diff --git a/extras/sniff/.mockery.yaml b/extras/sniff/.mockery.yaml
new file mode 100644
index 0000000..c866d1d
--- /dev/null
+++ b/extras/sniff/.mockery.yaml
@@ -0,0 +1,12 @@
+with-expecter: true
+dir: .
+outpkg: sniff
+packages:
+  github.com/apernet/quic-go:
+    interfaces:
+      Stream:
+        config:
+          mockname: mockStream
+          replace-type: # internal package alias dirty fix
+            - github.com/apernet/quic-go/internal/protocol=github.com/apernet/quic-go
+            - github.com/apernet/quic-go/internal/qerr=github.com/apernet/quic-go
diff --git a/extras/sniff/mock_Stream.go b/extras/sniff/mock_Stream.go
new file mode 100644
index 0000000..8b21e95
--- /dev/null
+++ b/extras/sniff/mock_Stream.go
@@ -0,0 +1,492 @@
+// Code generated by mockery v2.43.0. DO NOT EDIT.
+
+package sniff
+
+import (
+	context "context"
+
+	qerr "github.com/apernet/quic-go"
+	mock "github.com/stretchr/testify/mock"
+
+	time "time"
+)
+
+// mockStream is an autogenerated mock type for the Stream type
+type mockStream struct {
+	mock.Mock
+}
+
+type mockStream_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *mockStream) EXPECT() *mockStream_Expecter {
+	return &mockStream_Expecter{mock: &_m.Mock}
+}
+
+// CancelRead provides a mock function with given fields: _a0
+func (_m *mockStream) CancelRead(_a0 qerr.StreamErrorCode) {
+	_m.Called(_a0)
+}
+
+// mockStream_CancelRead_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'CancelRead'
+type mockStream_CancelRead_Call struct {
+	*mock.Call
+}
+
+// CancelRead is a helper method to define mock.On call
+//   - _a0 qerr.StreamErrorCode
+func (_e *mockStream_Expecter) CancelRead(_a0 interface{}) *mockStream_CancelRead_Call {
+	return &mockStream_CancelRead_Call{Call: _e.mock.On("CancelRead", _a0)}
+}
+
+func (_c *mockStream_CancelRead_Call) Run(run func(_a0 qerr.StreamErrorCode)) *mockStream_CancelRead_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(qerr.StreamErrorCode))
+	})
+	return _c
+}
+
+func (_c *mockStream_CancelRead_Call) Return() *mockStream_CancelRead_Call {
+	_c.Call.Return()
+	return _c
+}
+
+func (_c *mockStream_CancelRead_Call) RunAndReturn(run func(qerr.StreamErrorCode)) *mockStream_CancelRead_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// CancelWrite provides a mock function with given fields: _a0
+func (_m *mockStream) CancelWrite(_a0 qerr.StreamErrorCode) {
+	_m.Called(_a0)
+}
+
+// mockStream_CancelWrite_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'CancelWrite'
+type mockStream_CancelWrite_Call struct {
+	*mock.Call
+}
+
+// CancelWrite is a helper method to define mock.On call
+//   - _a0 qerr.StreamErrorCode
+func (_e *mockStream_Expecter) CancelWrite(_a0 interface{}) *mockStream_CancelWrite_Call {
+	return &mockStream_CancelWrite_Call{Call: _e.mock.On("CancelWrite", _a0)}
+}
+
+func (_c *mockStream_CancelWrite_Call) Run(run func(_a0 qerr.StreamErrorCode)) *mockStream_CancelWrite_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(qerr.StreamErrorCode))
+	})
+	return _c
+}
+
+func (_c *mockStream_CancelWrite_Call) Return() *mockStream_CancelWrite_Call {
+	_c.Call.Return()
+	return _c
+}
+
+func (_c *mockStream_CancelWrite_Call) RunAndReturn(run func(qerr.StreamErrorCode)) *mockStream_CancelWrite_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Close provides a mock function with given fields:
+func (_m *mockStream) Close() error {
+	ret := _m.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for Close")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func() error); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// mockStream_Close_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Close'
+type mockStream_Close_Call struct {
+	*mock.Call
+}
+
+// Close is a helper method to define mock.On call
