1.0\r\n": {
+			"method": "POST", "path": "/hello?a=1&b=2", "version": "HTTP/1.0",
+		},
+		"PUT /world HTTP/1.1\r\nContent-Length: 4\r\n\r\nbody": {
+			"method": "PUT", "path": "/world", "version": "HTTP/1.1", "headers": analyzer.PropMap{"content-length": "4"},
+		},
+		"DELETE /goodbye HTTP/2.0\r\n": {
+			"method": "DELETE", "path": "/goodbye", "version": "HTTP/2.0",
+		},
+	}
+
+	for tc, want := range testCases {
+		t.Run(strings.Split(tc, " ")[0], func(t *testing.T) {
+			tc, want := tc, want
+			t.Parallel()
+
+			u, _ := newHTTPStream(nil).Feed(false, false, false, 0, []byte(tc))
+			got := u.M.Get("req")
+			if !reflect.DeepEqual(got, want) {
+				t.Errorf("\"%s\" parsed = %v, want %v", tc, got, want)
+			}
+		})
+	}
+}
+
+func TestHTTPParsing_Response(t *testing.T) {
+	testCases := map[string]analyzer.PropMap{
+		"HTTP/1.0 200 OK\r\nContent-Length: 4\r\n\r\nbody": {
+			"version": "HTTP/1.0", "status": 200,
+			"headers": analyzer.PropMap{"content-length": "4"},
+		},
+		"HTTP/2.0 204 No Content\r\n\r\n": {
+			"version": "HTTP/2.0", "status": 204,
+		},
+	}
+
+	for tc, want := range testCases {
+		t.Run(strings.Split(tc, " ")[0], func(t *testing.T) {
+			tc, want := tc, want
+			t.Parallel()
+
+			u, _ := newHTTPStream(nil).Feed(true, false, false, 0, []byte(tc))
+			got := u.M.Get("resp")
+			if !reflect.DeepEqual(got, want) {
+				t.Errorf("\"%s\" parsed = %v, want %v", tc, got, want)
+			}
+		})
+	}
+}
--- a/analyzer/tcp/socks.go
+++ b/analyzer/tcp/socks.go
@@ -0,0 +1,508 @@
+package tcp
+
+import (
+	"net"
+
+	"git.difuse.io/Difuse/Mellaris/analyzer"
+	"git.difuse.io/Difuse/Mellaris/analyzer/utils"
+)
+
+const (
+	SocksInvalid = iota
+	Socks4
+	Socks4A
+	Socks5
+
+	Socks4Version = 0x04
+	Socks5Version = 0x05
+
+	Socks4ReplyVN = 0x00
+
+	Socks4CmdTCPConnect = 0x01
+	Socks4CmdTCPBind    = 0x02
+
+	Socks4ReqGranted        = 0x5A
+	Socks4ReqRejectOrFailed = 0x5B
+	Socks4ReqRejectIdentd   = 0x5C
+	Socks4ReqRejectUser     = 0x5D
+
+	Socks5CmdTCPConnect   = 0x01
+	Socks5CmdTCPBind      = 0x02
+	Socks5CmdUDPAssociate = 0x03
+
+	Socks5AuthNotRequired      = 0x00
+	Socks5AuthPassword         = 0x02
+	Socks5AuthNoMatchingMethod = 0xFF
+
+	Socks5AuthSuccess = 0x00
+	Socks5AuthFailure = 0x01
+
+	Socks5AddrTypeIPv4   = 0x01
+	Socks5AddrTypeDomain = 0x03
+	Socks5AddrTypeIPv6   = 0x04
+)
+
+var _ analyzer.Analyzer = (*SocksAnalyzer)(nil)
+
+type SocksAnalyzer struct{}
+
+func (a *SocksAnalyzer) Name() string {
+	return "socks"
+}
+
+func (a *SocksAnalyzer) Limit() int {
+	// Socks4 length limit cannot be predicted
+	return 0
+}
+
+func (a *SocksAnalyzer) NewTCP(info analyzer.TCPInfo, logger analyzer.Logger) analyzer.TCPStream {
+	return newSocksStream(logger)
+}
+
+type socksStream struct {
+	logger analyzer.Logger
+
+	reqBuf     *utils.ByteBuffer
+	reqMap     analyzer.PropMap
+	reqUpdated bool
+	reqLSM     *utils.LinearStateMachine
+	reqDone    bool
+
+	respBuf     *utils.ByteBuffer
+	respMap     analyzer.PropMap
+	respUpdated bool
+	respLSM     *utils.LinearStateMachine
+	respDone    bool
+
+	version int
+
+	authReqMethod int
+	authUsername  string
+	authPassword  string
+
+	authRespMethod int
+}
+
+func newSocksStream(logger analyzer.Logger) *socksStream {
+	s := &socksStream{logger: logger, reqBuf: &utils.ByteBuffer{}, respBuf: &utils.ByteBuffer{}}
+	s.reqLSM = utils.NewLinearStateMachine(
+		s.parseSocksReqVersion,
+	)
+	s.respLSM = utils.NewLinearStateMachine(
+		s.parseSocksRespVersion,
+	)
+	return s
+}
+
+func (s *socksStream) Feed(rev, start, end bool, skip int, data []byte) (u *analyzer.PropUpdate, d bool) {
+	if skip != 0 {
+		return nil, true
+	}
+	if len(data) == 0 {
+		return nil, false
+	}
+	var update *analyzer.PropUpdate
+	var cancelled bool
+	if rev {
+		s.respBuf.Append(data)
+		s.respUpdated = false
+		cancelled, s.respDone = s.respLSM.Run()
+		if s.respUpdated {
+			update = &analyzer.PropUpdate{
+				Type: analyzer.PropUpdateMerge,
+				M:    analyzer.PropMap{"resp": s.respMap},
+			}
+			s.respUpdated = false
+		}
+	} else {
+		s.reqBuf.Append(data)
+		s.reqUpdated = false
+		cancelled, s.reqDone = s.reqLSM.Run()
+		if s.reqUpdated {
+			update = &analyzer.PropUpdate{
+				Type: analyzer.PropUpdateMerge,
+				M: analyzer.PropMap{
+					"version": s.socksVersion(),
+					"req":     s.reqMap,
+				},
+			}
+			s.reqUpdated = false
+		}
+	}
+
+	return update, cancelled || (s.reqDone && s.respDone)
+}
+
+func (s *socksStream) Close(limited bool) *analyzer.PropUpdate {
+	s.reqBuf.Reset()
+	s.respBuf.Reset()
+	s.reqMap = nil
+	s.respMap = nil
+	return nil
+}
+
+func (s *socksStream) parseSocksReqVersion() utils.LSMAction {
+	socksVer, ok := s.reqBuf.GetByte(true)
+	if !ok {
+		return utils.LSMActionPause
+	}
+	if socksVer != Socks4Version && socksVer != Socks5Version {
+		return utils.LSMActionCancel
+	}
+	s.reqMap = make(analyzer.PropMap)
+	s.reqUpdated = true
+	if socksVer == Socks4Version {
+		s.version = Socks4
+		s.reqLSM.AppendSteps(
+			s.parseSocks4ReqIpAndPort,
+			s.parseSocks4ReqUserId,
+			s.parseSocks4ReqHostname,
+		)
+	} else {
+		s.version = Socks5
+		s.reqLSM.AppendSteps(
+			s.parseSocks5ReqMethod,
+			s.parseSocks5ReqAuth,
+			s.parseSocks5ReqConnInfo,
+		)
+	}
+	return utils.LSMActionNext
+}
+
+func (s *socksStream) parseSocksRespVersion() utils.LSMAction {
+	socksVer, ok := s.respBuf.GetByte(true)
+	if !ok {
+		return utils.LSMActionPause
+	}
+	if (s.version == Socks4 || s.version == Socks4A) && socksVer != Socks4ReplyVN ||
+		s.version == Socks5 && socksVer != Socks5Version || s.version == SocksInvalid {
+		return utils.LSMActionCancel
+	}
+	if socksVer == Socks4ReplyVN {
+		s.respLSM.AppendSteps(
+			s.parseSocks4RespPacket,
+		)
+	} else {
+		s.respLSM.AppendSteps(
+			s.parseSocks5RespMethod,
+			s.parseSocks5RespAuth,
+			s.parseSocks5RespConnInfo,
+		)
+	}
+	return utils.LSMActionNext
+}
+
+func (s *socksStream) parseSocks5ReqMethod() utils.LSMAction {
+	nMethods, ok := s.reqBuf.GetByte(false)
+	if !ok {
+		return utils.LSMActionPause
+	}
+	methods, ok := s.reqBuf.Get(int(nMethods)+1, true)
+	if !ok {
+		return utils.LSMActionPause
+	}
+
+	// For convenience, we only take the first method we can process
+	s.authReqMethod = Socks5AuthNoMatchingMethod
+	for _, method := range methods[1:] {
+		switch method {
+		case Socks5AuthNotRequired:
+			s.authReqMethod = Socks5AuthNotRequired
+			return utils.LSMActionNext
+		case Socks5AuthPassword:
+			s.authReqMethod = Socks5AuthPassword
+			return utils.LSMActionNext
+		default:
+			// TODO: more auth method to support
+		}
+	}
+	return utils.LSMActionNext
+}
+
+func (s *socksStream) parseSocks5ReqAuth() utils.LSMAction {
+	switch s.authReqMethod {
+	case Socks5AuthNotRequired:
+		s.reqMap["auth"] = analyzer.PropMap{"method": s.authReqMethod}
+	case Socks5AuthPassword:
+		meta, ok := s.reqBuf.Get(2, false)
+		if !ok {
+			return utils.LSMActionPause
+		}
+		if meta[0] != 0x01 {
+			return utils.LSMActionCancel
+		}
+		usernameLen := int(meta[1])
+		meta, ok = s.reqBuf.Get(usernameLen+3, false)
+		if !ok {
+			return utils.LSMActionPause
+		}
+		passwordLen := int(meta[usernameLen+2])
+		meta, ok = s.reqBuf.Get(usernameLen+passwordLen+3, true)
+		if !ok {
+			return utils.LSMActionPause
+		}
+		s.authUsername = string(meta[2 : usernameLen+2])
+		s.authPassword = string(meta[usernameLen+3:])
+		s.reqMap["auth"] = analyzer.PropMap{
+			"method":   s.authReqMethod,
+			"username": s.authUsername,
+			"password": s.authPassword,
+		}
+	default:
+		return utils.LSMActionCancel
+	}
+	s.reqUpdated = true
+	return utils.LSMActionNext
+}
+
+func (s *socksStream) parseSocks5ReqConnInfo() utils.LSMAction {
+	/* preInfo struct
+	+----+-----+-------+------+-------------+
+	|VER | CMD |  RSV  | ATYP | DST.ADDR(1) |
+	+----+-----+-------+------+-------------+
+	*/
+	preInfo, ok := s.reqBuf.Get(5, false)
+	if !ok {
+		return utils.LSMActionPause
+	}
+
+	// verify socks version
+	if preInfo[0] != Socks5Version {
+		return utils.LSMActionCancel
+	}
+
+	var pktLen int
+	switch int(preInfo[3]) {
+	case Socks5AddrTypeIPv4:
+		pktLen = 10
+	case Socks5AddrTypeDomain:
+		domainLen := int(preInfo[4])
+		pktLen = 7 + domainLen
+	case Socks5AddrTypeIPv6:
+		pktLen = 22
+	default:
+		return utils.LSMActionCancel
+	}
+
+	pkt, ok := s.reqBuf.Get(pktLen, true)
+	if !ok {
+		return utils.LSMActionPause
+	}
+
+	// parse cmd
+	cmd := int(pkt[1])
+	if cmd != Socks5CmdTCPConnect && cmd != Socks5CmdTCPBind && cmd != Socks5CmdUDPAssociate {
+		return utils.LSMActionCancel
+	}
+	s.reqMap["cmd"] = cmd
+
+	// parse addr type
+	addrType := int(pkt[3])
+	var addr string
+	switch addrType {
+	case Socks5AddrTypeIPv4:
+		addr = net.IPv4(pkt[4], pkt[5], pkt[6], pkt[7]).String()
+	case Socks5AddrTypeDomain:
+		addr = string(pkt[5 : 5+pkt[4]])
+	case Socks5AddrTypeIPv6:
+		addr = net.IP(pkt[4 : 4+net.IPv6len]).String()
+	default:
+		return utils.LSMActionCancel
+	}
+	s.reqMap["addr_type"] = addrType
+	s.reqMap["addr"] = addr
+
+	// parse port
+	port := int(pkt[pktLen-2])<<8 | int(pkt[pktLen-1])
+	s.reqMap["port"] = port
+	s.reqUpdated = true
+	return utils.LSMActionNext
+}
+
+func (s *socksStream) parseSocks5RespMethod() utils.LSMAction {
+	method, ok := s.respBuf.Get(1, true)
+	if !ok {
+		return utils.LSMActionPause
+	}
+	s.authRespMethod = int(method[0])
+	s.respMap = make(analyzer.PropMap)
+	return utils.LSMActionNext
+}
+
+func (s *socksStream) parseSocks5RespAuth() utils.LSMAction {
+	switch s.authRespMethod {
+	case Socks5AuthNotRequired:
+		s.respMap["auth"] = analyzer.PropMap{"method": s.authRespMethod}
+	case Socks5AuthPassword:
+		authResp, ok := s.respBuf.Get(2, true)
+		if !ok {
+			return utils.LSMActionPause
+		}
+		if authResp[0] != 0x01 {
+			return utils.LSMActionCancel
+		}
+		authStatus := int(authResp[1])
+		s.respMap["auth"] = analyzer.PropMap{
+			"method": s.authRespMethod,
+			"status": authStatus,
+		}
+	default:
+		return utils.LSMActionCancel
+	}
+	s.respUpdated = true
+	return utils.LSMActionNext
+}
+
+func (s *socksStream) parseSocks5RespConnInfo() utils.LSMAction {
+	/* preInfo struct
