This is not what the attackers did however. From the original article (not this one): > Traffic dump on port 5222, the connection is hijacked on application le

This is not what the attackers did however. From the original article (not this one): > Traffic dump on port 5222, the connection is hijacked on application level (L7), the server receives replaced ClientHello message from the client.