+func (_e *mockStream_Expecter) Close() *mockStream_Close_Call {
+	return &mockStream_Close_Call{Call: _e.mock.On("Close")}
+}
+
+func (_c *mockStream_Close_Call) Run(run func()) *mockStream_Close_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *mockStream_Close_Call) Return(_a0 error) *mockStream_Close_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *mockStream_Close_Call) RunAndReturn(run func() error) *mockStream_Close_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Context provides a mock function with given fields:
+func (_m *mockStream) Context() context.Context {
+	ret := _m.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for Context")
+	}
+
+	var r0 context.Context
+	if rf, ok := ret.Get(0).(func() context.Context); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(context.Context)
+		}
+	}
+
+	return r0
+}
+
+// mockStream_Context_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Context'
+type mockStream_Context_Call struct {
+	*mock.Call
+}
+
+// Context is a helper method to define mock.On call
+func (_e *mockStream_Expecter) Context() *mockStream_Context_Call {
+	return &mockStream_Context_Call{Call: _e.mock.On("Context")}
+}
+
+func (_c *mockStream_Context_Call) Run(run func()) *mockStream_Context_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *mockStream_Context_Call) Return(_a0 context.Context) *mockStream_Context_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *mockStream_Context_Call) RunAndReturn(run func() context.Context) *mockStream_Context_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Read provides a mock function with given fields: p
+func (_m *mockStream) Read(p []byte) (int, error) {
+	ret := _m.Called(p)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Read")
+	}
+
+	var r0 int
+	var r1 error
+	if rf, ok := ret.Get(0).(func([]byte) (int, error)); ok {
+		return rf(p)
+	}
+	if rf, ok := ret.Get(0).(func([]byte) int); ok {
+		r0 = rf(p)
+	} else {
+		r0 = ret.Get(0).(int)
+	}
+
+	if rf, ok := ret.Get(1).(func([]byte) error); ok {
+		r1 = rf(p)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// mockStream_Read_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Read'
+type mockStream_Read_Call struct {
+	*mock.Call
+}
+
+// Read is a helper method to define mock.On call
+//   - p []byte
+func (_e *mockStream_Expecter) Read(p interface{}) *mockStream_Read_Call {
+	return &mockStream_Read_Call{Call: _e.mock.On("Read", p)}
+}
+
+func (_c *mockStream_Read_Call) Run(run func(p []byte)) *mockStream_Read_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].([]byte))
+	})
+	return _c
+}
+
+func (_c *mockStream_Read_Call) Return(n int, err error) *mockStream_Read_Call {
+	_c.Call.Return(n, err)
+	return _c
+}
+
+func (_c *mockStream_Read_Call) RunAndReturn(run func([]byte) (int, error)) *mockStream_Read_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// SetDeadline provides a mock function with given fields: t
+func (_m *mockStream) SetDeadline(t time.Time) error {
+	ret := _m.Called(t)
+
+	if len(ret) == 0 {
+		panic("no return value specified for SetDeadline")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(time.Time) error); ok {
+		r0 = rf(t)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// mockStream_SetDeadline_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'SetDeadline'
+type mockStream_SetDeadline_Call struct {
+	*mock.Call
+}
+
+// SetDeadline is a helper method to define mock.On call
+//   - t time.Time
+func (_e *mockStream_Expecter) SetDeadline(t interface{}) *mockStream_SetDeadline_Call {
+	return &mockStream_SetDeadline_Call{Call: _e.mock.On("SetDeadline", t)}
+}
+
+func (_c *mockStream_SetDeadline_Call) Run(run func(t time.Time)) *mockStream_SetDeadline_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(time.Time))