+	+----+-----+-------+------+-------------+
+	|VER | REP |  RSV  | ATYP | BND.ADDR(1) |
+	+----+-----+-------+------+-------------+
+	*/
+	preInfo, ok := s.respBuf.Get(5, false)
+	if !ok {
+		return utils.LSMActionPause
+	}
+
+	// verify socks version
+	if preInfo[0] != Socks5Version {
+		return utils.LSMActionCancel
+	}
+
+	var pktLen int
+	switch int(preInfo[3]) {
+	case Socks5AddrTypeIPv4:
+		pktLen = 10
+	case Socks5AddrTypeDomain:
+		domainLen := int(preInfo[4])
+		pktLen = 7 + domainLen
+	case Socks5AddrTypeIPv6:
+		pktLen = 22
+	default:
+		return utils.LSMActionCancel
+	}
+
+	pkt, ok := s.respBuf.Get(pktLen, true)
+	if !ok {
+		return utils.LSMActionPause
+	}
+
+	// parse rep
+	rep := int(pkt[1])
+	s.respMap["rep"] = rep
+
+	// parse addr type
+	addrType := int(pkt[3])
+	var addr string
+	switch addrType {
+	case Socks5AddrTypeIPv4:
+		addr = net.IPv4(pkt[4], pkt[5], pkt[6], pkt[7]).String()
+	case Socks5AddrTypeDomain:
+		addr = string(pkt[5 : 5+pkt[4]])
+	case Socks5AddrTypeIPv6:
+		addr = net.IP(pkt[4 : 4+net.IPv6len]).String()
+	default:
+		return utils.LSMActionCancel
+	}
+	s.respMap["addr_type"] = addrType
+	s.respMap["addr"] = addr
+
+	// parse port
+	port := int(pkt[pktLen-2])<<8 | int(pkt[pktLen-1])
+	s.respMap["port"] = port
+	s.respUpdated = true
+	return utils.LSMActionNext
+}
+
+func (s *socksStream) parseSocks4ReqIpAndPort() utils.LSMAction {
+	/* Following field will be parsed in this state:
+	+-----+----------+--------+
+	| CMD | DST.PORT | DST.IP |
+	+-----+----------+--------+
+	*/
+	pkt, ok := s.reqBuf.Get(7, true)
+	if !ok {
+		return utils.LSMActionPause
+	}
+	if pkt[0] != Socks4CmdTCPConnect && pkt[0] != Socks4CmdTCPBind {
+		return utils.LSMActionCancel
+	}
+
+	dstPort := uint16(pkt[1])<<8 | uint16(pkt[2])
+	dstIp := net.IPv4(pkt[3], pkt[4], pkt[5], pkt[6]).String()
+
+	// Socks4a extension
+	if pkt[3] == 0 && pkt[4] == 0 && pkt[5] == 0 {
+		s.version = Socks4A
+	}
+
+	s.reqMap["cmd"] = pkt[0]
+	s.reqMap["addr"] = dstIp
+	s.reqMap["addr_type"] = Socks5AddrTypeIPv4
+	s.reqMap["port"] = dstPort
+	s.reqUpdated = true
+	return utils.LSMActionNext
+}
+
+func (s *socksStream) parseSocks4ReqUserId() utils.LSMAction {
+	userIdSlice, ok := s.reqBuf.GetUntil([]byte("\x00"), true, true)
+	if !ok {
+		return utils.LSMActionPause
+	}
+	userId := string(userIdSlice[:len(userIdSlice)-1])
+	s.reqMap["auth"] = analyzer.PropMap{
+		"user_id": userId,
+	}
+	s.reqUpdated = true
+	return utils.LSMActionNext
+}
+
+func (s *socksStream) parseSocks4ReqHostname() utils.LSMAction {
+	// Only Socks4a support hostname
+	if s.version != Socks4A {
+		return utils.LSMActionNext
+	}
+	hostnameSlice, ok := s.reqBuf.GetUntil([]byte("\x00"), true, true)
+	if !ok {
+		return utils.LSMActionPause
+	}
+	hostname := string(hostnameSlice[:len(hostnameSlice)-1])
+	s.reqMap["addr"] = hostname
+	s.reqMap["addr_type"] = Socks5AddrTypeDomain
+	s.reqUpdated = true
+	return utils.LSMActionNext
+}
+
+func (s *socksStream) parseSocks4RespPacket() utils.LSMAction {
+	pkt, ok := s.respBuf.Get(7, true)
+	if !ok {
+		return utils.LSMActionPause
+	}
+	if pkt[0] != Socks4ReqGranted &&
+		pkt[0] != Socks4ReqRejectOrFailed &&
+		pkt[0] != Socks4ReqRejectIdentd &&
+		pkt[0] != Socks4ReqRejectUser {
+		return utils.LSMActionCancel
+	}
+	dstPort := uint16(pkt[1])<<8 | uint16(pkt[2])
+	dstIp := net.IPv4(pkt[3], pkt[4], pkt[5], pkt[6]).String()
+	s.respMap = analyzer.PropMap{
+		"rep":       pkt[0],
+		"addr":      dstIp,
+		"addr_type": Socks5AddrTypeIPv4,
+		"port":      dstPort,
+	}
+	s.respUpdated = true
+	return utils.LSMActionNext
+}
+
+func (s *socksStream) socksVersion() int {
+	switch s.version {
+	case Socks4, Socks4A:
+		return Socks4Version
+	case Socks5:
+		return Socks5Version
+	default:
+		return SocksInvalid
+	}
+}
--- a/analyzer/tcp/ssh.go
+++ b/analyzer/tcp/ssh.go
@@ -0,0 +1,147 @@
+package tcp
+
+import (
+	"strings"
+
+	"git.difuse.io/Difuse/Mellaris/analyzer"
+	"git.difuse.io/Difuse/Mellaris/analyzer/utils"
+)
+
+var _ analyzer.TCPAnalyzer = (*SSHAnalyzer)(nil)
+
+type SSHAnalyzer struct{}
+
+func (a *SSHAnalyzer) Name() string {
+	return "ssh"
+}
+
+func (a *SSHAnalyzer) Limit() int {
+	return 1024
+}
+
+func (a *SSHAnalyzer) NewTCP(info analyzer.TCPInfo, logger analyzer.Logger) analyzer.TCPStream {
+	return newSSHStream(logger)
+}
+
+type sshStream struct {
+	logger analyzer.Logger
+
+	clientBuf     *utils.ByteBuffer
+	clientMap     analyzer.PropMap
+	clientUpdated bool
+	clientLSM     *utils.LinearStateMachine
+	clientDone    bool
+
+	serverBuf     *utils.ByteBuffer
+	serverMap     analyzer.PropMap
+	serverUpdated bool
+	serverLSM     *utils.LinearStateMachine
+	serverDone    bool
+}
+
+func newSSHStream(logger analyzer.Logger) *sshStream {
+	s := &sshStream{logger: logger, clientBuf: &utils.ByteBuffer{}, serverBuf: &utils.ByteBuffer{}}
+	s.clientLSM = utils.NewLinearStateMachine(
+		s.parseClientExchangeLine,
+	)
+	s.serverLSM = utils.NewLinearStateMachine(
+		s.parseServerExchangeLine,
+	)
+	return s
+}
+
+func (s *sshStream) Feed(rev, start, end bool, skip int, data []byte) (u *analyzer.PropUpdate, done bool) {
+	if skip != 0 {
+		return nil, true
+	}
+	if len(data) == 0 {
+		return nil, false
+	}
+	var update *analyzer.PropUpdate
+	var cancelled bool
+	if rev {
+		s.serverBuf.Append(data)
+		s.serverUpdated = false
+		cancelled, s.serverDone = s.serverLSM.Run()
+		if s.serverUpdated {
+			update = &analyzer.PropUpdate{
+				Type: analyzer.PropUpdateMerge,
+				M:    analyzer.PropMap{"server": s.serverMap},
+			}
+			s.serverUpdated = false
+		}
+	} else {
+		s.clientBuf.Append(data)
+		s.clientUpdated = false
+		cancelled, s.clientDone = s.clientLSM.Run()
+		if s.clientUpdated {
+			update = &analyzer.PropUpdate{
+				Type: analyzer.PropUpdateMerge,
+				M:    analyzer.PropMap{"client": s.clientMap},
+			}
+			s.clientUpdated = false
+		}
+	}
+	return update, cancelled || (s.clientDone && s.serverDone)
+}
+
+// parseExchangeLine parses the SSH Protocol Version Exchange string.
+// See RFC 4253, section 4.2.
+// "SSH-protoversion-softwareversion SP comments CR LF"
+// The "comments" part (along with the SP) is optional.
+func (s *sshStream) parseExchangeLine(buf *utils.ByteBuffer) (utils.LSMAction, analyzer.PropMap) {
+	// Find the end of the line
+	line, ok := buf.GetUntil([]byte("\r\n"), true, true)
+	if !ok {
+		// No end of line yet, but maybe we just need more data
+		return utils.LSMActionPause, nil
+	}
+	if !strings.HasPrefix(string(line), "SSH-") {
+		// Not SSH
+		return utils.LSMActionCancel, nil
+	}
+	fields := strings.Fields(string(line[:len(line)-2])) // Strip \r\n
+	if len(fields) < 1 || len(fields) > 2 {
+		// Invalid line
+		return utils.LSMActionCancel, nil
+	}
+	sshFields := strings.SplitN(fields[0], "-", 3)
+	if len(sshFields) != 3 {
+		// Invalid SSH version format
+		return utils.LSMActionCancel, nil
+	}
+	sMap := analyzer.PropMap{
+		"protocol": sshFields[1],
+		"software": sshFields[2],
+	}
+	if len(fields) == 2 {
+		sMap["comments"] = fields[1]
+	}
+	return utils.LSMActionNext, sMap
+}
+
+func (s *sshStream) parseClientExchangeLine() utils.LSMAction {
+	action, sMap := s.parseExchangeLine(s.clientBuf)
+	if action == utils.LSMActionNext {
+		s.clientMap = sMap
+		s.clientUpdated = true
+	}
+	return action
+}
+
+func (s *sshStream) parseServerExchangeLine() utils.LSMAction {
+	action, sMap := s.parseExchangeLine(s.serverBuf)
+	if action == utils.LSMActionNext {
+		s.serverMap = sMap
+		s.serverUpdated = true
+	}
+	return action
+}
+
+func (s *sshStream) Close(limited bool) *analyzer.PropUpdate {
+	s.clientBuf.Reset()
+	s.serverBuf.Reset()
+	s.clientMap = nil
+	s.serverMap = nil
+	return nil
+}
--- a/analyzer/tcp/tls.go
+++ b/analyzer/tcp/tls.go
@@ -0,0 +1,226 @@
+package tcp
+
+import (
+	"git.difuse.io/Difuse/Mellaris/analyzer"
+	"git.difuse.io/Difuse/Mellaris/analyzer/internal"
+	"git.difuse.io/Difuse/Mellaris/analyzer/utils"
+)
+
+var _ analyzer.TCPAnalyzer = (*TLSAnalyzer)(nil)
+
+type TLSAnalyzer struct{}
+
+func (a *TLSAnalyzer) Name() string {
+	return "tls"
+}
+
+func (a *TLSAnalyzer) Limit() int {
+	return 8192
+}
+
+func (a *TLSAnalyzer) NewTCP(info analyzer.TCPInfo, logger analyzer.Logger) analyzer.TCPStream {
+	return newTLSStream(logger)
+}
+
+type tlsStream struct {
+	logger analyzer.Logger
+
+	reqBuf     *utils.ByteBuffer
+	reqMap     analyzer.PropMap
+	reqUpdated bool
+	reqLSM     *utils.LinearStateMachine
+	reqDone    bool
+
+	respBuf     *utils.ByteBuffer
+	respMap     analyzer.PropMap
+	respUpdated bool
+	respLSM     *utils.LinearStateMachine
+	respDone    bool
+
+	clientHelloLen int
+	serverHelloLen int
+}
+
+func newTLSStream(logger analyzer.Logger) *tlsStream {
+	s := &tlsStream{logger: logger, reqBuf: &utils.ByteBuffer{}, respBuf: &utils.ByteBuffer{}}
+	s.reqLSM = utils.NewLinearStateMachine(
+		s.tlsClientHelloPreprocess,
+		s.parseClientHelloData,
+	)
+	s.respLSM = utils.NewLinearStateMachine(
+		s.tlsServerHelloPreprocess,
+		s.parseServerHelloData,
+	)
+	return s
+}
+
+func (s *tlsStream) Feed(rev, start, end bool, skip int, data []byte) (u *analyzer.PropUpdate, done bool) {
+	if skip != 0 {
+		return nil, true
+	}
+	if len(data) == 0 {
+		return nil, false
+	}
+	var update *analyzer.PropUpdate
+	var cancelled bool
+	if rev {
+		s.respBuf.Append(data)
+		s.respUpdated = false
+		cancelled, s.respDone = s.respLSM.Run()
+		if s.respUpdated {
+			update = &analyzer.PropUpdate{
+				Type: analyzer.PropUpdateMerge,
+				M:    analyzer.PropMap{"resp": s.respMap},
+			}
+			s.respUpdated = false
+		}
+	} else {
+		s.reqBuf.Append(data)
+		s.reqUpdated = false
+		cancelled, s.reqDone = s.reqLSM.Run()
+		if s.reqUpdated {
+			update = &analyzer.PropUpdate{
+				Type: analyzer.PropUpdateMerge,
+				M:    analyzer.PropMap{"req": s.reqMap},
+			}
+			s.reqUpdated = false
+		}
+	}
+	return update, cancelled || (s.reqDone && s.respDone)
+}
+
+// tlsClientHelloPreprocess validates ClientHello message.
+//
+// During validation, message header and first handshake header may be removed
+// from `s.reqBuf`.
