public static boolean looksLikeTlsToMe(byte[] data) {
        if (data.length != SNOOP_SIZE) {
            return false; // wrong data size for tls detection
        }
        if (data[0] != 22) {
            return false; // not tagged as tls handshake
        }
        if (data[1] != 3) {
            return false; // unknown major version
        }
        if ((data[2] != 1) && (data[2] != 3)) {
            return false; // unknown minor version
        }
        int frame_len = (data[3] & 0xff);
        frame_len = ((frame_len << 8) | (data[4] & 0xff));
        if (frame_len > (16384 + 2048)) {
            return false; // frame too large
        }
        if (frame_len < 4) {
            return false; // frame too small
        }
        if (data[5] != 0x1) {
            return false; // not tagges as client hello
        }
        int hello_len = (data[6] & 0xff);
        hello_len = ((hello_len << 8) | (data[7] & 0xff));
        hello_len = ((hello_len << 8) | (data[8] & 0xff));
        if ((frame_len - 4) != hello_len) {
            return false; // inconsistent sizes; frame vs client hello
        }
        return true;
    }
A crypto socket for the server side of a connection that
auto-detects whether the connection is tls encrypted or unencrypted
using clever heuristics. The assumption is that the client side
will send at least one RPC request before expecting anything from
the server. The first 9 bytes are inspected to see if they look
like part of a tls handshake or not (RPC packet headers are 12
bytes).
jrt/src/com/yahoo/jrt/MaybeTlsCryptoSocket.java