+	})
+	return _c
+}
+
+func (_c *mockStream_SetDeadline_Call) Return(_a0 error) *mockStream_SetDeadline_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *mockStream_SetDeadline_Call) RunAndReturn(run func(time.Time) error) *mockStream_SetDeadline_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// SetReadDeadline provides a mock function with given fields: t
+func (_m *mockStream) SetReadDeadline(t time.Time) error {
+	ret := _m.Called(t)
+
+	if len(ret) == 0 {
+		panic("no return value specified for SetReadDeadline")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(time.Time) error); ok {
+		r0 = rf(t)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// mockStream_SetReadDeadline_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'SetReadDeadline'
+type mockStream_SetReadDeadline_Call struct {
+	*mock.Call
+}
+
+// SetReadDeadline is a helper method to define mock.On call
+//   - t time.Time
+func (_e *mockStream_Expecter) SetReadDeadline(t interface{}) *mockStream_SetReadDeadline_Call {
+	return &mockStream_SetReadDeadline_Call{Call: _e.mock.On("SetReadDeadline", t)}
+}
+
+func (_c *mockStream_SetReadDeadline_Call) Run(run func(t time.Time)) *mockStream_SetReadDeadline_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(time.Time))
+	})
+	return _c
+}
+
+func (_c *mockStream_SetReadDeadline_Call) Return(_a0 error) *mockStream_SetReadDeadline_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *mockStream_SetReadDeadline_Call) RunAndReturn(run func(time.Time) error) *mockStream_SetReadDeadline_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// SetWriteDeadline provides a mock function with given fields: t
+func (_m *mockStream) SetWriteDeadline(t time.Time) error {
+	ret := _m.Called(t)
+
+	if len(ret) == 0 {
+		panic("no return value specified for SetWriteDeadline")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(time.Time) error); ok {
+		r0 = rf(t)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// mockStream_SetWriteDeadline_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'SetWriteDeadline'
+type mockStream_SetWriteDeadline_Call struct {
+	*mock.Call
+}
+
+// SetWriteDeadline is a helper method to define mock.On call
+//   - t time.Time
+func (_e *mockStream_Expecter) SetWriteDeadline(t interface{}) *mockStream_SetWriteDeadline_Call {
+	return &mockStream_SetWriteDeadline_Call{Call: _e.mock.On("SetWriteDeadline", t)}
+}
+
+func (_c *mockStream_SetWriteDeadline_Call) Run(run func(t time.Time)) *mockStream_SetWriteDeadline_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(time.Time))
+	})
+	return _c
+}
+
+func (_c *mockStream_SetWriteDeadline_Call) Return(_a0 error) *mockStream_SetWriteDeadline_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *mockStream_SetWriteDeadline_Call) RunAndReturn(run func(time.Time) error) *mockStream_SetWriteDeadline_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// StreamID provides a mock function with given fields:
+func (_m *mockStream) StreamID() qerr.StreamID {
+	ret := _m.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for StreamID")
+	}
+
+	var r0 qerr.StreamID
+	if rf, ok := ret.Get(0).(func() qerr.StreamID); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(qerr.StreamID)
+	}
+
+	return r0
+}
+
+// mockStream_StreamID_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'StreamID'
+type mockStream_StreamID_Call struct {
+	*mock.Call
+}
+
+// StreamID is a helper method to define mock.On call
+func (_e *mockStream_Expecter) StreamID() *mockStream_StreamID_Call {
+	return &mockStream_StreamID_Call{Call: _e.mock.On("StreamID")}
+}
+