+func (s *tlsStream) tlsClientHelloPreprocess() utils.LSMAction {
+	// headers size: content type (1 byte) + legacy protocol version (2 bytes) +
+	//   + content length (2 bytes) + message type (1 byte) +
+	//   + handshake length (3 bytes)
+	const headersSize = 9
+
+	// minimal data size: protocol version (2 bytes) + random (32 bytes) +
+	//   + session ID (1 byte) + cipher suites (4 bytes) +
+	//   + compression methods (2 bytes) + no extensions
+	const minDataSize = 41
+
+	header, ok := s.reqBuf.Get(headersSize, true)
+	if !ok {
+		// not a full header yet
+		return utils.LSMActionPause
+	}
+
+	if header[0] != internal.RecordTypeHandshake || header[5] != internal.TypeClientHello {
+		return utils.LSMActionCancel
+	}
+
+	s.clientHelloLen = int(header[6])<<16 | int(header[7])<<8 | int(header[8])
+	if s.clientHelloLen < minDataSize {
+		return utils.LSMActionCancel
+	}
+
+	// TODO: something is missing. See:
+	//   const messageHeaderSize = 4
+	//   fullMessageLen := int(header[3])<<8 | int(header[4])
+	//   msgNo := fullMessageLen / int(messageHeaderSize+s.serverHelloLen)
+	//   if msgNo != 1 {
+	// 	   // what here?
+	//   }
+	//   if messageNo != int(messageNo) {
+	// 	   // what here?
+	//   }
+
+	return utils.LSMActionNext
+}
+
+// tlsServerHelloPreprocess validates ServerHello message.
+//
+// During validation, message header and first handshake header may be removed
+// from `s.reqBuf`.
+func (s *tlsStream) tlsServerHelloPreprocess() utils.LSMAction {
+	// header size: content type (1 byte) + legacy protocol version (2 byte) +
+	//   + content length (2 byte) + message type (1 byte) +
+	//   + handshake length (3 byte)
+	const headersSize = 9
+
+	// minimal data size: server version (2 byte) + random (32 byte) +
+	//	 + session ID (>=1 byte) + cipher suite (2 byte) +
+	//	 + compression method (1 byte) + no extensions
+	const minDataSize = 38
+
+	header, ok := s.respBuf.Get(headersSize, true)
+	if !ok {
+		// not a full header yet
+		return utils.LSMActionPause
+	}
+
+	if header[0] != internal.RecordTypeHandshake || header[5] != internal.TypeServerHello {
+		return utils.LSMActionCancel
+	}
+
+	s.serverHelloLen = int(header[6])<<16 | int(header[7])<<8 | int(header[8])
+	if s.serverHelloLen < minDataSize {
+		return utils.LSMActionCancel
+	}
+
+	// TODO: something is missing. See example:
+	//   const messageHeaderSize = 4
+	//   fullMessageLen := int(header[3])<<8 | int(header[4])
+	//   msgNo := fullMessageLen / int(messageHeaderSize+s.serverHelloLen)
+	//   if msgNo != 1 {
+	// 	   // what here?
+	//   }
+	//   if messageNo != int(messageNo) {
+	// 	   // what here?
+	//   }
+
+	return utils.LSMActionNext
+}
+
+// parseClientHelloData converts valid ClientHello message data (without
+// headers) into `analyzer.PropMap`.
+//
+// Parsing error may leave `s.reqBuf` in an unusable state.
+func (s *tlsStream) parseClientHelloData() utils.LSMAction {
+	chBuf, ok := s.reqBuf.GetSubBuffer(s.clientHelloLen, true)
+	if !ok {
+		// Not a full client hello yet
+		return utils.LSMActionPause
+	}
+	m := internal.ParseTLSClientHelloMsgData(chBuf)
+	if m == nil {
+		return utils.LSMActionCancel
+	} else {
+		s.reqUpdated = true
+		s.reqMap = m
+		return utils.LSMActionNext
+	}
+}
+
+// parseServerHelloData converts valid ServerHello message data (without
+// headers) into `analyzer.PropMap`.
+//
+// Parsing error may leave `s.respBuf` in an unusable state.
+func (s *tlsStream) parseServerHelloData() utils.LSMAction {
+	shBuf, ok := s.respBuf.GetSubBuffer(s.serverHelloLen, true)
+	if !ok {
+		// Not a full server hello yet
+		return utils.LSMActionPause
+	}
+	m := internal.ParseTLSServerHelloMsgData(shBuf)
+	if m == nil {
+		return utils.LSMActionCancel
+	} else {
+		s.respUpdated = true
+		s.respMap = m
+		return utils.LSMActionNext
+	}
+}
+
+func (s *tlsStream) Close(limited bool) *analyzer.PropUpdate {
+	s.reqBuf.Reset()
+	s.respBuf.Reset()
+	s.reqMap = nil
+	s.respMap = nil
+	return nil
+}
--- a/analyzer/tcp/tls_test.go
+++ b/analyzer/tcp/tls_test.go
@@ -0,0 +1,69 @@
+package tcp
+
+import (
+	"reflect"
+	"testing"
+
+	"git.difuse.io/Difuse/Mellaris/analyzer"
+)
+
+func TestTlsStreamParsing_ClientHello(t *testing.T) {
+	// example packet taken from <https://tls12.xargs.org/#client-hello/annotated>
+	clientHello := []byte{
+		0x16, 0x03, 0x01, 0x00, 0xa5, 0x01, 0x00, 0x00, 0xa1, 0x03, 0x03, 0x00,
+		0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c,
+		0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18,
+		0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x00, 0x00, 0x20, 0xcc, 0xa8,
+		0xcc, 0xa9, 0xc0, 0x2f, 0xc0, 0x30, 0xc0, 0x2b, 0xc0, 0x2c, 0xc0, 0x13,
+		0xc0, 0x09, 0xc0, 0x14, 0xc0, 0x0a, 0x00, 0x9c, 0x00, 0x9d, 0x00, 0x2f,
+		0x00, 0x35, 0xc0, 0x12, 0x00, 0x0a, 0x01, 0x00, 0x00, 0x58, 0x00, 0x00,
+		0x00, 0x18, 0x00, 0x16, 0x00, 0x00, 0x13, 0x65, 0x78, 0x61, 0x6d, 0x70,
+		0x6c, 0x65, 0x2e, 0x75, 0x6c, 0x66, 0x68, 0x65, 0x69, 0x6d, 0x2e, 0x6e,
+		0x65, 0x74, 0x00, 0x05, 0x00, 0x05, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x0a, 0x00, 0x0a, 0x00, 0x08, 0x00, 0x1d, 0x00, 0x17, 0x00, 0x18, 0x00,
+		0x19, 0x00, 0x0b, 0x00, 0x02, 0x01, 0x00, 0x00, 0x0d, 0x00, 0x12, 0x00,
+		0x10, 0x04, 0x01, 0x04, 0x03, 0x05, 0x01, 0x05, 0x03, 0x06, 0x01, 0x06,
+		0x03, 0x02, 0x01, 0x02, 0x03, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x12,
+		0x00, 0x00,
+	}
+	want := analyzer.PropMap{
+		"ciphers":     []uint16{52392, 52393, 49199, 49200, 49195, 49196, 49171, 49161, 49172, 49162, 156, 157, 47, 53, 49170, 10},
+		"compression": []uint8{0},
+		"random":      []uint8{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31},
+		"session":     []uint8{},
+		"sni":         "example.ulfheim.net",
+		"version":     uint16(771),
+	}
+
+	s := newTLSStream(nil)
+	u, _ := s.Feed(false, false, false, 0, clientHello)
+	got := u.M.Get("req")
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("%d B parsed = %v, want %v", len(clientHello), got, want)
+	}
+}
+
+func TestTlsStreamParsing_ServerHello(t *testing.T) {
+	// example packet taken from <https://tls12.xargs.org/#server-hello/annotated>
+	serverHello := []byte{
+		0x16, 0x03, 0x03, 0x00, 0x31, 0x02, 0x00, 0x00, 0x2d, 0x03, 0x03, 0x70,
+		0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x7b, 0x7c,
+		0x7d, 0x7e, 0x7f, 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88,
+		0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f, 0x00, 0xc0, 0x13, 0x00, 0x00,
+		0x05, 0xff, 0x01, 0x00, 0x01, 0x00,
+	}
+	want := analyzer.PropMap{
+		"cipher":      uint16(49171),
+		"compression": uint8(0),
+		"random":      []uint8{112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143},
+		"session":     []uint8{},
+		"version":     uint16(771),
+	}
+
+	s := newTLSStream(nil)
+	u, _ := s.Feed(true, false, false, 0, serverHello)
+	got := u.M.Get("resp")
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("%d B parsed = %v, want %v", len(serverHello), got, want)
+	}
+}
--- a/analyzer/tcp/trojan.go
+++ b/analyzer/tcp/trojan.go
@@ -0,0 +1,517 @@
+package tcp
+
+import (
+	"bytes"
+
+	"git.difuse.io/Difuse/Mellaris/analyzer"
+)
+
+var _ analyzer.TCPAnalyzer = (*TrojanAnalyzer)(nil)
+
+// CCS stands for "Change Cipher Spec"
+var ccsPattern = []byte{20, 3, 3, 0, 1, 1}
+
+// TrojanAnalyzer uses length-based heuristics to detect Trojan traffic based on
+// its "TLS-in-TLS" nature. The heuristics are trained using a decision tree with
+// about 20k Trojan samples and 30k non-Trojan samples. The tree is then converted
+// to code using a custom tool and inlined here (isTrojanSeq function).
+// Accuracy: 1% false positive rate, 10% false negative rate.
+// We do NOT recommend directly blocking all positive connections, as this may
+// break legitimate TLS connections.
+type TrojanAnalyzer struct{}
+
+func (a *TrojanAnalyzer) Name() string {
+	return "trojan"
+}
+
+func (a *TrojanAnalyzer) Limit() int {
+	return 512000
+}
+
+func (a *TrojanAnalyzer) NewTCP(info analyzer.TCPInfo, logger analyzer.Logger) analyzer.TCPStream {
+	return newTrojanStream(logger)
+}
+
+type trojanStream struct {
+	logger   analyzer.Logger
+	first    bool
+	count    bool
+	rev      bool
+	seq      [4]int
+	seqIndex int
+}
+
+func newTrojanStream(logger analyzer.Logger) *trojanStream {
+	return &trojanStream{logger: logger}
+}
+
+func (s *trojanStream) Feed(rev, start, end bool, skip int, data []byte) (u *analyzer.PropUpdate, done bool) {
+	if skip != 0 {
+		return nil, true
+	}
+	if len(data) == 0 {
+		return nil, false
+	}
+
+	if s.first {
+		s.first = false
+		// Stop if it's not a valid TLS connection
+		if !(!rev && len(data) >= 3 && data[0] >= 0x16 && data[0] <= 0x17 &&
+			data[1] == 0x03 && data[2] <= 0x09) {
+			return nil, true
+		}
+	}
+
+	if !rev && !s.count && len(data) >= 6 && bytes.Equal(data[:6], ccsPattern) {
+		// Client Change Cipher Spec encountered, start counting
+		s.count = true
+	}
+
+	if s.count {
+		if rev == s.rev {
+			// Same direction as last time, just update the number
+			s.seq[s.seqIndex] += len(data)
+		} else {
+			// Different direction, bump the index
+			s.seqIndex += 1
+			if s.seqIndex == 4 {
+				return &analyzer.PropUpdate{
+					Type: analyzer.PropUpdateReplace,
+					M: analyzer.PropMap{
+						"seq": s.seq,
+						"yes": isTrojanSeq(s.seq),
+					},
+				}, true
+			}
+			s.seq[s.seqIndex] += len(data)
+			s.rev = rev
+		}
+	}
+
+	return nil, false
+}
+
+func (s *trojanStream) Close(limited bool) *analyzer.PropUpdate {
+	return nil
+}
+
+func isTrojanSeq(seq [4]int) bool {
+	length1 := seq[0]
+	length2 := seq[1]
+	length3 := seq[2]
+	length4 := seq[3]
+
+	if length2 <= 2431 {
+		if length2 <= 157 {
+			if length1 <= 156 {
+				if length3 <= 108 {
+					return false
+				} else {
+					return false
+				}
+			} else {
+				if length1 <= 892 {
+					if length3 <= 40 {
+						return false
+					} else {
+						if length3 <= 788 {
+							if length4 <= 185 {
+								if length1 <= 411 {
+									return true
+								} else {
+									return false
+								}
+							} else {
+								if length2 <= 112 {
+									return false
+								} else {
+									return true
+								}
+							}
+						} else {
+							if length3 <= 1346 {
+								if length1 <= 418 {
+									return false
+								} else {
+									return true
+								}
+							} else {
+								return false
+							}
+						}
+					}
+				} else {
+					if length2 <= 120 {
+						if length2 <= 63 {
+							return false
+						} else {
+							if length4 <= 653 {
+								return false
+							} else {
+								return false
+							}
+						}
+					} else {
+						return false
+					}
+				}
+			}
+		} else {
+			if length1 <= 206 {
+				if length1 <= 185 {
+					if length1 <= 171 {
+						return false
+					} else {
+						if length4 <= 211 {
+							return false
+						} else {
+							return false
+						}
+					}
+				} else {
+					if length2 <= 251 {
+						return true
+					} else {
+						return false
+					}
+				}
+			} else {
+				if length2 <= 286 {
+					if length1 <= 1123 {
+						if length3 <= 70 {
+							return false
+						} else {
+							if length1 <= 659 {
+								if length3 <= 370 {
+									return true
+								} else {
+									return false
+								}
+							} else {
+								if length4 <= 272 {
+									return false
+								} else {
+									return true
+								}
+							}
+						}
+					} else {
+						if length4 <= 537 {
+							if length2 <= 276 {
+								if length3 <= 1877 {
+									return false
+								} else {
+									return false
+								}
+							} else {
+								return false
+							}
+						} else {
+							if length1 <= 1466 {
+								if length1 <= 1435 {
+									return false
+								} else {
+									return true
+								}
+							} else {
+								if length2 <= 193 {
+									return false
+								} else {
+									return false
+								}
+							}
+						}
+					}
+				} else {
+					if length1 <= 284 {
+						if length1 <= 277 {
+							if length2 <= 726 {
+								return false
+							} else {
+								if length2 <= 768 {
+									return true
+								} else {
+									return false
+								}
+							}
+						} else {
+							if length2 <= 782 {
+								if length4 <= 783 {
+									return true
