https://www.wireguard.com/protocol/ https://www.wireguard.com/protocol/ The initiator sends this message: msg = handshake_initiation { u8 message_type

https://www.wireguard.com/protocol/ https://www.wireguard.com/protocol/ The initiator sends this message: msg = handshake_initiation { u8 message_type u8 reserved_zero[3] u32 sender_index u8 unencrypted_ephemeral[32] u8 encrypted_static[AEAD_LEN(32)] u8 encrypted_timestamp[AEAD_LEN(12)] u8 mac1[16] u8 mac2[16] } msg.message_type = 1 msg.reserved_zero = { 0, 0, 0 } Seems like this is trivially detected. Just watch for first UDP packet with 01-00-00-00 bytes in the payload.