+func (_c *mockStream_StreamID_Call) Run(run func()) *mockStream_StreamID_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *mockStream_StreamID_Call) Return(_a0 qerr.StreamID) *mockStream_StreamID_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *mockStream_StreamID_Call) RunAndReturn(run func() qerr.StreamID) *mockStream_StreamID_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Write provides a mock function with given fields: p
+func (_m *mockStream) Write(p []byte) (int, error) {
+	ret := _m.Called(p)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Write")
+	}
+
+	var r0 int
+	var r1 error
+	if rf, ok := ret.Get(0).(func([]byte) (int, error)); ok {
+		return rf(p)
+	}
+	if rf, ok := ret.Get(0).(func([]byte) int); ok {
+		r0 = rf(p)
+	} else {
+		r0 = ret.Get(0).(int)
+	}
+
+	if rf, ok := ret.Get(1).(func([]byte) error); ok {
+		r1 = rf(p)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// mockStream_Write_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Write'
+type mockStream_Write_Call struct {
+	*mock.Call
+}
+
+// Write is a helper method to define mock.On call
+//   - p []byte
+func (_e *mockStream_Expecter) Write(p interface{}) *mockStream_Write_Call {
+	return &mockStream_Write_Call{Call: _e.mock.On("Write", p)}
+}
+
+func (_c *mockStream_Write_Call) Run(run func(p []byte)) *mockStream_Write_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].([]byte))
+	})
+	return _c
+}
+
+func (_c *mockStream_Write_Call) Return(n int, err error) *mockStream_Write_Call {
+	_c.Call.Return(n, err)
+	return _c
+}
+
+func (_c *mockStream_Write_Call) RunAndReturn(run func([]byte) (int, error)) *mockStream_Write_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// newMockStream creates a new instance of mockStream. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func newMockStream(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *mockStream {
+	mock := &mockStream{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/extras/sniff/sniff_test.go b/extras/sniff/sniff_test.go
new file mode 100644
index 0000000..fb86c3b
--- /dev/null
+++ b/extras/sniff/sniff_test.go
@@ -0,0 +1,126 @@
+package sniff
+
+import (
+	"encoding/base64"
+	"io"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+)
+
+func TestSnifferTCP(t *testing.T) {
+	sniffer := &Sniffer{
+		Timeout:       1 * time.Second,
+		RewriteDomain: false,
+	}
+
+	buf := &[]byte{}
+
+	// Test HTTP
+	*buf = []byte("POST /hello HTTP/1.1\r\n" +
+		"Host: example.com\r\n" +
+		"User-Agent: mamamiya\r\n" +
+		"Content-Length: 27\r\n" +
+		"Connection: keep-alive\r\n\r\n" +
+		"param1=value1&param2=value2")
+	index := 0
+	stream := &mockStream{}
+	stream.EXPECT().SetReadDeadline(mock.Anything).Return(nil)
+	stream.EXPECT().Read(mock.Anything).RunAndReturn(func(bs []byte) (int, error) {
+		if index < len(*buf) {
+			n := copy(bs, (*buf)[index:])
+			index += n
+			return n, nil
+		} else {
+			return 0, io.EOF
+		}
+	})
+
+	// Rewrite IP to domain
+	reqAddr := "111.111.111.111:80"
+	assert.True(t, sniffer.Check(false, reqAddr))
+	putback, err := sniffer.TCP(stream, &reqAddr)
+	assert.NoError(t, err)
+	assert.Equal(t, *buf, putback)
+	assert.Equal(t, "example.com:80", reqAddr)
+
+	// Do not rewrite if it's already a domain
+	index = 0
+	reqAddr = "gulag.cc:443"
+	assert.False(t, sniffer.Check(false, reqAddr))
+
+	// Turn on rewrite and now it should rewrite
+	sniffer.RewriteDomain = true
+	assert.True(t, sniffer.Check(false, reqAddr))
+
+	// Test TLS
+	*buf, err = base64.StdEncoding.DecodeString("FgMBARcBAAETAwPJL2jlt1OAo+Rslkjv/aqKiTthKMaCKg2Gvd+uALDbDCDdY+UIk8ouadEB9fC3j52Y1i7SJZqGIgBRIS6kKieYrAAoEwITAcAswCvAMMAvwCTAI8AowCfACsAJwBTAEwCdAJwAPQA8ADUALwEAAKIAAAAOAAwAAAlpcGluZm8uaW8ABQAFAQAAAAAAKwAJCAMEAwMDAgMBAA0AGgAYCAQIBQgGBAEFAQIBBAMFAwIDAgIGAQYDACMAAAAKAAgABgAdABcAGAAQAAsACQhodHRwLzEuMQAzACYAJAAdACBguQbqNJNyamYxYcrBFpBP7pWv5TgZsP9gwGtMYNKVBQAxAAAAFwAA/wEAAQAALQACAQE=")