+								} else {
+									return false
+								}
+							} else {
+								return false
+							}
+						}
+					} else {
+						if length2 <= 492 {
+							if length2 <= 396 {
+								if length2 <= 322 {
+									return false
+								} else {
+									return false
+								}
+							} else {
+								if length4 <= 971 {
+									return false
+								} else {
+									return true
+								}
+							}
+						} else {
+							if length2 <= 2128 {
+								if length2 <= 1418 {
+									return false
+								} else {
+									return false
+								}
+							} else {
+								if length3 <= 103 {
+									return false
+								} else {
+									return false
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+	} else {
+		if length2 <= 6232 {
+			if length3 <= 85 {
+				if length2 <= 3599 {
+					return false
+				} else {
+					if length1 <= 613 {
+						return false
+					} else {
+						return false
+					}
+				}
+			} else {
+				if length3 <= 220 {
+					if length4 <= 1173 {
+						if length1 <= 874 {
+							if length4 <= 337 {
+								if length4 <= 68 {
+									return true
+								} else {
+									return true
+								}
+							} else {
+								if length1 <= 667 {
+									return true
+								} else {
+									return true
+								}
+							}
+						} else {
+							if length3 <= 108 {
+								if length1 <= 1930 {
+									return true
+								} else {
+									return true
+								}
+							} else {
+								if length2 <= 5383 {
+									return false
+								} else {
+									return true
+								}
+							}
+						}
+					} else {
+						return false
+					}
+				} else {
+					if length1 <= 664 {
+						if length3 <= 411 {
+							if length3 <= 383 {
+								if length4 <= 346 {
+									return true
+								} else {
+									return false
+								}
+							} else {
+								if length1 <= 445 {
+									return true
+								} else {
+									return false
+								}
+							}
+						} else {
+							if length2 <= 3708 {
+								if length4 <= 307 {
+									return true
+								} else {
+									return false
+								}
+							} else {
+								if length2 <= 4656 {
+									return false
+								} else {
+									return false
+								}
+							}
+						}
+					} else {
+						if length1 <= 1055 {
+							if length3 <= 580 {
+								if length1 <= 724 {
+									return true
+								} else {
+									return false
+								}
+							} else {
+								if length1 <= 678 {
+									return false
+								} else {
+									return true
+								}
+							}
+						} else {
+							if length2 <= 5352 {
+								if length3 <= 1586 {
+									return false
+								} else {
+									return false
+								}
+							} else {
+								if length4 <= 2173 {
+									return true
+								} else {
+									return false
+								}
+							}
+						}
+					}
+				}
+			}
+		} else {
+			if length2 <= 9408 {
+				if length1 <= 670 {
+					if length4 <= 76 {
+						if length3 <= 175 {
+							return true
+						} else {
+							return true
+						}
+					} else {
+						if length2 <= 9072 {
+							if length3 <= 314 {
+								if length3 <= 179 {
+									return false
+								} else {
+									return false
+								}
+							} else {
+								if length4 <= 708 {
+									return false
+								} else {
+									return false
+								}
+							}
+						} else {
+							return true
+						}
+					}
+				} else {
+					if length1 <= 795 {
+						if length2 <= 6334 {
+							if length2 <= 6288 {
+								return true
+							} else {
+								return false
+							}
+						} else {
+							if length4 <= 6404 {
+								if length2 <= 8194 {
+									return true
+								} else {
+									return true
+								}
+							} else {
+								if length2 <= 8924 {
+									return false
+								} else {
+									return true
+								}
+							}
+						}
+					} else {
+						if length3 <= 732 {
+							if length1 <= 1397 {
+								if length3 <= 179 {
+									return false
+								} else {
+									return false
+								}
+							} else {
+								if length1 <= 1976 {
+									return false
+								} else {
+									return false
+								}
+							}
+						} else {
+							if length1 <= 2840 {
+								if length1 <= 2591 {
+									return false
+								} else {
+									return true
+								}
+							} else {
+								return false
+							}
+						}
+					}
+				}
+			} else {
+				if length4 <= 30 {
+					return false
+				} else {
+					if length2 <= 13314 {
+						if length4 <= 1786 {
+							if length2 <= 13018 {
+								if length4 <= 869 {
+									return false
+								} else {
+									return false
+								}
+							} else {
+								return true
+							}
+						} else {
+							if length3 <= 775 {
+								return false
+							} else {
+								return false
+							}
+						}
+					} else {
+						if length4 <= 73 {
+							return false
+						} else {
+							if length3 <= 640 {
+								if length3 <= 237 {
+									return false
+								} else {
+									return false
+								}
+							} else {
+								if length2 <= 43804 {
+									return false
+								} else {
+									return false
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+}
--- a/analyzer/udp/dns.go
+++ b/analyzer/udp/dns.go
@@ -0,0 +1,265 @@
+package udp
+
+import (
+	"git.difuse.io/Difuse/Mellaris/analyzer"
+	"git.difuse.io/Difuse/Mellaris/analyzer/utils"
+
+	"github.com/google/gopacket"
+	"github.com/google/gopacket/layers"
+)
+
+const (
+	dnsUDPInvalidCountThreshold = 4
+)
+
+// DNSAnalyzer is for both DNS over UDP and TCP.
+var (
+	_ analyzer.UDPAnalyzer = (*DNSAnalyzer)(nil)
+	_ analyzer.TCPAnalyzer = (*DNSAnalyzer)(nil)
+)
+
+type DNSAnalyzer struct{}
+
+func (a *DNSAnalyzer) Name() string {
+	return "dns"
+}
+
+func (a *DNSAnalyzer) Limit() int {
+	// DNS is a stateless protocol, with unlimited amount
+	// of back-and-forth exchanges. Don't limit it here.
+	return 0
+}
+
+func (a *DNSAnalyzer) NewUDP(info analyzer.UDPInfo, logger analyzer.Logger) analyzer.UDPStream {
+	return &dnsUDPStream{logger: logger}
+}
+
+func (a *DNSAnalyzer) NewTCP(info analyzer.TCPInfo, logger analyzer.Logger) analyzer.TCPStream {
+	s := &dnsTCPStream{logger: logger, reqBuf: &utils.ByteBuffer{}, respBuf: &utils.ByteBuffer{}}
+	s.reqLSM = utils.NewLinearStateMachine(
+		s.getReqMessageLength,
+		s.getReqMessage,
+	)
+	s.respLSM = utils.NewLinearStateMachine(
+		s.getRespMessageLength,
+		s.getRespMessage,
+	)
+	return s
+}
+
+type dnsUDPStream struct {
+	logger       analyzer.Logger
+	invalidCount int
+}
+
+func (s *dnsUDPStream) Feed(rev bool, data []byte) (u *analyzer.PropUpdate, done bool) {
+	m := parseDNSMessage(data)
+	// To allow non-DNS UDP traffic to get offloaded,
+	// we consider a UDP stream invalid and "done" if
+	// it has more than a certain number of consecutive
+	// packets that are not valid DNS messages.
+	if m == nil {
+		s.invalidCount++
+		return nil, s.invalidCount >= dnsUDPInvalidCountThreshold
+	}
+	s.invalidCount = 0 // Reset invalid count on valid DNS message
+	return &analyzer.PropUpdate{
+		Type: analyzer.PropUpdateReplace,
+		M:    m,
+	}, false
+}
+
+func (s *dnsUDPStream) Close(limited bool) *analyzer.PropUpdate {
+	return nil
+}
+
+type dnsTCPStream struct {
+	logger analyzer.Logger
+
+	reqBuf     *utils.ByteBuffer
+	reqMap     analyzer.PropMap
+	reqUpdated bool
+	reqLSM     *utils.LinearStateMachine
+	reqDone    bool
+
+	respBuf     *utils.ByteBuffer
+	respMap     analyzer.PropMap
+	respUpdated bool
+	respLSM     *utils.LinearStateMachine
+	respDone    bool
+
+	reqMsgLen  int
+	respMsgLen int
+}
+
+func (s *dnsTCPStream) Feed(rev, start, end bool, skip int, data []byte) (u *analyzer.PropUpdate, done bool) {
+	if skip != 0 {
+		return nil, true
+	}
+	if len(data) == 0 {
+		return nil, false
+	}
+	var update *analyzer.PropUpdate
+	var cancelled bool
+	if rev {
+		s.respBuf.Append(data)
+		s.respUpdated = false
+		cancelled, s.respDone = s.respLSM.Run()
+		if s.respUpdated {
+			update = &analyzer.PropUpdate{
+				Type: analyzer.PropUpdateReplace,
+				M:    s.respMap,
+			}
+			s.respUpdated = false
+		}
+	} else {
+		s.reqBuf.Append(data)
+		s.reqUpdated = false
+		cancelled, s.reqDone = s.reqLSM.Run()
+		if s.reqUpdated {
+			update = &analyzer.PropUpdate{
+				Type: analyzer.PropUpdateReplace,
+				M:    s.reqMap,
+			}
+			s.reqUpdated = false
+		}
+	}
+	return update, cancelled || (s.reqDone && s.respDone)
+}
+
+func (s *dnsTCPStream) Close(limited bool) *analyzer.PropUpdate {
+	s.reqBuf.Reset()
+	s.respBuf.Reset()
+	s.reqMap = nil
+	s.respMap = nil
+	return nil
+}
+
+func (s *dnsTCPStream) getReqMessageLength() utils.LSMAction {
+	bs, ok := s.reqBuf.Get(2, true)
+	if !ok {
+		return utils.LSMActionPause
+	}
+	s.reqMsgLen = int(bs[0])<<8 | int(bs[1])
+	return utils.LSMActionNext
+}
+
+func (s *dnsTCPStream) getRespMessageLength() utils.LSMAction {
+	bs, ok := s.respBuf.Get(2, true)
+	if !ok {
+		return utils.LSMActionPause
+	}
+	s.respMsgLen = int(bs[0])<<8 | int(bs[1])
+	return utils.LSMActionNext
+}
+
+func (s *dnsTCPStream) getReqMessage() utils.LSMAction {
+	bs, ok := s.reqBuf.Get(s.reqMsgLen, true)
+	if !ok {
+		return utils.LSMActionPause
+	}
+	m := parseDNSMessage(bs)
+	if m == nil {
+		// Invalid DNS message
+		return utils.LSMActionCancel
+	}
+	s.reqMap = m
+	s.reqUpdated = true
+	return utils.LSMActionReset
+}
+
+func (s *dnsTCPStream) getRespMessage() utils.LSMAction {
+	bs, ok := s.respBuf.Get(s.respMsgLen, true)
+	if !ok {
+		return utils.LSMActionPause
+	}
+	m := parseDNSMessage(bs)
+	if m == nil {
+		// Invalid DNS message
+		return utils.LSMActionCancel
+	}
+	s.respMap = m
+	s.respUpdated = true
+	return utils.LSMActionReset
+}
+
+func parseDNSMessage(msg []byte) analyzer.PropMap {
+	dns := &layers.DNS{}
+	err := dns.DecodeFromBytes(msg, gopacket.NilDecodeFeedback)
+	if err != nil {
+		// Not a DNS packet
+		return nil
+	}
+	m := analyzer.PropMap{
+		"id":     dns.ID,
+		"qr":     dns.QR,
+		"opcode": dns.OpCode,
+		"aa":     dns.AA,
+		"tc":     dns.TC,
+		"rd":     dns.RD,
+		"ra":     dns.RA,
+		"z":      dns.Z,
+		"rcode":  dns.ResponseCode,
+	}
+	if len(dns.Questions) > 0 {
+		mQuestions := make([]analyzer.PropMap, len(dns.Questions))
+		for i, q := range dns.Questions {
+			mQuestions[i] = analyzer.PropMap{
+				"name":  string(q.Name),
+				"type":  q.Type,
+				"class": q.Class,
+			}
+		}
+		m["questions"] = mQuestions
+	}
+	if len(dns.Answers) > 0 {
+		mAnswers := make([]analyzer.PropMap, len(dns.Answers))
+		for i, rr := range dns.Answers {
+			mAnswers[i] = dnsRRToPropMap(rr)
+		}
+		m["answers"] = mAnswers
+	}
+	if len(dns.Authorities) > 0 {
+		mAuthorities := make([]analyzer.PropMap, len(dns.Authorities))
+		for i, rr := range dns.Authorities {
+			mAuthorities[i] = dnsRRToPropMap(rr)
+		}
+		m["authorities"] = mAuthorities
+	}
+	if len(dns.Additionals) > 0 {
+		mAdditionals := make([]analyzer.PropMap, len(dns.Additionals))
+		for i, rr := range dns.Additionals {
+			mAdditionals[i] = dnsRRToPropMap(rr)
+		}
+		m["additionals"] = mAdditionals
+	}
+	return m
+}
+
+func dnsRRToPropMap(rr layers.DNSResourceRecord) analyzer.PropMap {
+	m := analyzer.PropMap{
+		"name":  string(rr.Name),
+		"type":  rr.Type,
+		"class": rr.Class,
+		"ttl":   rr.TTL,
+	}
+	switch rr.Type {
+	// These are not everything, but is
+	// all we decided to support for now.
+	case layers.DNSTypeA:
+		m["a"] = rr.IP.String()
+	case layers.DNSTypeAAAA:
+		m["aaaa"] = rr.IP.String()
+	case layers.DNSTypeNS:
+		m["ns"] = string(rr.NS)
+	case layers.DNSTypeCNAME:
+		m["cname"] = string(rr.CNAME)
+	case layers.DNSTypePTR:
+		m["ptr"] = string(rr.PTR)
+	case layers.DNSTypeTXT:
+		m["txt"] = utils.ByteSlicesToStrings(rr.TXTs)
+	case layers.DNSTypeMX:
+		m["mx"] = string(rr.MX.Name)
+	}
+	return m
+}
--- a/analyzer/udp/internal/quic/LICENSE
+++ b/analyzer/udp/internal/quic/LICENSE
@@ -0,0 +1,31 @@
+Author:: Cuong Manh Le <cuong.manhle.vn@gmail.com>
+Copyright:: Copyright (c) 2023, Cuong Manh Le
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+
+    * Redistributions in binary form must reproduce the above
+      copyright notice, this list of conditions and the following
+      disclaimer in the documentation and/or other materials provided
+      with the distribution.