+	assert.NoError(t, err)
+	index = 0
+	reqAddr = "222.222.222.222:443"
+	assert.True(t, sniffer.Check(false, reqAddr))
+	putback, err = sniffer.TCP(stream, &reqAddr)
+	assert.NoError(t, err)
+	assert.Equal(t, *buf, putback)
+	assert.Equal(t, "ipinfo.io:443", reqAddr)
+
+	// Test unrecognized 1
+	*buf = []byte("Wait It's All Ohio? Always Has Been.")
+	index = 0
+	reqAddr = "123.123.123.123:123"
+	assert.True(t, sniffer.Check(false, reqAddr))
+	putback, err = sniffer.TCP(stream, &reqAddr)
+	assert.NoError(t, err)
+	assert.Equal(t, *buf, putback)
+	assert.Equal(t, "123.123.123.123:123", reqAddr)
+
+	// Test unrecognized 2
+	*buf = []byte("\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a")
+	index = 0
+	reqAddr = "45.45.45.45:45"
+	assert.True(t, sniffer.Check(false, reqAddr))
+	putback, err = sniffer.TCP(stream, &reqAddr)
+	assert.NoError(t, err)
+	assert.Equal(t, []byte("\x01\x02\x03"), putback)
+	assert.Equal(t, "45.45.45.45:45", reqAddr)
+
+	// Test timeout
+	blockStream := &mockStream{}
+	blockStream.EXPECT().SetReadDeadline(mock.Anything).Return(nil)
+	blockStream.EXPECT().Read(mock.Anything).RunAndReturn(func(bs []byte) (int, error) {
+		time.Sleep(2 * time.Second)
+		return 0, io.EOF
+	})
+	reqAddr = "66.66.66.66:66"
+	assert.True(t, sniffer.Check(false, reqAddr))
+	putback, err = sniffer.TCP(blockStream, &reqAddr)
+	assert.NoError(t, err)
+	assert.Equal(t, []byte{}, putback)
+	assert.Equal(t, "66.66.66.66:66", reqAddr)
+}
+
+func TestSnifferUDP(t *testing.T) {
+	sniffer := &Sniffer{
+		Timeout:       1 * time.Second,
+		RewriteDomain: false,
+	}
+
+	// Test QUIC
+	reqAddr := "2.3.4.5:443"
+	assert.True(t, sniffer.Check(true, reqAddr))
+	pkt, err := base64.StdEncoding.DecodeString("ygAAAAEIwugWgPS7ulYAAES8hY891uwgGE9GG4CPOLd+nsDe28raso24lCSFmlFwYQG1uF39ikbL13/R9ZTghYmTl+jEbr6F9TxxRiOgpTmKRmh6aKZiIiVfy5pVRckovaI8lq0WRoW9xoFNTyYtQP8TVJ3bLCK+zUqpquEQSyWf7CE43ywayyMpE9UlIoPXFWCoopXLM1SvzdQ+17P51N9KR7m4emti4DWWTBLMQOvrwd2HEEkbiZdRO1wf6ZXJlIat5dN0R/6uod60OFPO+u+awvq67MoMReC7+5I/xWI+xx6o4JpnZNn6YPG8Gqi8hS6doNcAAdtD8h5eMLuHCCgkpX3QVjjfWtcOhtw9xKjU43HhUPwzUTv+JDLgwuTQCTmlfYlb3B+pk4b2I9si0tJ0SBuYaZ2VQPtZbj2hpGXw3gn11pbN8xsbKkQL50+Scd4dGJxWQlGaJHeaU5WOCkxLXc635z8m5XO/CBHVYPGp4pfwfwNUgbe5WF+3MaUIlDB8dMfsnrO0BmZPo379jVx0SFLTAiS8wAdHib1WNEY8qKYnTWuiyxYg1GZEhJt0nXmI+8f0eJq42DgHBWC+Rf5rRBr/Sf25o3mFAmTUaul0Woo9/CIrpT73B63N91xd9A77i4ru995YG8l9Hen+eLtpDU9Q9376nwMDYBzeYG9U/Rn0Urbm6q4hmAgV/xlNJ2rAyDS+yLnwqD6I0PRy8bZJEttcidb/SkOyrpgMiAzWeT+SO+c/k+Y8H0UTRa05faZUrhuUaym9wAcaIVRA6nFI+fejfjVp+7afFv+kWn3vCqQEij+CRHuxkltrixZMD2rfYj6NUW7TTYBtPRtuV/V0ZIDjRR26vr4K+0D84+l3c0mA/l6nmpP5kkco3nmpdjtQN6sGXL7+5o0nnsftX5d6/n5mLyEpP+AEDl1zk3iqkS62RsITwql6DMMoGbSDdUpMclCIeM0vlo3CkxGMO7QA9ruVeNddkL3EWMivl+uxO43sXEEqYQHVl4N75y63t05GOf7/gm9Kb/BJ8MpG9ViEkVYaskQCzi3D8bVpzo8FfTj8te8B6c3ikc/cm7r8k0ZcZpr+YiLGDYq+0ilHxpqJfmq8dPkSvxdzLcUSvy7+LMQ/TTobRSF7L4JhtDKck0+00vl9H35Tkh9N+MsVtpKdWyoqZ4XaK2Nx1M6AieczXpdFc0y7lYPoUfF4IeW8WzeVUclol5ElYjkyFz/lDOGAe1bF2g5AYaGWCPiGleVZknNdD5ihB8W8Mfkt1pEwq2S97AHrppqkf/VoIfZzeqH8wUFw8fDDrZIpnoa0rW7HfwIQaqJhPCyB9Z6TVbV4x9UWmaHfVAcinCK/7o10dtaj3rvEqcUC/iPceGq3Tqv/p9GGNJ+Ci2JBjXqNxYr893Llk75VdPD9pM6y1SM0P80oXNy32VMtafkFFST8GpvvqWcxUJ93kzaY8RmU1g3XFOImSU2utU6+FUQ2Pn5uLwcfT2cTYfTpPGh+WXjSbZ6trqdEMEsLHybuPo2UN4WpVLXVQma3kSaHQggcLlEip8GhEUAy/xCb2eKqhI4HkDpDjwDnDVKufWlnRaOHf58cc8Woi+WT8JTOkHC+nBEG6fKRPHDG08U5yayIQIjI")
+	assert.NoError(t, err)
+	err = sniffer.UDP(pkt, &reqAddr)
+	assert.NoError(t, err)
+	assert.Equal(t, "www.notion.so:443", reqAddr)
+
+	// Test unrecognized
+	pkt = []byte("oh my sweet summer child")
+	reqAddr = "90.90.90.90:90"
+	assert.True(t, sniffer.Check(true, reqAddr))
+	err = sniffer.UDP(pkt, &reqAddr)
+	assert.NoError(t, err)
+	assert.Equal(t, "90.90.90.90:90", reqAddr)
+}