+
+    * Neither the name of the @organization@ nor the names of its
+      contributors may be used to endorse or promote products derived
+      from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL LE MANH CUONG
+BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
--- a/analyzer/udp/internal/quic/README.md
+++ b/analyzer/udp/internal/quic/README.md
@@ -0,0 +1 @@
+The code here is from https://github.com/cuonglm/quicsni with various modifications.
--- a/analyzer/udp/internal/quic/header.go
+++ b/analyzer/udp/internal/quic/header.go
@@ -0,0 +1,105 @@
+package quic
+
+import (
+	"bytes"
+	"encoding/binary"
+	"errors"
+	"io"
+
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// The Header represents a QUIC header.
+type Header struct {
+	Type             uint8
+	Version          uint32
+	SrcConnectionID  []byte
+	DestConnectionID []byte
+	Length           int64
+	Token            []byte
+}
+
+// ParseInitialHeader parses the initial packet of a QUIC connection,
+// return the initial header and number of bytes read so far.
+func ParseInitialHeader(data []byte) (*Header, int64, error) {
+	br := bytes.NewReader(data)
+	hdr, err := parseLongHeader(br)
+	if err != nil {
+		return nil, 0, err
+	}
+	n := int64(len(data) - br.Len())
+	return hdr, n, nil
+}
+
+func parseLongHeader(b *bytes.Reader) (*Header, error) {
+	typeByte, err := b.ReadByte()
+	if err != nil {
+		return nil, err
+	}
+	h := &Header{}
+	ver, err := beUint32(b)
+	if err != nil {
+		return nil, err
+	}
+	h.Version = ver
+	if h.Version != 0 && typeByte&0x40 == 0 {
+		return nil, errors.New("not a QUIC packet")
+	}
+	destConnIDLen, err := b.ReadByte()
+	if err != nil {
+		return nil, err
+	}
+	h.DestConnectionID = make([]byte, int(destConnIDLen))
+	if err := readConnectionID(b, h.DestConnectionID); err != nil {
+		return nil, err
+	}
+	srcConnIDLen, err := b.ReadByte()
+	if err != nil {
+		return nil, err
+	}
+	h.SrcConnectionID = make([]byte, int(srcConnIDLen))
+	if err := readConnectionID(b, h.SrcConnectionID); err != nil {
+		return nil, err
+	}
+
+	initialPacketType := byte(0b00)
+	if h.Version == V2 {
+		initialPacketType = 0b01
+	}
+	if (typeByte >> 4 & 0b11) == initialPacketType {
+		tokenLen, err := quicvarint.Read(b)
+		if err != nil {
+			return nil, err
+		}
+		if tokenLen > uint64(b.Len()) {
+			return nil, io.EOF
+		}
+		h.Token = make([]byte, tokenLen)
+		if _, err := io.ReadFull(b, h.Token); err != nil {
+			return nil, err
+		}
+	}
+
+	pl, err := quicvarint.Read(b)
+	if err != nil {
+		return nil, err
+	}
+	h.Length = int64(pl)
+	return h, err
+}
+
+func readConnectionID(r io.Reader, cid []byte) error {
+	_, err := io.ReadFull(r, cid)
+	if err == io.ErrUnexpectedEOF {
+		return io.EOF
+	}
+	return nil
+}
+
+func beUint32(r io.Reader) (uint32, error) {
+	b := make([]byte, 4)
+	if _, err := io.ReadFull(r, b); err != nil {
+		return 0, err
+	}
+	return binary.BigEndian.Uint32(b), nil
+}
--- a/analyzer/udp/internal/quic/packet_protector.go
+++ b/analyzer/udp/internal/quic/packet_protector.go
@@ -0,0 +1,193 @@
+package quic
+
+import (
+	"crypto"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/sha256"
+	"crypto/tls"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"hash"
+
+	"golang.org/x/crypto/chacha20"
+	"golang.org/x/crypto/chacha20poly1305"
+	"golang.org/x/crypto/cryptobyte"
+	"golang.org/x/crypto/hkdf"
+)
+
+// NewProtectionKey creates a new ProtectionKey.
+func NewProtectionKey(suite uint16, secret []byte, v uint32) (*ProtectionKey, error) {
+	return newProtectionKey(suite, secret, v)
+}
+
+// NewInitialProtectionKey is like NewProtectionKey, but the returned protection key
+// is used for encrypt/decrypt Initial Packet only.
+//
+// See: https://datatracker.ietf.org/doc/html/draft-ietf-quic-tls-32#name-initial-secrets
+func NewInitialProtectionKey(secret []byte, v uint32) (*ProtectionKey, error) {
+	return NewProtectionKey(tls.TLS_AES_128_GCM_SHA256, secret, v)
+}
+
+// NewPacketProtector creates a new PacketProtector.
+func NewPacketProtector(key *ProtectionKey) *PacketProtector {
+	return &PacketProtector{key: key}
+}
+
+// PacketProtector is used for protecting a QUIC packet.
+//
+// See: https://www.rfc-editor.org/rfc/rfc9001.html#name-packet-protection
+type PacketProtector struct {
+	key *ProtectionKey
+}
+
+// UnProtect decrypts a QUIC packet.
+func (pp *PacketProtector) UnProtect(packet []byte, pnOffset, pnMax int64) ([]byte, error) {
+	if isLongHeader(packet[0]) && int64(len(packet)) < pnOffset+4+16 {
+		return nil, errors.New("packet with long header is too small")
+	}
+
+	// https://www.rfc-editor.org/rfc/rfc9001.html#name-header-protection-sample
+	sampleOffset := pnOffset + 4
+	sample := packet[sampleOffset : sampleOffset+16]
+
+	// https://www.rfc-editor.org/rfc/rfc9001.html#name-header-protection-applicati
+	mask := pp.key.headerProtection(sample)
+	if isLongHeader(packet[0]) {
+		// Long header: 4 bits masked
+		packet[0] ^= mask[0] & 0x0f
+	} else {
+		// Short header: 5 bits masked
+		packet[0] ^= mask[0] & 0x1f
+	}
+
+	pnLen := packet[0]&0x3 + 1
+	pn := int64(0)
+	for i := uint8(0); i < pnLen; i++ {
+		packet[pnOffset:][i] ^= mask[1+i]
+		pn = (pn << 8) | int64(packet[pnOffset:][i])
+	}
+	pn = decodePacketNumber(pnMax, pn, pnLen)
+	hdr := packet[:pnOffset+int64(pnLen)]
+	payload := packet[pnOffset:][pnLen:]
+	dec, err := pp.key.aead.Open(payload[:0], pp.key.nonce(pn), payload, hdr)
+	if err != nil {
+		return nil, fmt.Errorf("decryption failed: %w", err)
+	}
+	return dec, nil
+}
+
+// ProtectionKey is the key used to protect a QUIC packet.
+type ProtectionKey struct {
+	aead             cipher.AEAD
+	headerProtection func(sample []byte) (mask []byte)
+	iv               []byte
+}
+
+// https://datatracker.ietf.org/doc/html/draft-ietf-quic-tls-32#name-aead-usage
+//
+// "The 62 bits of the reconstructed QUIC packet number in network byte order are
+// left-padded with zeros to the size of the IV. The exclusive OR of the padded
+// packet number and the IV forms the AEAD nonce."
+func (pk *ProtectionKey) nonce(pn int64) []byte {
+	nonce := make([]byte, len(pk.iv))
+	binary.BigEndian.PutUint64(nonce[len(nonce)-8:], uint64(pn))
+	for i := range pk.iv {
+		nonce[i] ^= pk.iv[i]
+	}
+	return nonce
+}
+
+func newProtectionKey(suite uint16, secret []byte, v uint32) (*ProtectionKey, error) {
+	switch suite {
+	case tls.TLS_AES_128_GCM_SHA256:
+		key := hkdfExpandLabel(crypto.SHA256.New, secret, keyLabel(v), nil, 16)
+		c, err := aes.NewCipher(key)
+		if err != nil {
+			panic(err)
+		}
+		aead, err := cipher.NewGCM(c)
+		if err != nil {
+			panic(err)
+		}
+		iv := hkdfExpandLabel(crypto.SHA256.New, secret, ivLabel(v), nil, aead.NonceSize())
+		hpKey := hkdfExpandLabel(crypto.SHA256.New, secret, headerProtectionLabel(v), nil, 16)
+		hp, err := aes.NewCipher(hpKey)
+		if err != nil {
+			panic(err)
+		}
+		k := &ProtectionKey{}
+		k.aead = aead
+		// https://datatracker.ietf.org/doc/html/draft-ietf-quic-tls-32#name-aes-based-header-protection
+		k.headerProtection = func(sample []byte) []byte {
+			mask := make([]byte, hp.BlockSize())
+			hp.Encrypt(mask, sample)
+			return mask
+		}
+		k.iv = iv
+		return k, nil
+	case tls.TLS_CHACHA20_POLY1305_SHA256:
+		key := hkdfExpandLabel(crypto.SHA256.New, secret, keyLabel(v), nil, chacha20poly1305.KeySize)
+		aead, err := chacha20poly1305.New(key)
+		if err != nil {
+			return nil, err
+		}
+		iv := hkdfExpandLabel(crypto.SHA256.New, secret, ivLabel(v), nil, aead.NonceSize())
+		hpKey := hkdfExpandLabel(sha256.New, secret, headerProtectionLabel(v), nil, chacha20.KeySize)
+		k := &ProtectionKey{}
+		k.aead = aead
+		// https://datatracker.ietf.org/doc/html/draft-ietf-quic-tls-32#name-chacha20-based-header-prote
+		k.headerProtection = func(sample []byte) []byte {
+			nonce := sample[4:16]
+			c, err := chacha20.NewUnauthenticatedCipher(hpKey, nonce)
+			if err != nil {
+				panic(err)
+			}
+			c.SetCounter(binary.LittleEndian.Uint32(sample[:4]))
+			mask := make([]byte, 5)
+			c.XORKeyStream(mask, mask)
+			return mask
+		}
+		k.iv = iv
+		return k, nil
+	}
+	return nil, errors.New("not supported cipher suite")
+}
+
+// decodePacketNumber decode the packet number after header protection removed.
+//
+// See: https://datatracker.ietf.org/doc/html/draft-ietf-quic-transport-32#section-appendix.a
+func decodePacketNumber(largest, truncated int64, nbits uint8) int64 {
+	expected := largest + 1
+	win := int64(1 << (nbits * 8))
+	hwin := win / 2
+	mask := win - 1
+	candidate := (expected &^ mask) | truncated
+	switch {
+	case candidate <= expected-hwin && candidate < (1<<62)-win:
+		return candidate + win
+	case candidate > expected+hwin && candidate >= win:
+		return candidate - win
+	}
+	return candidate
+}
+
+// Copied from crypto/tls/key_schedule.go.
+func hkdfExpandLabel(hash func() hash.Hash, secret []byte, label string, context []byte, length int) []byte {
+	var hkdfLabel cryptobyte.Builder
+	hkdfLabel.AddUint16(uint16(length))
+	hkdfLabel.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) {
+		b.AddBytes([]byte("tls13 "))
+		b.AddBytes([]byte(label))
+	})
+	hkdfLabel.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) {
+		b.AddBytes(context)
+	})
+	out := make([]byte, length)
+	n, err := hkdf.Expand(hash, secret, hkdfLabel.BytesOrPanic()).Read(out)
+	if err != nil || n != length {
+		panic("quic: HKDF-Expand-Label invocation failed unexpectedly")
+	}
+	return out
+}
--- a/analyzer/udp/internal/quic/packet_protector_test.go
+++ b/analyzer/udp/internal/quic/packet_protector_test.go
@@ -0,0 +1,94 @@
+package quic
+
+import (
+	"bytes"
+	"crypto"
+	"crypto/tls"
+	"encoding/hex"
+	"strings"
+	"testing"
+	"unicode"
+
+	"golang.org/x/crypto/hkdf"
+)
+
+func TestInitialPacketProtector_UnProtect(t *testing.T) {
+	// https://datatracker.ietf.org/doc/html/draft-ietf-quic-tls-32#name-server-initial
+	protect := mustHexDecodeString(`
+			c7ff0000200008f067a5502a4262b500 4075fb12ff07823a5d24534d906ce4c7
+			6782a2167e3479c0f7f6395dc2c91676 302fe6d70bb7cbeb117b4ddb7d173498
+			44fd61dae200b8338e1b932976b61d91 e64a02e9e0ee72e3a6f63aba4ceeeec5
+			be2f24f2d86027572943533846caa13e 6f163fb257473d0eda5047360fd4a47e
+			fd8142fafc0f76
+		`)
+	unProtect := mustHexDecodeString(`
+			02000000000600405a020000560303ee fce7f7b37ba1d1632e96677825ddf739
+			88cfc79825df566dc5430b9a045a1200 130100002e00330024001d00209d3c94
+			0d89690b84d08a60993c144eca684d10 81287c834d5311bcf32bb9da1a002b00
+			020304
+		`)
+
+	connID := mustHexDecodeString(`8394c8f03e515708`)
+
+	packet := append([]byte{}, protect...)
+	hdr, offset, err := ParseInitialHeader(packet)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	initialSecret := hkdf.Extract(crypto.SHA256.New, connID, getSalt(hdr.Version))
+	serverSecret := hkdfExpandLabel(crypto.SHA256.New, initialSecret, "server in", []byte{}, crypto.SHA256.Size())
+	key, err := NewInitialProtectionKey(serverSecret, hdr.Version)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pp := NewPacketProtector(key)
+	got, err := pp.UnProtect(protect, offset, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(got, unProtect) {
+		t.Error("UnProtect returns wrong result")
+	}
+}
+
+func TestPacketProtectorShortHeader_UnProtect(t *testing.T) {
+	// https://datatracker.ietf.org/doc/html/draft-ietf-quic-tls-32#name-chacha20-poly1305-short-hea
+	protect := mustHexDecodeString(`4cfe4189655e5cd55c41f69080575d7999c25a5bfb`)
+	unProtect := mustHexDecodeString(`01`)
+	hdr := mustHexDecodeString(`4200bff4`)
+
+	secret := mustHexDecodeString(`9ac312a7f877468ebe69422748ad00a1 5443f18203a07d6060f688f30f21632b`)
+	k, err := NewProtectionKey(tls.TLS_CHACHA20_POLY1305_SHA256, secret, V1)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	pnLen := int(hdr[0]&0x03) + 1
+	offset := len(hdr) - pnLen
+	pp := NewPacketProtector(k)
+	got, err := pp.UnProtect(protect, int64(offset), 654360564)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(got, unProtect) {
+		t.Error("UnProtect returns wrong result")
+	}
+}
+
+func mustHexDecodeString(s string) []byte {
+	b, err := hex.DecodeString(normalizeHex(s))
+	if err != nil {
+		panic(err)
+	}
+	return b
+}
+
+func normalizeHex(s string) string {
+	return strings.Map(func(c rune) rune {
+		if unicode.IsSpace(c) {
+			return -1
+		}
+		return c
+	}, s)
+}
--- a/analyzer/udp/internal/quic/payload.go
+++ b/analyzer/udp/internal/quic/payload.go
@@ -0,0 +1,122 @@
+package quic
+
+import (
+	"bytes"
+	"crypto"
+	"errors"
+	"fmt"
+	"io"
+	"sort"
+
+	"github.com/quic-go/quic-go/quicvarint"
+	"golang.org/x/crypto/hkdf"
+)
+
+func ReadCryptoPayload(packet []byte) ([]byte, error) {
+	hdr, offset, err := ParseInitialHeader(packet)
+	if err != nil {
+		return nil, err
+	}
+	// Some sanity checks
+	if hdr.Version != V1 && hdr.Version != V2 {
+		return nil, fmt.Errorf("unsupported version: %x", hdr.Version)
+	}
+	if offset == 0 || hdr.Length == 0 {
+		return nil, errors.New("invalid packet")
+	}
+
+	initialSecret := hkdf.Extract(crypto.SHA256.New, hdr.DestConnectionID, getSalt(hdr.Version))
+	clientSecret := hkdfExpandLabel(crypto.SHA256.New, initialSecret, "client in", []byte{}, crypto.SHA256.Size())
+	key, err := NewInitialProtectionKey(clientSecret, hdr.Version)
+	if err != nil {
+		return nil, fmt.Errorf("NewInitialProtectionKey: %w", err)
+	}
+	pp := NewPacketProtector(key)
+	// https://datatracker.ietf.org/doc/html/draft-ietf-quic-tls-32#name-client-initial
+	//
+	// "The unprotected header includes the connection ID and a 4-byte packet number encoding for a packet number of 2"
+	if int64(len(packet)) < offset+hdr.Length {
+		return nil, fmt.Errorf("packet is too short: %d < %d", len(packet), offset+hdr.Length)
+	}
+	unProtectedPayload, err := pp.UnProtect(packet[:offset+hdr.Length], offset, 2)
+	if err != nil {
+		return nil, err
+	}
+	frs, err := extractCryptoFrames(bytes.NewReader(unProtectedPayload))
+	if err != nil {
+		return nil, err
+	}
+	data := assembleCryptoFrames(frs)
+	if data == nil {
+		return nil, errors.New("unable to assemble crypto frames")
+	}
+	return data, nil
+}
+
+const (
+	paddingFrameType = 0x00
+	pingFrameType    = 0x01
+	cryptoFrameType  = 0x06
+)
+
+type cryptoFrame struct {
+	Offset int64
+	Data   []byte
+}
+
+func extractCryptoFrames(r *bytes.Reader) ([]cryptoFrame, error) {
+	var frames []cryptoFrame
+	for r.Len() > 0 {
+		typ, err := quicvarint.Read(r)
+		if err != nil {
+			return nil, err
+		}
+		if typ == paddingFrameType || typ == pingFrameType {
+			continue
+		}
+		if typ != cryptoFrameType {
+			return nil, fmt.Errorf("encountered unexpected frame type: %d", typ)
+		}
+		var frame cryptoFrame
+		offset, err := quicvarint.Read(r)
+		if err != nil {
+			return nil, err
+		}
+		frame.Offset = int64(offset)
+		dataLen, err := quicvarint.Read(r)
+		if err != nil {
+			return nil, err
+		}
+		frame.Data = make([]byte, dataLen)
+		if _, err := io.ReadFull(r, frame.Data); err != nil {
+			return nil, err
+		}
+		frames = append(frames, frame)
+	}
+	return frames, nil
+}
+
+// assembleCryptoFrames assembles multiple crypto frames into a single slice (if possible).
+// It returns an error if the frames cannot be assembled. This can happen if the frames are not contiguous.
+func assembleCryptoFrames(frames []cryptoFrame) []byte {
+	if len(frames) == 0 {
+		return nil
+	}
+	if len(frames) == 1 {
+		return frames[0].Data
+	}
+	// sort the frames by offset
+	sort.Slice(frames, func(i, j int) bool { return frames[i].Offset < frames[j].Offset })
+	// check if the frames are contiguous
+	for i := 1; i < len(frames); i++ {
+		if frames[i].Offset != frames[i-1].Offset+int64(len(frames[i-1].Data)) {
+			return nil
+		}
+	}
+	// concatenate the frames
+	data := make([]byte, frames[len(frames)-1].Offset+int64(len(frames[len(frames)-1].Data)))
+	for _, frame := range frames {
+		copy(data[frame.Offset:], frame.Data)
+	}
+	return data
+}
--- a/analyzer/udp/internal/quic/quic.go
+++ b/analyzer/udp/internal/quic/quic.go
@@ -0,0 +1,59 @@
+package quic
+
+const (
+	V1 uint32 = 0x1
+	V2 uint32 = 0x6b3343cf
+
+	hkdfLabelKeyV1 = "quic key"
+	hkdfLabelKeyV2 = "quicv2 key"
+	hkdfLabelIVV1  = "quic iv"
+	hkdfLabelIVV2  = "quicv2 iv"
+	hkdfLabelHPV1  = "quic hp"
+	hkdfLabelHPV2  = "quicv2 hp"
+)
+
+var (
+	quicSaltOld = []byte{0xaf, 0xbf, 0xec, 0x28, 0x99, 0x93, 0xd2, 0x4c, 0x9e, 0x97, 0x86, 0xf1, 0x9c, 0x61, 0x11, 0xe0, 0x43, 0x90, 0xa8, 0x99}
+	// https://www.rfc-editor.org/rfc/rfc9001.html#name-initial-secrets
+	quicSaltV1 = []byte{0x38, 0x76, 0x2c, 0xf7, 0xf5, 0x59, 0x34, 0xb3, 0x4d, 0x17, 0x9a, 0xe6, 0xa4, 0xc8, 0x0c, 0xad, 0xcc, 0xbb, 0x7f, 0x0a}
+	// https://www.ietf.org/archive/id/draft-ietf-quic-v2-10.html#name-initial-salt-2
+	quicSaltV2 = []byte{0x0d, 0xed, 0xe3, 0xde, 0xf7, 0x00, 0xa6, 0xdb, 0x81, 0x93, 0x81, 0xbe, 0x6e, 0x26, 0x9d, 0xcb, 0xf9, 0xbd, 0x2e, 0xd9}
+)
+
+// isLongHeader reports whether b is the first byte of a long header packet.
+func isLongHeader(b byte) bool {
+	return b&0x80 > 0
+}
+
+func getSalt(v uint32) []byte {
+	switch v {
+	case V1:
+		return quicSaltV1
+	case V2:
+		return quicSaltV2
+	}
+	return quicSaltOld
+}
+
+func keyLabel(v uint32) string {
+	kl := hkdfLabelKeyV1
+	if v == V2 {
+		kl = hkdfLabelKeyV2
+	}
+	return kl
+}
+
+func ivLabel(v uint32) string {
+	ivl := hkdfLabelIVV1
+	if v == V2 {
+		ivl = hkdfLabelIVV2
+	}
+	return ivl
+}
+
+func headerProtectionLabel(v uint32) string {
+	if v == V2 {
+		return hkdfLabelHPV2
+	}
+	return hkdfLabelHPV1
+}
--- a/analyzer/udp/openvpn.go
+++ b/analyzer/udp/openvpn.go
@@ -0,0 +1,384 @@
+package udp
+
+import (
+	"git.difuse.io/Difuse/Mellaris/analyzer"
+	"git.difuse.io/Difuse/Mellaris/analyzer/utils"
+)
+
+var (
+	_ analyzer.UDPAnalyzer = (*OpenVPNAnalyzer)(nil)
+	_ analyzer.TCPAnalyzer = (*OpenVPNAnalyzer)(nil)
+)
+
+var (
+	_ analyzer.UDPStream = (*openvpnUDPStream)(nil)
+	_ analyzer.TCPStream = (*openvpnTCPStream)(nil)
+)
+
+// Ref paper:
+// https://www.usenix.org/system/files/sec22fall_xue-diwen.pdf
+
+// OpenVPN Opcodes definitions from:
+// https://github.com/OpenVPN/openvpn/blob/master/src/openvpn/ssl_pkt.h
+const (
+	OpenVPNControlHardResetClientV1 = 1
+	OpenVPNControlHardResetServerV1 = 2
+	OpenVPNControlSoftResetV1       = 3
+	OpenVPNControlV1                = 4
+	OpenVPNAckV1                    = 5
+	OpenVPNDataV1                   = 6
+	OpenVPNControlHardResetClientV2 = 7
+	OpenVPNControlHardResetServerV2 = 8
+	OpenVPNDataV2                   = 9
+	OpenVPNControlHardResetClientV3 = 10
+	OpenVPNControlWkcV1             = 11
+)
+
+const (
+	OpenVPNMinPktLen          = 6
+	OpenVPNTCPPktDefaultLimit = 256
+	OpenVPNUDPPktDefaultLimit = 256
+)
+
+type OpenVPNAnalyzer struct{}
+
+func (a *OpenVPNAnalyzer) Name() string {
+	return "openvpn"
+}
+
+func (a *OpenVPNAnalyzer) Limit() int {
+	return 0
+}
+
+func (a *OpenVPNAnalyzer) NewUDP(info analyzer.UDPInfo, logger analyzer.Logger) analyzer.UDPStream {
+	return newOpenVPNUDPStream(logger)
+}
+
+func (a *OpenVPNAnalyzer) NewTCP(info analyzer.TCPInfo, logger analyzer.Logger) analyzer.TCPStream {
+	return newOpenVPNTCPStream(logger)
+}
+
+type openvpnPkt struct {
+	pktLen uint16 // 16 bits, TCP proto only
+	opcode byte   // 5 bits
+	_keyId byte   // 3 bits, not used
+
+	// We don't care about the rest of the packet
+	// payload []byte
+}
+
+type openvpnStream struct {
+	logger analyzer.Logger
+
+	reqUpdated bool
+	reqLSM     *utils.LinearStateMachine
+	reqDone    bool
+
+	respUpdated bool
+	respLSM     *utils.LinearStateMachine
+	respDone    bool
+
+	rxPktCnt int
+	txPktCnt int
+	pktLimit int
+
+	reqPktParse  func() (*openvpnPkt, utils.LSMAction)
+	respPktParse func() (*openvpnPkt, utils.LSMAction)
+
+	lastOpcode byte
+}
+
+func (o *openvpnStream) parseCtlHardResetClient() utils.LSMAction {
+	pkt, action := o.reqPktParse()
+	if action != utils.LSMActionNext {
+		return action
+	}
+
+	if pkt.opcode != OpenVPNControlHardResetClientV1 &&
+		pkt.opcode != OpenVPNControlHardResetClientV2 &&
+		pkt.opcode != OpenVPNControlHardResetClientV3 {
+		return utils.LSMActionCancel
+	}
+	o.lastOpcode = pkt.opcode
+
+	return utils.LSMActionNext
+}
+
+func (o *openvpnStream) parseCtlHardResetServer() utils.LSMAction {
+	if o.lastOpcode != OpenVPNControlHardResetClientV1 &&
+		o.lastOpcode != OpenVPNControlHardResetClientV2 &&
+		o.lastOpcode != OpenVPNControlHardResetClientV3 {
+		return utils.LSMActionCancel
+	}
+
+	pkt, action := o.respPktParse()
+	if action != utils.LSMActionNext {
+		return action
+	}
+
+	if pkt.opcode != OpenVPNControlHardResetServerV1 &&
+		pkt.opcode != OpenVPNControlHardResetServerV2 {
+		return utils.LSMActionCancel
+	}
+	o.lastOpcode = pkt.opcode
+
+	return utils.LSMActionNext
+}
+
+func (o *openvpnStream) parseReq() utils.LSMAction {
+	pkt, action := o.reqPktParse()
+	if action != utils.LSMActionNext {
+		return action
+	}
+
+	if pkt.opcode != OpenVPNControlSoftResetV1 &&
+		pkt.opcode != OpenVPNControlV1 &&
+		pkt.opcode != OpenVPNAckV1 &&
+		pkt.opcode != OpenVPNDataV1 &&
+		pkt.opcode != OpenVPNDataV2 &&
+		pkt.opcode != OpenVPNControlWkcV1 {
+		return utils.LSMActionCancel
+	}
+
+	o.txPktCnt += 1
+	o.reqUpdated = true
+
+	return utils.LSMActionPause
+}
+
+func (o *openvpnStream) parseResp() utils.LSMAction {
+	pkt, action := o.respPktParse()
+	if action != utils.LSMActionNext {
+		return action
+	}
+
+	if pkt.opcode != OpenVPNControlSoftResetV1 &&
+		pkt.opcode != OpenVPNControlV1 &&
+		pkt.opcode != OpenVPNAckV1 &&
+		pkt.opcode != OpenVPNDataV1 &&
+		pkt.opcode != OpenVPNDataV2 &&
+		pkt.opcode != OpenVPNControlWkcV1 {
+		return utils.LSMActionCancel
+	}
+
+	o.rxPktCnt += 1
+	o.respUpdated = true
+
+	return utils.LSMActionPause
+}
+
+type openvpnUDPStream struct {
+	openvpnStream
+	curPkt []byte
+	// We don't introduce `invalidCount` here to decrease the false positive rate
+	// invalidCount int
+}
+
+func newOpenVPNUDPStream(logger analyzer.Logger) *openvpnUDPStream {
+	s := &openvpnUDPStream{
+		openvpnStream: openvpnStream{
+			logger:   logger,
+			pktLimit: OpenVPNUDPPktDefaultLimit,
+		},
+	}
+	s.respPktParse = s.parsePkt
+	s.reqPktParse = s.parsePkt
+	s.reqLSM = utils.NewLinearStateMachine(
+		s.parseCtlHardResetClient,
+		s.parseReq,
+	)
+	s.respLSM = utils.NewLinearStateMachine(
+		s.parseCtlHardResetServer,
+		s.parseResp,
+	)
+	return s
+}
+
+func (o *openvpnUDPStream) Feed(rev bool, data []byte) (u *analyzer.PropUpdate, d bool) {
+	if len(data) == 0 {
+		return nil, false
+	}
+	var update *analyzer.PropUpdate
+	var cancelled bool
+	o.curPkt = data
+	if rev {
+		o.respUpdated = false
+		cancelled, o.respDone = o.respLSM.Run()
+		if o.respUpdated {
+			update = &analyzer.PropUpdate{
+				Type: analyzer.PropUpdateReplace,
+				M:    analyzer.PropMap{"rx_pkt_cnt": o.rxPktCnt, "tx_pkt_cnt": o.txPktCnt},
+			}
+			o.respUpdated = false
+		}
+	} else {
+		o.reqUpdated = false
+		cancelled, o.reqDone = o.reqLSM.Run()
+		if o.reqUpdated {
+			update = &analyzer.PropUpdate{
+				Type: analyzer.PropUpdateReplace,
+				M:    analyzer.PropMap{"rx_pkt_cnt": o.rxPktCnt, "tx_pkt_cnt": o.txPktCnt},
+			}
+			o.reqUpdated = false
+		}
+	}
+
+	return update, cancelled || (o.reqDone && o.respDone) || o.rxPktCnt+o.txPktCnt > o.pktLimit
+}
+
+func (o *openvpnUDPStream) Close(limited bool) *analyzer.PropUpdate {
+	return nil
+}
+
+// Parse OpenVPN UDP packet.
+func (o *openvpnUDPStream) parsePkt() (p *openvpnPkt, action utils.LSMAction) {
+	if o.curPkt == nil {
+		return nil, utils.LSMActionPause
+	}
+
+	if !OpenVPNCheckForValidOpcode(o.curPkt[0] >> 3) {
+		return nil, utils.LSMActionCancel
+	}
+
+	// Parse packet header
+	p = &openvpnPkt{}
+	p.opcode = o.curPkt[0] >> 3
+	p._keyId = o.curPkt[0] & 0x07
+
+	o.curPkt = nil
+	return p, utils.LSMActionNext
+}
+
+type openvpnTCPStream struct {
+	openvpnStream
+	reqBuf  *utils.ByteBuffer
+	respBuf *utils.ByteBuffer
+}
+
+func newOpenVPNTCPStream(logger analyzer.Logger) *openvpnTCPStream {
+	s := &openvpnTCPStream{
+		openvpnStream: openvpnStream{
+			logger:   logger,
+			pktLimit: OpenVPNTCPPktDefaultLimit,
+		},
+		reqBuf:  &utils.ByteBuffer{},
+		respBuf: &utils.ByteBuffer{},
+	}
+	s.respPktParse = func() (*openvpnPkt, utils.LSMAction) {
+		return s.parsePkt(true)
+	}
+	s.reqPktParse = func() (*openvpnPkt, utils.LSMAction) {
+		return s.parsePkt(false)
+	}
+	s.reqLSM = utils.NewLinearStateMachine(
+		s.parseCtlHardResetClient,
+		s.parseReq,
+	)
+	s.respLSM = utils.NewLinearStateMachine(
+		s.parseCtlHardResetServer,
+		s.parseResp,
+	)
+	return s
+}
+
+func (o *openvpnTCPStream) Feed(rev, start, end bool, skip int, data []byte) (u *analyzer.PropUpdate, d bool) {
+	if skip != 0 {
+		return nil, true
+	}
+	if len(data) == 0 {
+		return nil, false
+	}
+	var update *analyzer.PropUpdate
+	var cancelled bool
+	if rev {
+		o.respBuf.Append(data)
+		o.respUpdated = false
+		cancelled, o.respDone = o.respLSM.Run()
+		if o.respUpdated {
+			update = &analyzer.PropUpdate{
+				Type: analyzer.PropUpdateReplace,
+				M:    analyzer.PropMap{"rx_pkt_cnt": o.rxPktCnt, "tx_pkt_cnt": o.txPktCnt},
+			}
+			o.respUpdated = false
+		}
+	} else {
+		o.reqBuf.Append(data)
+		o.reqUpdated = false
+		cancelled, o.reqDone = o.reqLSM.Run()
+		if o.reqUpdated {
+			update = &analyzer.PropUpdate{
+				Type: analyzer.PropUpdateMerge,
+				M:    analyzer.PropMap{"rx_pkt_cnt": o.rxPktCnt, "tx_pkt_cnt": o.txPktCnt},
+			}
+			o.reqUpdated = false
+		}
+	}
+
+	return update, cancelled || (o.reqDone && o.respDone) || o.rxPktCnt+o.txPktCnt > o.pktLimit
+}
+
+func (o *openvpnTCPStream) Close(limited bool) *analyzer.PropUpdate {
+	o.reqBuf.Reset()
+	o.respBuf.Reset()
+	return nil
+}
+
+// Parse OpenVPN TCP packet.
+func (o *openvpnTCPStream) parsePkt(rev bool) (p *openvpnPkt, action utils.LSMAction) {
+	var buffer *utils.ByteBuffer
+	if rev {
+		buffer = o.respBuf
+	} else {
+		buffer = o.reqBuf
+	}
+
+	// Parse packet length
+	pktLen, ok := buffer.GetUint16(false, false)
+	if !ok {
+		return nil, utils.LSMActionPause
+	}
+
+	if pktLen < OpenVPNMinPktLen {
+		return nil, utils.LSMActionCancel
+	}
+
+	pktOp, ok := buffer.Get(3, false)
+	if !ok {
+		return nil, utils.LSMActionPause
+	}
+	if !OpenVPNCheckForValidOpcode(pktOp[2] >> 3) {
+		return nil, utils.LSMActionCancel
+	}
+
+	pkt, ok := buffer.Get(int(pktLen)+2, true)
+	if !ok {
+		return nil, utils.LSMActionPause
+	}
+	pkt = pkt[2:]
+
+	// Parse packet header
+	p = &openvpnPkt{}
+	p.pktLen = pktLen
+	p.opcode = pkt[0] >> 3
+	p._keyId = pkt[0] & 0x07
+
+	return p, utils.LSMActionNext
+}
+
+func OpenVPNCheckForValidOpcode(opcode byte) bool {
+	switch opcode {
+	case OpenVPNControlHardResetClientV1,
+		OpenVPNControlHardResetServerV1,
+		OpenVPNControlSoftResetV1,
+		OpenVPNControlV1,
+		OpenVPNAckV1,
+		OpenVPNDataV1,
+		OpenVPNControlHardResetClientV2,
+		OpenVPNControlHardResetServerV2,
+		OpenVPNDataV2,
+		OpenVPNControlHardResetClientV3,
+		OpenVPNControlWkcV1:
+		return true
+	}
+	return false
+}
--- a/analyzer/udp/quic.go
+++ b/analyzer/udp/quic.go
@@ -0,0 +1,81 @@
+package udp
+
+import (
+	"git.difuse.io/Difuse/Mellaris/analyzer"
+	"git.difuse.io/Difuse/Mellaris/analyzer/internal"
+	"git.difuse.io/Difuse/Mellaris/analyzer/udp/internal/quic"
+	"git.difuse.io/Difuse/Mellaris/analyzer/utils"
+)
+
+const (
+	quicInvalidCountThreshold = 4
+)
+
+var (
+	_ analyzer.UDPAnalyzer = (*QUICAnalyzer)(nil)
+	_ analyzer.UDPStream   = (*quicStream)(nil)
+)
+
+type QUICAnalyzer struct{}
+
+func (a *QUICAnalyzer) Name() string {
+	return "quic"
+}
+
+func (a *QUICAnalyzer) Limit() int {
+	return 0
+}
+
+func (a *QUICAnalyzer) NewUDP(info analyzer.UDPInfo, logger analyzer.Logger) analyzer.UDPStream {
+	return &quicStream{logger: logger}
+}
+
+type quicStream struct {
+	logger       analyzer.Logger
+	invalidCount int
+}
+
+func (s *quicStream) Feed(rev bool, data []byte) (u *analyzer.PropUpdate, done bool) {
+	// minimal data size: protocol version (2 bytes) + random (32 bytes) +
+	//   + session ID (1 byte) + cipher suites (4 bytes) +
+	//   + compression methods (2 bytes) + no extensions
+	const minDataSize = 41
+
+	if rev {
+		// We don't support server direction for now
+		s.invalidCount++
+		return nil, s.invalidCount >= quicInvalidCountThreshold
+	}
+
+	pl, err := quic.ReadCryptoPayload(data)
+	if err != nil || len(pl) < 4 { // FIXME: isn't length checked inside quic.ReadCryptoPayload? Also, what about error handling?
+		s.invalidCount++
+		return nil, s.invalidCount >= quicInvalidCountThreshold
+	}
+
+	if pl[0] != internal.TypeClientHello {
+		s.invalidCount++
+		return nil, s.invalidCount >= quicInvalidCountThreshold
+	}
+
+	chLen := int(pl[1])<<16 | int(pl[2])<<8 | int(pl[3])
+	if chLen < minDataSize {
+		s.invalidCount++
+		return nil, s.invalidCount >= quicInvalidCountThreshold
+	}
+
+	m := internal.ParseTLSClientHelloMsgData(&utils.ByteBuffer{Buf: pl[4:]})
+	if m == nil {
+		s.invalidCount++
+		return nil, s.invalidCount >= quicInvalidCountThreshold
+	}
+
+	return &analyzer.PropUpdate{
+		Type: analyzer.PropUpdateMerge,
+		M:    analyzer.PropMap{"req": m},
+	}, true
+}
+
+func (s *quicStream) Close(limited bool) *analyzer.PropUpdate {
+	return nil
+}
--- a/analyzer/udp/quic_test.go
+++ b/analyzer/udp/quic_test.go
@@ -0,0 +1,58 @@
+package udp
+
+import (
+	"reflect"
+	"testing"
+
+	"git.difuse.io/Difuse/Mellaris/analyzer"
+)
+
+func TestQuicStreamParsing_ClientHello(t *testing.T) {
+	// example packet taken from <https://quic.xargs.org/#client-initial-packet/annotated>
+	clientHello := make([]byte, 1200)
+	clientInitial := []byte{
+		0xcd, 0x00, 0x00, 0x00, 0x01, 0x08, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05,
+		0x06, 0x07, 0x05, 0x63, 0x5f, 0x63, 0x69, 0x64, 0x00, 0x41, 0x03, 0x98,
+		0x1c, 0x36, 0xa7, 0xed, 0x78, 0x71, 0x6b, 0xe9, 0x71, 0x1b, 0xa4, 0x98,
+		0xb7, 0xed, 0x86, 0x84, 0x43, 0xbb, 0x2e, 0x0c, 0x51, 0x4d, 0x4d, 0x84,
+		0x8e, 0xad, 0xcc, 0x7a, 0x00, 0xd2, 0x5c, 0xe9, 0xf9, 0xaf, 0xa4, 0x83,
+		0x97, 0x80, 0x88, 0xde, 0x83, 0x6b, 0xe6, 0x8c, 0x0b, 0x32, 0xa2, 0x45,
+		0x95, 0xd7, 0x81, 0x3e, 0xa5, 0x41, 0x4a, 0x91, 0x99, 0x32, 0x9a, 0x6d,
+		0x9f, 0x7f, 0x76, 0x0d, 0xd8, 0xbb, 0x24, 0x9b, 0xf3, 0xf5, 0x3d, 0x9a,
+		0x77, 0xfb, 0xb7, 0xb3, 0x95, 0xb8, 0xd6, 0x6d, 0x78, 0x79, 0xa5, 0x1f,
+		0xe5, 0x9e, 0xf9, 0x60, 0x1f, 0x79, 0x99, 0x8e, 0xb3, 0x56, 0x8e, 0x1f,
+		0xdc, 0x78, 0x9f, 0x64, 0x0a, 0xca, 0xb3, 0x85, 0x8a, 0x82, 0xef, 0x29,
+		0x30, 0xfa, 0x5c, 0xe1, 0x4b, 0x5b, 0x9e, 0xa0, 0xbd, 0xb2, 0x9f, 0x45,
+		0x72, 0xda, 0x85, 0xaa, 0x3d, 0xef, 0x39, 0xb7, 0xef, 0xaf, 0xff, 0xa0,
+		0x74, 0xb9, 0x26, 0x70, 0x70, 0xd5, 0x0b, 0x5d, 0x07, 0x84, 0x2e, 0x49,
+		0xbb, 0xa3, 0xbc, 0x78, 0x7f, 0xf2, 0x95, 0xd6, 0xae, 0x3b, 0x51, 0x43,
+		0x05, 0xf1, 0x02, 0xaf, 0xe5, 0xa0, 0x47, 0xb3, 0xfb, 0x4c, 0x99, 0xeb,
+		0x92, 0xa2, 0x74, 0xd2, 0x44, 0xd6, 0x04, 0x92, 0xc0, 0xe2, 0xe6, 0xe2,
+		0x12, 0xce, 0xf0, 0xf9, 0xe3, 0xf6, 0x2e, 0xfd, 0x09, 0x55, 0xe7, 0x1c,
+		0x76, 0x8a, 0xa6, 0xbb, 0x3c, 0xd8, 0x0b, 0xbb, 0x37, 0x55, 0xc8, 0xb7,
+		0xeb, 0xee, 0x32, 0x71, 0x2f, 0x40, 0xf2, 0x24, 0x51, 0x19, 0x48, 0x70,
+		0x21, 0xb4, 0xb8, 0x4e, 0x15, 0x65, 0xe3, 0xca, 0x31, 0x96, 0x7a, 0xc8,
+		0x60, 0x4d, 0x40, 0x32, 0x17, 0x0d, 0xec, 0x28, 0x0a, 0xee, 0xfa, 0x09,
+		0x5d, 0x08, 0xb3, 0xb7, 0x24, 0x1e, 0xf6, 0x64, 0x6a, 0x6c, 0x86, 0xe5,
+		0xc6, 0x2c, 0xe0, 0x8b, 0xe0, 0x99,
+	}
+	copy(clientHello, clientInitial)
+
+	want := analyzer.PropMap{
+		"alpn":               []string{"ping/1.0"},
+		"ciphers":            []uint16{4865, 4866, 4867},
+		"compression":        []uint8{0},
+		"random":             []uint8{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31},
+		"session":            []uint8{},
+		"sni":                "example.ulfheim.net",
+		"supported_versions": []uint16{772},
+		"version":            uint16(771),
+	}
+
+	s := quicStream{}
+	u, _ := s.Feed(false, clientHello)
+	got := u.M.Get("req")
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("%d B parsed = %v, want %v", len(clientHello), got, want)
+	}
+}
--- a/analyzer/udp/wireguard.go
+++ b/analyzer/udp/wireguard.go
@@ -0,0 +1,217 @@
+package udp
+
+import (
+	"container/ring"
+	"encoding/binary"
+	"slices"
+	"sync"
+
+	"git.difuse.io/Difuse/Mellaris/analyzer"
+)
+
+var (
+	_ analyzer.UDPAnalyzer = (*WireGuardAnalyzer)(nil)
+	_ analyzer.UDPStream   = (*wireGuardUDPStream)(nil)
+)
+
+const (
+	wireguardUDPInvalidCountThreshold = 4
+	wireguardRememberedIndexCount     = 6
+	wireguardPropKeyMessageType       = "message_type"
+)
+
+const (
+	wireguardTypeHandshakeInitiation = 1
+	wireguardTypeHandshakeResponse   = 2
+	wireguardTypeData                = 4
+	wireguardTypeCookieReply         = 3
+)
+
+const (
+	wireguardSizeHandshakeInitiation = 148
+	wireguardSizeHandshakeResponse   = 92
+	wireguardMinSizePacketData       = 32 // 16 bytes header + 16 bytes AEAD overhead
+	wireguardSizePacketCookieReply   = 64
+)
+
+type WireGuardAnalyzer struct{}
+
+func (a *WireGuardAnalyzer) Name() string {
+	return "wireguard"
+}
+
+func (a *WireGuardAnalyzer) Limit() int {
+	return 0
+}
+
+func (a *WireGuardAnalyzer) NewUDP(info analyzer.UDPInfo, logger analyzer.Logger) analyzer.UDPStream {
+	return newWireGuardUDPStream(logger)
+}
+
+type wireGuardUDPStream struct {
+	logger                analyzer.Logger
+	invalidCount          int
+	rememberedIndexes     *ring.Ring
+	rememberedIndexesLock sync.RWMutex
+}
+
+func newWireGuardUDPStream(logger analyzer.Logger) *wireGuardUDPStream {
+	return &wireGuardUDPStream{
+		logger:            logger,
+		rememberedIndexes: ring.New(wireguardRememberedIndexCount),
+	}
+}
+
+func (s *wireGuardUDPStream) Feed(rev bool, data []byte) (u *analyzer.PropUpdate, done bool) {
+	m := s.parseWireGuardPacket(rev, data)
+	if m == nil {
+		s.invalidCount++
+		return nil, s.invalidCount >= wireguardUDPInvalidCountThreshold
+	}
+	s.invalidCount = 0 // Reset invalid count on valid WireGuard packet
+	messageType := m[wireguardPropKeyMessageType].(byte)
+	propUpdateType := analyzer.PropUpdateMerge
+	if messageType == wireguardTypeHandshakeInitiation {
+		propUpdateType = analyzer.PropUpdateReplace
+	}
+	return &analyzer.PropUpdate{
+		Type: propUpdateType,
+		M:    m,
+	}, false
+}
+
+func (s *wireGuardUDPStream) Close(limited bool) *analyzer.PropUpdate {
+	return nil
+}
+
+func (s *wireGuardUDPStream) parseWireGuardPacket(rev bool, data []byte) analyzer.PropMap {
+	if len(data) < 4 {
+		return nil
+	}
+	if slices.Max(data[1:4]) != 0 {
+		return nil
+	}
+
+	messageType := data[0]
+	var propKey string
+	var propValue analyzer.PropMap
+	switch messageType {
+	case wireguardTypeHandshakeInitiation:
+		propKey = "handshake_initiation"
+		propValue = s.parseWireGuardHandshakeInitiation(rev, data)
+	case wireguardTypeHandshakeResponse:
+		propKey = "handshake_response"
+		propValue = s.parseWireGuardHandshakeResponse(rev, data)
+	case wireguardTypeData:
+		propKey = "packet_data"
+		propValue = s.parseWireGuardPacketData(rev, data)
+	case wireguardTypeCookieReply:
+		propKey = "packet_cookie_reply"
+		propValue = s.parseWireGuardPacketCookieReply(rev, data)
+	}
+	if propValue == nil {
+		return nil
+	}
+
+	m := make(analyzer.PropMap)
+	m[wireguardPropKeyMessageType] = messageType
+	m[propKey] = propValue
+	return m
+}
+
+func (s *wireGuardUDPStream) parseWireGuardHandshakeInitiation(rev bool, data []byte) analyzer.PropMap {
+	if len(data) != wireguardSizeHandshakeInitiation {
+		return nil
+	}
+	m := make(analyzer.PropMap)
+
+	senderIndex := binary.LittleEndian.Uint32(data[4:8])
+	m["sender_index"] = senderIndex
+	s.putSenderIndex(rev, senderIndex)
+
+	return m
+}
+
+func (s *wireGuardUDPStream) parseWireGuardHandshakeResponse(rev bool, data []byte) analyzer.PropMap {
+	if len(data) != wireguardSizeHandshakeResponse {
+		return nil
+	}
+	m := make(analyzer.PropMap)
+
+	senderIndex := binary.LittleEndian.Uint32(data[4:8])
+	m["sender_index"] = senderIndex
+	s.putSenderIndex(rev, senderIndex)
+
+	receiverIndex := binary.LittleEndian.Uint32(data[8:12])
+	m["receiver_index"] = receiverIndex
+	m["receiver_index_matched"] = s.matchReceiverIndex(rev, receiverIndex)
+
+	return m
+}
+
+func (s *wireGuardUDPStream) parseWireGuardPacketData(rev bool, data []byte) analyzer.PropMap {
+	if len(data) < wireguardMinSizePacketData {
+		return nil
+	}
+	if len(data)%16 != 0 {
+		// WireGuard zero padding the packet to make the length a multiple of 16
+		return nil
+	}
+	m := make(analyzer.PropMap)
+
+	receiverIndex := binary.LittleEndian.Uint32(data[4:8])
+	m["receiver_index"] = receiverIndex
+	m["receiver_index_matched"] = s.matchReceiverIndex(rev, receiverIndex)
+
+	m["counter"] = binary.LittleEndian.Uint64(data[8:16])
+
+	return m
+}
+
+func (s *wireGuardUDPStream) parseWireGuardPacketCookieReply(rev bool, data []byte) analyzer.PropMap {
+	if len(data) != wireguardSizePacketCookieReply {
+		return nil
+	}
+	m := make(analyzer.PropMap)
+
+	receiverIndex := binary.LittleEndian.Uint32(data[4:8])
+	m["receiver_index"] = receiverIndex
+	m["receiver_index_matched"] = s.matchReceiverIndex(rev, receiverIndex)
+
+	return m
+}
+
+type wireGuardIndex struct {
+	SenderIndex uint32
+	Reverse     bool
+}
+
+func (s *wireGuardUDPStream) putSenderIndex(rev bool, senderIndex uint32) {
+	s.rememberedIndexesLock.Lock()
+	defer s.rememberedIndexesLock.Unlock()
+
+	s.rememberedIndexes.Value = &wireGuardIndex{
+		SenderIndex: senderIndex,
+		Reverse:     rev,
+	}
+	s.rememberedIndexes = s.rememberedIndexes.Prev()
+}
+
+func (s *wireGuardUDPStream) matchReceiverIndex(rev bool, receiverIndex uint32) bool {
+	s.rememberedIndexesLock.RLock()
+	defer s.rememberedIndexesLock.RUnlock()
+
+	var found bool
+	ris := s.rememberedIndexes
+	for it := ris.Next(); it != ris; it = it.Next() {
+		if it.Value == nil {
+			break
+		}
+		wgidx := it.Value.(*wireGuardIndex)
+		if wgidx.Reverse == !rev && wgidx.SenderIndex == receiverIndex {
+			found = true
+			break
+		}
+	}
+	return found
+}
--- a/analyzer/utils/bytebuffer.go
+++ b/analyzer/utils/bytebuffer.go
@@ -0,0 +1,99 @@
+package utils
+
+import "bytes"
+
+type ByteBuffer struct {
+	Buf []byte
+}
+
+func (b *ByteBuffer) Append(data []byte) {
+	b.Buf = append(b.Buf, data...)
+}
+
+func (b *ByteBuffer) Len() int {
+	return len(b.Buf)
+}
+
+func (b *ByteBuffer) Index(sep []byte) int {
+	return bytes.Index(b.Buf, sep)
+}
+
+func (b *ByteBuffer) Get(length int, consume bool) (data []byte, ok bool) {
+	if len(b.Buf) < length {
+		return nil, false
+	}
+	data = b.Buf[:length]
+	if consume {
+		b.Buf = b.Buf[length:]
+	}
+	return data, true
+}
+
+func (b *ByteBuffer) GetString(length int, consume bool) (string, bool) {
+	data, ok := b.Get(length, consume)
+	if !ok {
+		return "", false
+	}
+	return string(data), true
+}
+
+func (b *ByteBuffer) GetByte(consume bool) (byte, bool) {
+	data, ok := b.Get(1, consume)
+	if !ok {
+		return 0, false
+	}
+	return data[0], true
+}
+
+func (b *ByteBuffer) GetUint16(littleEndian, consume bool) (uint16, bool) {
+	data, ok := b.Get(2, consume)
+	if !ok {
+		return 0, false
+	}
+	if littleEndian {
+		return uint16(data[0]) | uint16(data[1])<<8, true
+	}
+	return uint16(data[1]) | uint16(data[0])<<8, true
+}
+
+func (b *ByteBuffer) GetUint32(littleEndian, consume bool) (uint32, bool) {
+	data, ok := b.Get(4, consume)
+	if !ok {
+		return 0, false
+	}
+	if littleEndian {
+		return uint32(data[0]) | uint32(data[1])<<8 | uint32(data[2])<<16 | uint32(data[3])<<24, true
+	}
+	return uint32(data[3]) | uint32(data[2])<<8 | uint32(data[1])<<16 | uint32(data[0])<<24, true
+}
+
+func (b *ByteBuffer) GetUntil(sep []byte, includeSep, consume bool) (data []byte, ok bool) {
+	index := b.Index(sep)
+	if index == -1 {
+		return nil, false
+	}
+	if includeSep {
+		index += len(sep)
+	}
+	return b.Get(index, consume)
+}
+
+func (b *ByteBuffer) GetSubBuffer(length int, consume bool) (sub *ByteBuffer, ok bool) {
+	data, ok := b.Get(length, consume)
+	if !ok {
+		return nil, false
+	}
+	return &ByteBuffer{Buf: data}, true
+}
+
+func (b *ByteBuffer) Skip(length int) bool {
+	if len(b.Buf) < length {
+		return false
+	}
+	b.Buf = b.Buf[length:]
+	return true
+}
+
+func (b *ByteBuffer) Reset() {
+	b.Buf = nil
+}
--- a/analyzer/utils/lsm.go
+++ b/analyzer/utils/lsm.go
@@ -0,0 +1,54 @@
+package utils
+
+type LSMAction int
+
+const (
+	LSMActionPause LSMAction = iota
+	LSMActionNext
+	LSMActionReset
+	LSMActionCancel
+)
+
+type LinearStateMachine struct {
+	Steps []func() LSMAction
+
+	index     int
+	cancelled bool
+}
+
+func NewLinearStateMachine(steps ...func() LSMAction) *LinearStateMachine {
+	return &LinearStateMachine{
+		Steps: steps,
+	}
+}
+
+// Run runs the state machine until it pauses, finishes or is cancelled.
+func (lsm *LinearStateMachine) Run() (cancelled bool, done bool) {
+	if lsm.index >= len(lsm.Steps) {
+		return lsm.cancelled, true
+	}
+	for lsm.index < len(lsm.Steps) {
+		action := lsm.Steps[lsm.index]()
+		switch action {
+		case LSMActionPause:
+			return false, false
+		case LSMActionNext:
+			lsm.index++
+		case LSMActionReset:
+			lsm.index = 0
+		case LSMActionCancel:
+			lsm.cancelled = true
+			return true, true
+		}
+	}
+	return false, true
+}
+
+func (lsm *LinearStateMachine) AppendSteps(steps ...func() LSMAction) {
+	lsm.Steps = append(lsm.Steps, steps...)
+}
+
+func (lsm *LinearStateMachine) Reset() {
+	lsm.index = 0
+	lsm.cancelled = false
+}
--- a/analyzer/utils/string.go
+++ b/analyzer/utils/string.go
@@ -0,0 +1,9 @@
+package utils
+
+func ByteSlicesToStrings(bss [][]byte) []string {
+	ss := make([]string, len(bss))
+	for i, bs := range bss {
+		ss[i] = string(bs)
+	}
+	return ss
+}
				`@@ -0,0 +1 @@`
				`The code here is from https://github.com/cuonglm/quicsni with various modifications.`